{"id":8229,"date":"2023-05-22T12:06:37","date_gmt":"2023-05-22T10:06:37","guid":{"rendered":"https:\/\/sternico.com\/data-protection-notices\/"},"modified":"2026-11-05T13:08:09","modified_gmt":"2026-11-05T12:08:09","slug":"data-protection-notices","status":"publish","type":"page","link":"https:\/\/sternico.com\/en\/data-protection-notices\/","title":{"rendered":"Data protection notices"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"8229\" class=\"elementor elementor-8229 elementor-1638\" data-elementor-post-type=\"page\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-91a02fe elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"91a02fe\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-239fb02\" data-id=\"239fb02\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-8a93f10 elementor-widget elementor-widget-heading\" data-id=\"8a93f10\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\"><a href=\"\/consulting-services\/\">Data protection notices<\/a><\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-49c26dc elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"49c26dc\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ffaa860\" data-id=\"ffaa860\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-ca20835 elementor-widget elementor-widget-text-editor\" data-id=\"ca20835\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h1>Privacy Policy<\/h1>\n<h2 id=\"m716\">Preamble<\/h2>\n<p>In this Privacy Policy, we aim to explain to you what types of your personal data (hereinafter also referred to simply as \u2018data\u2019) we process, for what purposes and to what extent. This Privacy Policy applies to all processing of personal data carried out by us, processing of personal data, both in the context of providing our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as the \u201conline offering\u201d).<\/p>\n<p>The terms used are not gender-specific.<\/p>\n<p>Last updated: 27 October 2026<\/p>\n<p class=\"seal\"><a href=\"https:\/\/datenschutz-generator.de\/\" title=\"Legal text by Dr Schwenke \u2013 please click for further information.\" target=\" _blank\" rel=\"noopener noreferrer nofollow\"><img fetchpriority=\"high\" decoding=\"async\" src=\"https:\/\/datenschutz-generator.de\/wp-content\/plugins\/ts-dsg\/images\/dsg-seal\/dsg-seal-pp-de.png\" alt=\"Legal text by Dr Schwenke \u2013 please click for further information.\" width=\"250\" height=\"250\"><\/a><\/p>\n<h2>Table of contents<\/h2>\n<ul class=\"index\">\n<li><a class=\"index-link\" href=\"#m716\">Preamble<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m3\">Data controller<\/a><\/li>\n<li><a class=\"index-link\" href=\"# m11\">Contact the Data Protection Officer<\/a><\/li>\n<li><a class=\"index-link\" href=\"#mOverview\">Overview of processing activities<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m2427\">Relevant legal bases<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m27\">Security measures<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m25\">Transfer of personal data<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m24\">International data transfers<\/a><\/li>\n<li><a class=\"index-link\" href=\"\u2018#m12\u2019\">General information on data storage and deletion<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m10\">Rights of data subjects<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m225\">Provision of the online service and web hosting<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m134\">Use of cookies<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m182\">Contact and enquiry management<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m735\">Video conferences, online meetings, webinars and screen sharing<\/a><\/li>\n<li><a class=\"index-link\" href=\"# m29\">Cloud services<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m263\">Web analytics, monitoring and optimisation<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m136\">Social media presence<\/a><\/li>\n<li><a class=\"index-link\" href=\"\u2018#m328\u2019\">Plug-ins, embedded functions and content<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m723\">Management, organisation and support tools<\/a><\/li>\n<li><a class=\"index-link\" href=\"\u2018#m210\u2019\">Application procedures<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m2324\">Data protection information for whistleblowers<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m4319\">Whistleblower systems<\/a><\/li>\n<li><a class=\"index -link\" href=\"#m15\">Amendments and updates<\/a><\/li>\n<li><a class=\"index-link\" href=\"#m42\">Definitions<\/a><\/li>\n<\/ul>\n<h2 id=\"m3\">Data controller<\/h2>\n<p>Sternico GmbH<br>Dreim\u00e4nnerstra\u00dfe 5<br>38 176 Wendeburg<\/p>\n<p>Authorised representatives: Dipl.-Ing. Sico Algermissen<\/p>\n<p>Email address: <a href=\"mailto:info@sternico.com\">info@sternico.com<\/a><\/p>\n<p>Telephone: +49 (5303) 97940<\/p>\n<p>Legal notice: <a href=\"https:\/\/sternico.com\/impressum\/\" target=\"_blank\">https:\/\/sternico.com\/impressum\/<\/a><\/p>\n<h2 id=\"m11\">Contact the Data Protection Officer<\/h2>\n<p>QS-Kornmann GmbH<br>Michael Kornmann<br>Sudetenstrasse 33<br>35625 H\u00fcttenberg<br>Telephone: 06403 9295287<br>Email: dsb@qs-kornmann.de <\/p>\n<h2 id=\"mOverview\">Overview of data processing<\/h2>\n<p>The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects.<\/p>\n<h3>Types of data processed<\/h3>\n<ul>\n<li>Master data.<\/li>\n<li>Employment <\/li>\n<li>Location data.<\/li>\n<li>Contact details.<\/li>\n<li>Content data. <\/li>\n<li>Contract data.<\/li>\n<li>Usage data.<\/li>\n<li>Meta, communication and procedural data.<\/li>\n<li>Applicant data.<\/li>\n<li>Image and\/or video recordings.<\/li>\n<li>Audio recordings.<\/li>\n<li>Log data.<\/li>\n<\/ul>\n<h3>Categories of data subjects<\/h3>\n<ul>\n<li>Service recipients and clients.<\/li>\n<li>Employees.<\/li>\n<li>Prospective clients.<\/li>\n<li>Communication partners.<\/li>\n<li>Users. <\/li>\n<li>Job applicants.<\/li>\n<li>Business and contractual partners.<\/li>\n<li>Participants.<\/li>\n<li>Persons depicted. <\/li>\n<li>Third parties.<\/li>\n<li>Whistleblowers.<\/li>\n<\/ul>\n<h3>Purposes of processing<\/h3>\n<ul>\n<li>Provision of contractual services and fulfilment of contractual obligations.<\/li>\n<li>Communication.<\/li>\n<li>Security measures. <\/li>\n<li>Audience measurement.<\/li>\n<li>Office and organisational procedures.<\/li>\n<li>Organisational and administrative procedures.<\/li>\n<li>Recruitment procedures. <\/li>\n<li>Feedback.<\/li>\n<li>Profiles containing user-related information.<\/li>\n<li>Provision of our online services and user-friendliness.<\/li>\n<li>IT infrastructure.<\/li>\n<li>Whistleblower protection.<\/li>\n<li>Public relations.<\/li>\n<\/ul>\n<h2 id=\"\u2018m2427\u2019\">Applicable legal bases<\/h2>\n<p><strong>Applicable legal bases under the GDPR: <\/strong>Below you will find an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations in your our country of residence or registered office may also apply. Furthermore, should more specific legal bases apply in individual cases, we will inform you of these in the privacy policy.<\/p>\n<ul>\n<li><strong>Consent (Art. 6(1), first sentence, point a) of the GDPR)<\/strong> \u2013 The data subject has given their consent to the processing of their personal data for a specific purpose or for several specific purposes.<\/li>\n<li><strong>Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR)<\/strong> \u2013 The processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject\u2019s request.<\/li>\n<li><strong>Legal obligation (Art. 6(1), first sentence, point (c) of the GDPR)<\/strong> \u2013 Processing is necessary for compliance with a legal obligation to which the controller is subject.<\/li>\n<li><strong>Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR)<\/strong> \u2013 the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that the interests, fundamental rights and freedoms of the data subject which require the protection of personal data do not override those interests. <\/li>\n<li><strong>The recruitment process as a pre-contractual or contractual relationship (Article 6(1), first sentence, point (b) of the GDPR)<\/strong> \u2013 Where, as part of the recruitment process, special categories of personal data within the meaning of Article 9(1) of the GDPR (e.g. e.g. health data, such as severe disability status or ethnic origin) are requested from applicants so that the controller or the data subject may exercise their rights arising from labour law and the law on social security and social protection and fulfil their obligations in this regard, such processing is carried out in accordance with Article 9(2)(b) GDPR; in the case of the protection of the vital interests of applicants or other individuals, in accordance with Article 9(2)(c) GDPR; or for the purposes of preventive healthcare or occupational medicine, for assessing an employee\u2019s fitness for work, for medical diagnosis, care or treatment in the health or social sector, or for the administration of systems and services in the health or social sector in accordance with Article 9(2)(h) of the GDPR. Where the provision of special categories of data is based on voluntary consent, such data is processed on the basis of Article 9(2)(a) GDPR.<\/li>\n<\/ul>\n<p><strong>National data protection regulations in Germany: <\/strong>In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. These include, in particular, the Federal Data Protection Act (BDSG). The BDSG contains, in particular, specific provisions on the right of access, the right to erasure , the right to object, the processing of special categories of personal data, processing for other purposes and the transfer of data, as well as automated decision-making in individual cases, including profiling. Furthermore, state data protection laws of the individual federal states may apply.<\/p>\n<p><strong>Note regarding the applicability of the GDPR and the Swiss Data Protection Act (DSG): <\/strong>This privacy notice serves to provide information in accordance with both the Swiss Data Protection Act (DSG) and the General Data Protection Regulation (GDPR). For this reason, please note that, due to their broader geographical scope and clarity, the terms used in the GDPR are employed. In particular, instead of the terms used in the Swiss Data Protection Act (DSG) \u2013 \u201cprocessing\u201d &#8221; of \u201cpersonal data\u201d, \u201coverriding interest\u201d and \u201cpersonal data requiring special protection\u201d, the terms used in the GDPR \u2013 \u201cprocessing\u201d of \u201cpersonal data\u201d, \u201clegitimate interest\u201d and \u201cspecial categories of data\u201d. However, the legal meaning of these terms continues to be determined in accordance with the Swiss Data Protection Act (DSG) within the scope of its application.<\/p>\n<h2 id=\"m27\">Security measures<\/h2>\n<p>We take appropriate measures legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and the purposes of the processing, as well as the varying likelihood and severity of threats to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk.<\/p>\n<p>These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access to, input of, disclosure of, safeguarding the availability of, and segregation of the data. Furthermore, we have established procedures to ensure that data subjects\u2019 rights are upheld, that data is deleted and that appropriate action is taken in the event of a data breach auml;. Furthermore, we take the protection of personal data into account right from the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and through privacy-friendly default settings.<\/p>\n<p>Securing online connections using TLS\/SSL encryption &amp; encryption technology (HTTPS): To protect users\u2019 data transmitted via our online services from unauthorised access, we rely on TLS\/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data &amp; transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user\u2019s browser (or between two servers) , thereby protecting the data from unauthorised access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL\/TLS certificate, this is indicated by the display of \u2018HTTPS\u2019 in the<br> URL. This serves as an indicator to users that their data is being transmitted securely and transmitted.<\/p>\n<h2 id=\"m25\">Transfer of personal data<\/h2>\n<p>In the course of our processing of personal data, it may occur that such data is transferred to or disclosed to other bodies, companies, legally independent organisational units or individuals. The recipients of this data may include, for example, service providers commissioned to carry out IT tasks or providers of services and content integrated into a website. In such cases, we comply with the statutory requirements and, in particular, enter into appropriate contracts or agreements which serve to protect your data, with the recipients of your data.<\/p>\n<h2 id=\"m24\">International data transfers<\/h2>\n<p>Data processing in third countries: Where we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in the context of using third-party services or the disclosure or transfer of data to other individuals, bodies or organisations (as indicated by the postal address of the relevant provider or where the privacy policy expressly refers to data transfers to third countries), this is always carried out in accordance with the statutory requirements.<\/p>\n<p>For data transfers to the USA, we primarily on the Data Privacy Framework (DPF), which was recognised as a safe legal framework by an adequacy decision of the European Commission dated 10 July 2023. In addition, we have entered into standard contractual clauses with the respective providers, which comply with the European Commission\u2019s requirements and set out contractual obligations to protect your data.<\/p>\n<p>This dual safeguard ensures comprehensive protection of your data: the DPF forms the primary level of protection, whilst the standard contractual clauses serve as an additional safeguard. Should any changes arise within the framework of the DPF, the standard contractual clauses will come into effect as a reliable fallback option. In this way, we ensure that your data remains adequately protected at all times, even in the event of any political or legal changes.<\/p>\n<p>For each individual service provider, we inform you whether they are certified under the DPF and whether standard contractual clauses are in place. Further information on the DPF and a list of certified companies can be found on the US Department of Commerce\u2019s website at <a href=\"https:\/\/www.dataprivacyframework.gov\/\" target=\"_blank\">https:\/\/www.dataprivacyframework.gov\/ <\/a> (in English).<\/p>\n<p>For data transfers to other third countries, appropriate safeguards apply, in particular standard contractual clauses, explicit consent or transfers required by law. Information on transfers to third countries and applicable adequacy decisions can be found on the European Commission\u2019s website: <a href=\"https:\/\/commission.europa.eu\/law\/law-topic\/data-protection\/international-dimension-data-protection_en?prefLang=de\" target=\"_blank\">https:\/\/ commission.europa.eu\/law\/law-topic\/data-protection\/international-dimension-data-protection_en?prefLang=de.<\/a><\/p>\n<h2 id=\"m12\">General information on data storage and erasure<\/h2>\n<p>We erase personal data that we process in accordance with the statutory provisions as soon as the underlying consents are withdrawn or there are no longer any legal grounds for processing. This applies to cases where the original purpose of processing ceases to apply or the data is no longer required. Exceptions to this rule apply where statutory obligations or specific interests require the data to be retained or archived for a longer period.<\/p>\n<p>In particular, Data which must be retained for commercial or tax law reasons, or where storage is necessary for the purposes of legal proceedings or to protect the rights of other natural or legal persons, must be archived accordingly.<\/p>\n<p>Our privacy policy contains further information on the retention and erasure of data that applies specifically to certain processing operations.<\/p>\n<p>Where there are multiple specifications regarding the retention period or erasure deadlines for a particular item of data, the longest period shall always apply. Data that is no longer retained for the original but is retained due to legal requirements or other reasons, we process it exclusively for the purposes that justify its retention.<\/p>\n<p>Retention and deletion deletion of data: The following general time limits apply to the retention and archiving of data under German law: <\/p>\n<ul>\n<li>10 years \u2013 retention period for books and records, annual accounts, inventories, management reports, opening balance sheets, as well as the working instructions and other organisational documents necessary for their understanding (Section<br> 147(1)(1) in conjunction with (3) of the German Fiscal Code (AO), Section 257(1)(1) in conjunction with (4) of the German Commercial Code (HGB)).<\/li>\n<li>10 years: Accounting documents, such as invoices and expense receipts (statutory retention period of 8 years pursuant to Section 147(1)(4) and (4a) in conjunction with para. 3, first sentence, of the German Fiscal Code (AO), Section 14b(1) of the German Value Added Tax Act (UStG), Section 257(1)(4) in conjunction with para. 4 of the German Commercial Code (HGB); in addition, 2 years on the basis of our legitimate interest in defending against legal claims, Article 6(1)(f) of the General Data Protection Regulation (GDPR)). <\/li>\n<li>6 years \u2013 Other business documents: commercial or business correspondence received, copies of commercial or business correspondence sent, other documents insofar as they are relevant for tax purposes, e.g. hourly pay slips, operational accounting sheets, costing documents, price labels, as well as payroll records, insofar as they are not already accounting vouchers, and cash register receipts (Section 147(1)(2), (3) and (5) in conjunction with paragraph 3 of the German Fiscal Code (AO), Section 257(1)(2) and (3) in conjunction with (4) of the German Commercial Code (HGB)).<\/li>\n<li>3 years \u2013 data required to take into account potential warranty and compensation claims or similar contractual claims and rights and to process related enquiries, based on previous business experience and standard industry practices, shall be stored for the duration of the standard statutory limitation period of three years (Sections 195, 199 of the German Civil Code (BGB)) .<\/li>\n<\/ul>\n<p>Commencement of a limitation period at the end of the year: If a limitation period does not expressly on a specific date and is at least one year in duration, it shall automatically commence at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships within the framework of which data is stored, the event triggering the period triggering event is the date on which the termination or other cessation of the legal relationship takes effect.<\/p>\n<h2 id=\"m10\">Rights of data subjects<\/h2>\n<p>Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:<\/p>\n<ul>\n<li><strong>Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you carried out on the basis of Article 6(1)(e) or (f) of the GDPR, ; this also applies to profiling based on these provisions. Where personal data relating to you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data relating to you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.<\/strong><\/li>\n<li><strong>Right to withdraw consent: <\/strong> You have the right to withdraw any consent you have given at any time.<\/li>\n<li><strong>Right of access:<\/strong> You have the right to request confirmation as to whether data concerning you is being processed and to obtain information \u00fc , as well as to further information and a copy of the data in accordance with statutory requirements.<\/li>\n<li><strong>Right to rectification:<\/strong> In accordance with statutory requirements, you have the right to request that data concerning you be made complete or that any inaccurate data concerning you be rectified.<\/li>\n<li><strong>Right to erasure and restriction of processing:<\/strong> In accordance with the statutory provisions, you have the right to request that data relating to you be erased without delay or, alternatively, in accordance with the statutory provisions, to request a restriction on the processing of the data.<\/li>\n<li><strong>Right to data portability:<\/strong> You have the right, in accordance with the statutory provisions, to receive the data concerning you that you have provided to us in a structured, and machine-readable format, or to request that it be transferred to another controller.<\/li>\n<li><strong>Complaint to a supervisory authority:<\/strong> Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. In particular, you may lodge a complaint with a supervisory authority in the Member State of your habitual residence, your place of work or the place where the alleged infringement occurred.<\/li>\n<\/ul>\n<h2 id=\"m225\">Provision of the online service and web hosting<\/h2>\n<p>We process users\u2019 data in order to make our online services available to them. To this end, we process the user\u2019s IP address, which is necessary to transmit the content and functions of our online services to the user\u2019s browser or end device.<\/p>\n<ul class=\"m-elements\">\n<li><strong>Types of data processed:<\/strong> Usage data (e.g. page views and time spent on site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, individuals involved). Log data (e.g. log files relating to logins, data retrieval or access times).<\/li>\n<li><strong>Data subjects:<\/strong> Users (e.g. website visitors, users of online services).<\/li>\n<li><strong>Purposes of processing and legitimate interests: <\/strong> Provision of our online services and user-friendliness; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.) ). Security measures.<\/li>\n<li><strong>Retention and erasure:<\/strong> Erasure in accordance with the information provided in the section \u2018General information on data storage and erasure\u2019.<\/li>\n<li class=\"\"><strong>Legal bases:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).<\/li>\n<\/ul>\n<p><strong>Further information on processing operations, procedures and services:<\/strong><\/p>\n<ul class=\"m-elements\">\n<li><strong>Provision of the online service on leased storage space: <\/strong>The provision of our online service, we use storage space, computing capacity and software which we rent or otherwise obtain from a relevant server provider (also known as a \u201cweb host\u201d); <span class=\"\"><strong>Legal basis:<\/strong> Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).<\/span><\/li>\n<li><strong>Collection of access data and log files: <\/strong>Access to our online service is logged in the form of so-called \u2018server log files\u2019. Server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, a notification of successful access, browser type and version, the user\u2019s operating system, the referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files may be used, on the one hand, for security purposes, e.g. to prevent the servers from becoming overloaded (particularly in the event of malicious attacks, known as DDoS attacks), and secondly, to ensure the servers\u2019 capacity utilisation and stability ; <span class=\"\"><strong>Legal basis:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR) . <\/span><strong>Deletion of data:<\/strong> Log file information is stored for a maximum of 30 days and is subsequently deleted or anonymised. Data which must be retained for evidential purposes is excluded from deletion.<\/li>\n<\/ul>\n<h2 id=\"m134\">Use of cookies<\/h2>\n<p>The term \u2018cookies\u2019 refers to functions that store and retrieve information on users\u2019 end devices. Cookies may also be used for various purposes, such as to ensure the functionality, security and convenience of online services, as well as to analyse visitor traffic. We use cookies in accordance with legal requirements. To this end, we obtain users\u2019 consent in advance where necessary. If consent is not required, we rely on our legitimate interests. This applies where the storage and retrieval of information is essential to provide explicitly requested content and functions. This includes, for example, the storage of settings and ensuring the functionality and security of our online service. Consent may be withdrawn at any time. We provide clear information on the scope of this and which cookies are used.<\/p>\n<p><strong>Information on the legal basis under data protection law: <\/strong>Whether we process personal data using cookies depends on consent. Where consent has been given, this serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.<\/p>\n<p><strong>Retention period: <\/strong>With regard to the retention period, a distinction is made between the following types of cookies:<\/p>\n<ul>\n<li><strong>Temporary cookies (also known as session cookies):<\/strong> Temporary cookies are deleted at the latest once a user has left an online service and closed their device (e.g. browser or mobile application).<\/li>\n<li><strong>Persistent cookies:<\/strong> Persistent cookies remain stored even after the device has been closed. This allows, for example, the login status to be saved and preferred content to be displayed immediately when the user visits a website again. Similarly, user data collected via cookies may be used for audience measurement. Unless we provide users with explicit information regarding the type and storage duration of cookies (e.g. when obtaining consent), they should assume that these are persistent and that the storage period may be up to two years.<\/li>\n<\/ul>\n<p><strong>General information on withdrawal of consent and objection (opt-out): <\/strong>Users may may withdraw the consent they have given at any time and may also object to the processing in accordance with legal requirements, including via their browser\u2019s privacy settings. <\/p>\n<ul class=\"m-elements\">\n<li><strong>Types of data processed:<\/strong> Meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, individuals involved).<\/li>\n<li><strong>Data subjects:<\/strong> Users (e.g. website visitors, users of online services).<\/li>\n<li class=\"\"><strong>Legal bases:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR). Consent (Article 6(1), first sentence, point (a) of the GDPR).<\/li>\n<\/ul>\n<p><strong>Further information on processing operations, procedures and services:<\/strong><\/p>\n<ul class=\"m-elements\">\n<li><strong>Processing of cookie data on the basis of consent: <\/strong>We use a consent management solution through which users\u2019 consent is obtained for the use of cookies or for the procedures and providers specified within the scope of the consent management solution. This procedure serves to obtain, log, manage and revoke consents, in particular with regard to the use of cookies and similar technologies used to secure, retrieve and process information on users\u2019 end devices. As part of this procedure, users\u2019 consent is obtained for the use of cookies and the associated processing of information, including the specific processing activities and providers mentioned in the consent management procedure. Users also have the option to manage and withdraw their consent. The consent declarations are stored to avoid having to request consent again and to be able to provide evidence of consent in accordance with legal requirements. Storage takes place on the server and\/or in a cookie (known as an \u2018opt-in cookie\u2019) or by means of comparable technologies, in order to be able to attribute the consent to a specific user or their device . Unless specific details regarding the providers of consent management services are available, the following general information applies: Consent is stored for up to two years. A pseudonymous user identifier is created, which is stored together with the time of consent, details regarding the scope of consent (e.g. relevant categories of cookies and\/or service providers) as well as information about the browser, the system and the end device used; <span class=\"\"><strong>Legal basis:<\/strong> Consent (Art. 6(1), first sentence, point (a) of the GDPR).<\/span><\/li>\n<li><strong>BorlabsCookie: <\/strong>Storage and management of consents (consent to cookies and data processing), logging of user decisions, display of notices regarding data protection and cookies, enabling users to withdraw or amend their consent; <strong>Service provider:<\/strong> Processing carried out on servers and\/or computers under the provider\u2019s own responsibility for data protection; <strong>Website:<\/strong> <a href=\"https:\/\/de.borlabs.io\/borlabs-cookie\/\" target=\"_blank\">https:\/\/de. borlabs.io\/borlabs-cookie\/<\/a>. <strong>Further information:<\/strong> An individual user ID, language, types of consent and the time at which consent was given are stored on the server and in a cookie on the user\u2019s device.<\/li>\n<\/ul>\n<h2 id=\"m182\">Contact and enquiry management<\/h2>\n<p>When you contact us (e.g. by post, contact form, email, telephone or via social media) and within the context of existing user and business relationships, the details of the enquirers are processed to the extent necessary to respond to contact enquiries and any requested actions.<\/p>\n<ul class=\"m-elements\">\n<li><strong>Types of data processed:<\/strong> Contact details (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image-based messages and posts, as well as related information such as details of authorship or the time of creation). Meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved).<\/li>\n<li><strong>Data subjects:<\/strong> Communication partners.<\/li>\n<li><strong>Purposes of processing and legitimate interests:<\/strong> Communication; organisational and administrative procedures; feedback (e.g. collecting feedback via an online form). Provision of our online services and user-friendliness.<\/li>\n<li><strong>Retention and deletion:<\/strong> Deletion in accordance with the information in the section \u2018General information on data storage and deletion\u2019.<\/li>\n<li class=\"\"><strong>Legal bases:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR). Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR).<\/li>\n<\/ul>\n<p><strong>Further information on processing operations, procedures and services:<\/strong><\/p>\n<ul class=\"m-elements\">\n<li><strong>Contact form: <\/strong>When you contact us via our contact form, by email or through other communication channels, we process the personal data provided to us in order to respond to and deal with your enquiry. This generally includes details such as your name, contact details and, where applicable, any further information provided to us that is necessary for the appropriate handling of your enquiry. We use this data exclusively for the stated purpose of establishing contact and communication; <span class=\"\"><strong>Legal bases:<\/strong> Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR), legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).<\/span><\/li>\n<\/ul>\n<h2 id=\"m735\">Video conferences, online meetings, webinars and screen sharing<\/h2>\n<p>We use platforms and applications from other providers (hereinafter referred to as \u2018conference platforms\u2019) for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as \u2018conferences\u2019). When selecting conference platforms and their services, we comply with the statutory requirements. <\/p>\n<p><strong>Data processed by conference platforms:<\/strong> When participants take part in a conference, the conference platforms process the personal data of the participants listed below. The scope of the processing depends, on the one hand, on what data is required for a specific conference (e.g. provision of login details or real names) and which optional details are provided by the participants. In addition to processing for the purpose of conducting the conference, participants\u2019 data may also be processed by the conference platforms for security purposes or to optimise the service. The data processed includes personal details (first name, surname), contact information (email address, telephone number), login details (access codes or passwords ), profile pictures, details of professional status\/role, the IP address of the internet connection, details of participants\u2019 devices, their operating system, browser and its technical and language settings, information on the content of communications, i.e. chat entries as well as audio and video data, and the use of other available (e.g. surveys). The content of communications is encrypted to the extent technically provided by the conference providers . If participants are registered as users on the conference platforms, further data may be processed in accordance with the agreement with the respective conference provider.<\/p>\n<p><strong>Logging and recordings:<\/strong> Should text entries, participation results (e.g. from surveys) and video or audio recordings are logged, participants will be informed of this transparently in advance and, where necessary, asked for their consent.<\/p>\n<p><strong>Data protection measures for participants: <\/strong> Please refer to the privacy notices of the conference platforms for details regarding the processing of your data by them, and select the security and privacy settings that best suit your needs within the conference platform settings. Please also ensure that your data and privacy are protected in the background for the duration of a video conference (e.g. by informing housemates, locking doors and, where technically possible, using the function to blur the background). Links to the conference rooms and access details must not be disclosed to unauthorised third parties.<\/p>\n<p><strong>Notes on legal bases:<\/strong> Where, in addition to the conference platforms, we also process users\u2019 data and ask users for their consent to the use of the conference platforms or certain functions (e.g. agreement to the recording of conferences), the legal basis for the processing is this consent. Furthermore, our processing may be necessary to fulfil our contractual obligations (e.g. in participant lists, when summarising meeting outcomes, etc.). In addition, users\u2019 data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.<\/p>\n<ul class=\"m-elements\">\n<li><strong>Types of data processed:<\/strong> Master data (e.g. full name, residential address, contact details, customer number, etc.); contact details (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image-based messages and posts, as well as related information such as details of authorship or the time of creation); usage data (e.g. page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and functions); image and\/or video recordings (e.g. photographs or video recordings of a person); audio recordings; log data (e.g. log files relating to logins, data retrieval or access times); Contract data (e.g. subject matter of the contract, term, customer category). Meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved).<\/li>\n<li><strong>Data subjects:<\/strong> Communication partners; users (e.g. website visitors, users of online services); persons depicted; Service recipients and clients; prospective customers. Participants.<\/li>\n<li><strong>Purposes of processing and legitimate interests:<\/strong> Provision of contractual services and fulfilment contractual obligations; communication; office and organisational procedures. Provision of our online services and user-friendliness.<\/li>\n<li><strong>Retention and deletion:<\/strong> Deletion in accordance with the information in the section \u2018General information on data storage and deletion\u2019.<\/li>\n<li class=\" \"><strong>Legal bases:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).<\/li>\n<\/ul>\n<p><strong>Further information on processing procedures, procedures and services:<\/strong><\/p>\n<ul class=\"m-elements\">\n<li><strong>Microsoft Facilitator: <\/strong>Microsoft Facilitator is an AI-powered agent integrated directly into Microsoft Teams and used to conduct online events, conferences and for internal and external communication. The service facilitates enables voice transmission, direct messaging, group communication and collaboration features, and participates in meetings in real time as an additional participant \u2013 all contributions are visible to all meeting participants.<br>The following personal data is processed in the course of use: name, business contact details and professional profile of participants, attendance information, and meeting content in the form of audio and video signals, voice transcriptions, chat messages and shared files. System-generated log, diagnostic and metadata, as well as diagnostic data relating to product stability, security and the further development of the service, are also collected.<br>Audio signals are generally not stored unless recording is actively enabled. Meeting and conference recordings are stored for 90 days by default, unless a different retention period is specified. Chat and file content is stored in accordance with the policies set by the administrator or user; automatic deletion is not enabled by default Channels must be renewed every 180 days; otherwise, the content they contain will be deleted.<br>Processing is carried out for the purposes of increasing efficiency and productivity, cost-effectiveness, flexibility and mobility, improved communication, IT security, the use of a central collaboration platform, and for general business operations. The legal basis for the processing is legitimate interest pursuant to Article 6(1)( 1(f) of the GDPR. Where data is transferred to third countries, this is done on the basis of the EU Standard Contractual Clauses; <strong>Service providers:<\/strong> Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; <strong>Website:<\/strong> <a href=\"https:\/\/www.microsoft. com\/de-de\/microsoft-teams\/\" target=\"_blank\">https:\/\/www.microsoft.com\/de-de\/microsoft-teams\/<\/a>. <strong>Privacy Statement:<\/strong> <a href=\"https:\/\/privacy.microsoft.com\/de-de\/privacystatement\" target=\"_blank\">https:\/\/privacy.microsoft.com\/de-de\/privacystatement<\/a>, Security Information: <a href=\"https:\/\/www.microsoft.com\/de-de\/trustcenter\" target=\"\u2018_blank\u2019\">https:\/\/www.microsoft.com\/de-de\/trustcenter<\/a>.<\/li>\n<li><strong>Microsoft Teams: <\/strong>Used to organise online events and conferences, and to communicate with internal and external participants. Voice calls, direct messages, group communication and collaboration features are utilised; the following data is processed: name, business contact details, job profile, participation and content (audio\/video, voice, chat, files, speech transcription) are processed for the purposes of and in the interests of increasing efficiency and productivity, cost-effectiveness, flexibility, mobility, improved communication, IT security, the use of a centralised platform and the conduct of Microsoft\u2019s business. Audio signals are not stored as a matter of principle, unless recording is enabled. Meeting and conference recordings are stored for 90 days by default, unless a different duration is specified. Chat and file content is stored in accordance with the policies set by the administrator or user; by default, there is no automatic deletion. Channels must be renewed every 180 days, otherwise the content will be deleted. In addition, system-generated logs, diagnostic data and metadata are processed, and diagnostic data relating to product stability, security and improvement is collected; <strong>Service provider:<\/strong> Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; <span class=\"\"><strong>Legal basis:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); <\/span><strong>Website:<\/strong> <a href=\"https:\/\/www.microsoft.com\/de-de\/microsoft-teams\/\" target=\"_blank\">https:\/\/www. microsoft.com\/de-de\/microsoft-teams\/<\/a>; <strong>Privacy policy:<\/strong> <a href=\"https:\/\/www.microsoft.com\/de-de\/privacy\/privacystatement\" target=\"_blank\">https:\/\/www.microsoft.com\/de-de\/privacy\/privacystatement<\/a>. <strong>Basis for transfers to third countries: <\/strong> Data Privacy Framework (DPF), Standard Contractual Clauses (<a href=\"https:\/\/www.microsoft.com\/licensing\/docs\/view\/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA\" target=\"_blank\">https:\/\/www.microsoft.com\/licensing\/docs\/view\/Microsoft-Products -and-Services-Data-Protection-Addendum-DPA<\/a>).<\/li>\n<\/ul>\n<h2 id=\"m29\">Cloud services<\/h2>\n<p>We use software services accessible via the internet and executed on their providers\u2019 servers (so-called \u201ccloud services\u201d, also known as \u2018Software as a Service\u2019) for the storage and management of content (e.g. document storage and management, the exchange of documents, content and information with specific recipients, or the publication of content and information).<\/p>\n<p>In this context, personal data may be processed and stored on the providers\u2019 servers, insofar as such data forms part of communications with us or is otherwise processed by us, as set out in this privacy policy. This data may in particular include users\u2019 master data and contact details, as well as data relating to transactions, contracts, other processes and their contents. The cloud service providers also process usage data and metadata, which they use for security purposes and to optimise their services.<\/p>\n<p>Where we use the cloud services to make forms or similar documents and content available to other users or on publicly accessible , the providers may store cookies on users\u2019 devices for the purposes of web analytics or to remember users\u2019 settings (e.g. in the case of media controls).<\/p>\n<ul class=\"m-elements\">\n<li><strong>Types of data processed:<\/strong> Master data (e.g. full name, residential address, contact details, customer number, etc.); contact details (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or visual messages and posts, as well as related information, such as, B. details regarding authorship or the time of creation); usage data (e.g. page views and time spent on site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).<\/li>\n<li><strong>Data subjects:<\/strong> Prospective customers; communication partners; business and contractual partners. Users (e.g. website visitors, users of online services).<\/li>\n<li><strong>Purposes of processing and legitimate interests:<\/strong> Office and organisational procedures; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)); provision of contractual services and fulfilment of contractual obligations. Provision of our online services and user-friendliness.<\/li>\n<li><strong>Retention and deletion:<\/strong> Deletion in accordance with the information in the section \u201cGeneral Information on Data Storage and Deletion\u2018.<\/li>\n<li class=\"\"><strong>Legal bases:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).<\/li>\n<\/ul>\n<p><strong>Further information on processing operations, procedures and services:<\/strong><\/p>\n<ul class=\"\u2019m-elements\" \"=\"\">\n<li><strong>Atlassian Cloud: <\/strong>cloud storage, cloud infrastructure services and cloud-based application software; <strong>service provider:<\/strong> Atlassian Pty Ltd, 350 Bush Street, Floor 13, San Francisco, CA 94104, USA; <span class=\"\"><strong>Legal basis:<\/strong> legitimate interests (Article 6( 1(1)(f) of the GDPR); <\/span><strong>Website:<\/strong> <a href=\"https:\/\/www.atlassian.com\/licensing\/cloud\" target=\"\u2018_blank\u2019\">https:\/\/www.atlassian.com\/licensing\/cloud<\/a>; <strong>Privacy Policy:<\/strong> <a href=\"https:\/\/www.atlassian.com\/legal\/privacy-policy\" target=\"_blank\">https:\/\/www.atlassian.com\/legal\/privacy-policy<\/a>; <strong>Data Processing Agreement:<\/strong> <a href=\"https:\/\/www.atlassian.com\/legal\/data-processing-addendum\" target=\"_blank\">https:\/\/www.atlassian.com\/legal\/data-processing-addendum<\/a>. <strong>Legal basis for transfers to third countries:<\/strong> Data Privacy Framework (DPF), Standard Contractual Clauses (<a href=\"https:\/\/www.atlassian.com\/ legal\/data-processing-addendum#europe-uk-switzerland\" target=\"_blank\">https:\/\/www.atlassian.com\/legal\/data-processing-addendum#europe-uk-switzerland<\/a>). <\/li>\n<\/ul>\n<h2 id=\"m263\">Web analytics, monitoring and optimisation<\/h2>\n<p>Web analytics (also referred to as \u2018reach measurement\u2019) is used to analyse visitor traffic to our online offering and may include pseudonymous data relating to visitors\u2019 behaviour, interests or demographic information, such as age or gender. With the help of reach analysis, we can, for example, identify at what times our online offering or its functions and content are most frequently used, or encourage repeat visits. It also enables us to identify which areas require optimisation. <\/p>\n<p>In addition to web analytics, we may also use testing methods to, for example, test and optimise different versions of our online service or its components.<\/p>\n<p>Unless otherwise stated below, profiles \u2013 that is, data aggregated to represent a single usage session \u2013 may be created for these purposes, and information may be stored in a browser or on a device and subsequently retrieved. The data collected includes, in particular, websites visited and the elements used on them, as well as technical details such as the browser used, the computer system used and details of usage times. Where users have consented to the collection of their location data by us or by the providers of the services we use, the processing of location data is also possible. <\/p>\n<p>In addition, users\u2019 IP addresses are stored. However, we use an IP masking procedure (i.e. pseudonymisation by truncating the IP address) to protect users. Generally, no personally identifiable data (such as email addresses or names) are stored; instead, pseudonyms are used. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective processes.<\/p>\n<p>Notes on legal bases: Where we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. an interest in providing efficient, cost-effective and user-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.<\/p>\n<ul class=\"m-elements\">\n<li><strong>Types of data processed: <\/strong> Usage data (e.g. page views and time spent on site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, individuals involved).<\/li>\n<li><strong>Data subjects: <\/strong> Users (e.g. website visitors, users of online services).<\/li>\n<li><strong>Purposes of processing and legitimate interests:<\/strong> Audience measurement (e.g. access statistics, identification of returning visitors). Profiles containing user-related information (creation of user profiles).<\/li>\n<li><strong>Retention and deletion: <\/strong> Deletion in accordance with the information in the section \u2018General information on data storage and deletion\u2019. Storage of cookies for up to 2 years (Unless otherwise stated, cookies and similar storage methods may be stored on users\u2019 devices for a period of two years.).<\/li>\n<p>&lt; li&gt;<strong>Security measures:<\/strong> IP masking (pseudonymisation of the IP address).\n<\/p>\n<li class=\"\"><strong>Legal bases:<\/strong> Consent (Art. 6(1), first sentence, point (a) of the GDPR). Legitimate interests (Art. 6(1), first sentence, 1(f) of the GDPR).<\/li>\n<\/ul>\n<p><strong>Further information on processing operations, procedures and services:<\/strong><\/p>\n<ul class=\"m-elements\">\n<li><strong>Google Analytics: <\/strong>We use Google Analytics to measure and analyse the use of our online service on the basis of a pseudonymous user identification number. This identification number does not contain any unique data, such as names or email addresses. It serves to assign analytical information to a device in order to identify which content users have accessed during one or more sessions, which search terms they have used, re-accessed them or interacted with our online service. The time of use and its duration are also stored, as well as the sources from which users have accessed our online service and technical details of their devices and browsers.<br>In doing so, pseudonymous user profiles are created using information from the use of various devices, in which case cookies may be used. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides approximate geographical location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city) , continent, country, region, subcontinent (and ID-based equivalents). For EU data traffic, IP address data is used exclusively for this derivation of geolocation data before being deleted immediately. It is not logged, is not accessible and is not used for further purposes. When Google Analytics collects measurement data, all IP queries are carried out on EU-based servers before the traffic is forwarded to Analytics servers for processing; legal bases: Consent (Art. 6(1)(a) GDPR); Standard contractual clauses: https:\/\/business.safety.google\/adsprocessorterms; Right to object (opt-out): Opt-out plugin: https:\/\/tools.google.com\/dlpage\/gaoptout?hl=de, Settings for the display of adverts: https:\/\/myadcenter.google.com\/personalizationoff; Data processing agreement: https:\/\/business.safety.google\/adsprocessorterms\/; Further information: https:\/\/business.safety.google\/adsservices\/ (types of processing and data processed); <strong>Service provider: <\/strong> Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; <strong>Website:<\/strong> <a href=\"https:\/\/marketingplatform.google.com\/intl\/de\/about\/analytics\/\" target=\"_blank\">https:\/\/marketingplatform.google.com\/intl\/de\/about\/analytics\/<\/a>. <strong>Privacy policy:<\/strong> <a href=\"https:\/\/policies.google.com\/privacy\" target=\"_blank\">https:\/\/policies.google.com\/privacy<\/a>.<\/li>\n<\/ul>\n<h2 id=\"m136\">Social media presence<\/h2>\n<p>We maintain an online presence on social media platforms and, in this context, process user data in order to communicate with users active on these platforms or to provide information about us.<\/p>\n<p>Please note that user data may be processed outside the European Union. This may entail risks for users, as it could, for example, make it more difficult to enforce their rights.<\/p>\n<p>Furthermore, users\u2019 data within social media platforms is generally processed for market research and advertising purposes. For example, usage profiles can be created based on users\u2019 behaviour and the resulting interests. These profiles may in turn be used, for instance, to display adverts both within and outside the networks that are presumed correspond to users\u2019 interests. Consequently, cookies are usually stored on users\u2019 computers, in which their usage behaviour and interests are recorded. Furthermore, data may also be stored in the user profiles regardless of the devices used by the users (particularly if they are members of the respective platforms and are logged in there ).<\/p>\n<p>For a detailed description of the respective forms of processing and the options for objecting (opt-out), please refer to the privacy policies and information provided by the operators of the respective networks.<\/p>\n<p>We would also like to point out that, in the case of requests for information and the exercise of data subjects\u2019 rights, these can most effectively be exercised with the providers themselves. Only the latter have access to the user data and can can take appropriate measures and provide information directly. Should you nevertheless require assistance, you may contact us.<\/p>\n<ul class=\"m-elements\">\n<li><strong>Types of data processed:<\/strong> Contact details (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image-based messages and posts, as well as related information such as details of authorship or the time of creation) . Usage data (e.g. page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and functions).<\/li>\n<li><strong>Data subjects:<\/strong> Users (e.g. website visitors, users of online services).<\/li>\n<li><strong>Purposes of processing and legitimate interests:<\/strong> Communication; feedback (e.g. collecting feedback via an online form). Public relations.<\/li>\n<li><strong>Retention and erasure:<\/strong> Erasure in accordance with the information provided in the section \u2018General information on data storage and erasure\u2019 .<\/li>\n<li class=\"\"><strong>Legal bases:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).<\/li>\n<\/ul>\n<p><strong>Further information on processing operations, procedures and services:<\/strong><\/p>\n<ul class=\"m-elements\">\n<li><strong>Instagram: <\/strong>Social network, enables the sharing of photos and videos, commenting on and favouriting posts, sending messages, and following profiles and pages; <strong>Service provider:<\/strong> Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; <span class=\"\"><strong>Legal basis:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); <\/span><strong>Website:<\/strong> <a href=\"https:\/\/www.instagram.com\" target=\"\u2018_blank\u2019\">https:\/\/www.instagram.com<\/a>; <strong>Privacy Policy:<\/strong> <a href=\"https:\/\/privacycenter.instagram.com\/policy\/\" target=\"_blank\">https:\/\/privacycenter.instagram.com\/policy\/<\/a>. <strong>Basis for transfers to third countries:<\/strong> Data Privacy Framework (DPF).<\/li>\n<li><strong>Facebook pages: <\/strong>Profiles within the Facebook social network \u2013 The data controller is jointly responsible with Meta Platforms Ireland Limited for the collection and transmission of data relating to visitors to our Facebook page (\u201cFan Page\u201d). This includes, in particular, information about user behaviour (e.g. content viewed or interacted with, actions taken) as well as device information (e.g. IP address, operating system, browser type, language settings, cookie data). Further details can be found in the Facebook Data Policy: <a href=\"https:\/\/www.facebook.com\/privacy\/policy\/\" target=\"_blank\">https:\/\/www.facebook.com\/privacy\/policy\/.<\/a> Facebook also uses this data to provide us &amp; provide us with statistical analyses via the \u2018Page Insights\u2019 service, which give an insight into how people interact with our page and its content. This is based on an agreement with Facebook (\u2018Information on Page Insights\u2019: <a href=\"https:\/\/www.facebook.com\/legal\/terms\/page_controller_addendum\" target=\" _blank\">https:\/\/www.facebook.com\/legal\/terms\/page_controller_addendum<\/a>), which, amongst other things, sets out security measures and the exercise of data subjects\u2019 rights. Further information can be found here: <a href=\"https:\/\/www.facebook.com\/legal\/terms\/information_about_page_insights_data\" target=\"\u2018_blank\u2019\">https:\/\/www.facebook.com\/legal\/terms\/information_about_page_insights_data.<\/a> Users may therefore address requests for access or erasure directly to Facebook. Users\u2019 rights (in particular the right to access, erasure, objection and the right to lodge a complaint with a supervisory authority) remain unaffected by this. Joint controllership is limited exclusively to the collection of data by Meta Platforms Ireland Limited (EU) . Meta Platforms Ireland Limited is solely responsible for any further processing, including any potential transfer to Meta Platforms Inc. in the USA; <strong>Service provider:<\/strong> Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; <span class=\"\"><strong>Legal basis:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); <\/span><strong>Website:<\/strong> <a href=\"https:\/\/www.facebook.com\" target=\"_blank\">https:\/\/www.facebook.com<\/a>; <strong>Privacy policy:<\/strong> <a href=\"https:\/\/www.facebook.com\/privacy\/policy\/\" target=\"_blank\">https: \/\/www.facebook.com\/privacy\/policy\/<\/a>. <strong>Basis for transfers to third countries:<\/strong> Data Privacy Framework (DPF), Standard Contractual Clauses (<a href=\"https:\/\/www.facebook.com\/legal\/EU_data_transfer_addendum\" target=\"_blank\">https:\/\/www.facebook.com\/legal\/EU_data_transfer_addendum<\/a>) .<\/li>\n<li><strong>LinkedIn: <\/strong>Social network \u2013 Together with LinkedIn Ireland Unlimited Company, we are responsible for the collection (but not the further processing) of visitor data used to generate the \u2018Page Insights\u2019 (statistics) for our LinkedIn profiles. This data includes information about the types of content users view or interact with, as well as the actions they take. Details of the devices used are also collected, such as IP addresses, operating system, browser type, language settings and cookie data, as well as information from user profiles, such as job title, country, sector, hierarchical level, company size and employment status. Information on the processing of user data by LinkedIn can be found in LinkedIn\u2019s privacy policy: <a href=\"https:\/\/www.linkedin.com\/ legal\/privacy-policy\" target=\"_blank\">https:\/\/www.linkedin.com\/legal\/privacy-policy.<\/a><br>We have entered into a specific agreement with LinkedIn Ireland (\u201cPage Insights Joint Controller Addendum\u201d, <a href=\"https:\/\/legal.linkedin.com\/pages-joint-controller-addendum\" target=\"_blank\">https:\/\/legal. linkedin.com\/pages-joint-controller-addendum<\/a>), which specifically sets out the security measures LinkedIn must observe and in which LinkedIn has agreed to fulfil the rights of data subjects (i.e. users may, for example, submit requests for access or erasure deletion requests directly to LinkedIn). Users\u2019 rights (in particular the right to access, erasure, objection and to lodge a complaint with the competent supervisory authority) are not restricted by the agreements with LinkedIn. Joint responsibility is limited to the collection and transfer of data to LinkedIn Ireland Unlimited Company, a company based in the EU. Further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, in particular with regard to the transfer of data to the parent company, LinkedIn Corporation, in the USA; <strong>Service provider:<\/strong> LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland; <span class=\"\"><strong>Legal bases: <\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); <\/span><strong>Website:<\/strong> <a href=\"https:\/\/www.linkedin.com\" target=\"_blank \">https:\/\/www.linkedin.com<\/a>; <strong>Privacy policy:<\/strong> <a href=\"https:\/\/www.linkedin.com\/legal\/privacy-policy\" target=\"_blank\">https:\/\/www.linkedin.com\/legal\/privacy-policy<\/a>; <strong>Basis for transfers to third countries:<\/strong> Data Privacy Framework (DPF), Standard Contractual Clauses (<a href=\"https:\/\/www.linkedin.com\/legal\/privacy-policy\" target=\"_blank\">https:\/\/www.linkedin.com\/legal\/privacy-policy<\/a>). <strong>Right to object (opt-out):<\/strong> <a href=\"https:\/\/www.linkedin.com\/psettings\/guest -controls\/retargeting-opt-out\" target=\"_blank\">https:\/\/www.linkedin.com\/psettings\/guest-controls\/retargeting-opt-out<\/a>.<\/li>\n<li><strong>YouTube: <\/strong>Social network and video platform; <strong>Service provider:<\/strong> Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; <span class=\"\"><strong>Legal basis:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); <\/span><strong>Privacy policy:<\/strong> <a href=\"https:\/\/business.safety.google\/privacy\/\" target=\"_blank\">https:\/\/business.safety.google\/privacy\/<\/a>; <strong>Basis for transfers to third countries:<\/strong> Data Privacy Framework (DPF). <strong>Right to object (opt-out):<\/strong> <a href=\"https:\/\/myadcenter.google.com\/\" target=\"_blank\">https:\/\/myadcenter.google.com\/<\/a>.<\/li>\n<li><strong>Xing: <\/strong>Social network; <strong>Service provider:<\/strong> New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; <span class=\"\"><strong>Legal basis:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); <\/span><strong>Website:<\/strong> <a href=\"https:\/\/ www.xing.com\/\" target=\"_blank\">https:\/\/www.xing.com\/<\/a>. <strong>Privacy policy:<\/strong> <a href=\"https:\/\/privacy.xing.com\/de\/datenschutzerklaerung\" target=\"_blank\">https:\/\/privacy.xing.com\/de\/datenschutzerklaerung<\/a>.<\/li>\n<\/ul>\n<h2 id=\"m328\">Plug-ins, embedded functions and content<\/h2>\n<p>We incorporate functional and content elements into our online offering which are sourced from the servers of their respective providers (hereinafter referred to as \u2018third-party providers\u2019). These may include, for example, graphics, videos or city maps&amp; (hereinafter collectively referred to as \u2018content\u2019).<\/p>\n<p>This integration always requires the third-party providers of this content to process users\u2019 IP addresses, as they would be unable to send the content to users\u2019 browsers without an IP address. The IP address is therefore necessary for the display of this content or these functions. We endeavour to use only such content where the respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as \u2018web beacons\u2019) for statistical or marketing purposes. Through the \u2018pixel tags\u2019 can be used to analyse information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user\u2019s device and may include, amongst other things, technical details about the browser and operating system, referring websites, the time of the visit and further details regarding the use of our online service; it may also be linked to such information from other sources. <\/p>\n<p><strong>Information on legal bases:<\/strong> Where we ask users for their consent to the use of third-party providers, the legal basis for data processing is that consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. an interest in providing efficient, cost-effective and user-friendly services) . In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.<\/p>\n<ul class=\"m-elements\">\n<li><strong>Types of data processed:<\/strong> Usage data (e.g. page views and time spent on site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, individuals involved). Location data (information on the geographical position of a device or a person).<\/li>\n<li><strong>Data subjects:<\/strong> Users (e.g. website visitors, users of online services).<\/li>\n<li><strong>Purposes of processing and legitimate interests:<\/strong> Provision of our online services and user-friendliness. Provision of contractual services and fulfilment of contractual obligations.<\/li>\n<li><strong>Retention and deletion:<\/strong> Deletion in accordance with the information in the section \u2018General information on data storage and deletion\u2019. Storage of cookies for up to 2 years (unless otherwise stated, cookies and similar storage methods may be stored on users\u2019 devices for a period of two years).<\/li>\n<li class=\"\"><strong>Legal bases:<\/strong> Consent (Art. 6(1)( 1(a) of the GDPR). Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).<\/li>\n<\/ul>\n<p><strong>Further information on processing operations, procedures and services:<\/strong><\/p>\n<ul class=\"m-elements\">\n<li><strong>Google Fonts (hosted on our own server): <\/strong>Provision of font files to ensure a user-friendly presentation of our online offering; <strong>Service provider:<\/strong> Google Fonts are hosted on our server; no data is transmitted to Google; <span class=\"\"><strong>Legal basis:<\/strong> Legitimate interests (Art. 6(1), sentence 1, point (f) of the GDPR).<\/span><\/li>\n<li>&lt; strong&gt;Google Maps: We embed maps from the \u2018Google Maps\u2019 service provided by Google. The data processed may include, in particular, users\u2019 IP addresses and location data; <strong>Service provider:<\/strong> Google Cloud EMEA Limited, 70 Sir John Rogerson\u2019s Quay, Dublin 2, Ireland; <span class=\"\"><strong>Legal basis:<\/strong> Consent (Art. 6(1), first sentence, point (a) of the GDPR); <\/span><strong>Website:<\/strong> <a href=\"https:\/\/mapsplatform.google.com\/\" target=\"_blank\">https:\/\/mapsplatform.google.com\/<\/a>; <strong>Privacy policy:<\/strong> <a href=\"https:\/\/business.safety.google\/privacy\/\" target=\"_blank\">https:\/\/business.safety.google\/privacy\/<\/a>. <strong>Basis for transfers to third countries:<\/strong> Data Privacy Framework (DPF) .<\/li>\n<li><strong>reCAPTCHA: <\/strong>We integrate the \u201creCAPTCHA\u201d function to determine whether entries (e.g. in online forms) are made by humans and not by automated machines (so-called \u201cbots &#8220;). The data processed may include IP addresses, information on operating systems, devices or browsers used, language settings, location, mouse movements, keystrokes, time spent on web pages, previously visited web pages, interactions with reCAPTCHA on other websites, cookies in certain circumstances, and the results of manual verification processes (e.g. answering questions or selecting objects in images) . Data processing is carried out on the basis of our legitimate interest in protecting our online service from abusive automated crawling and spam; <strong>Service provider:<\/strong> Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; <span class=\"\"><strong>Legal basis:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); <\/span><strong>Website:<\/strong> <a href=\"https:\/\/cloud.google.com\/security\/products\/recaptcha\" target=\"_blank\">https:\/\/cloud.google.com\/security\/ products\/recaptcha<\/a>; <strong>Privacy policy:<\/strong> <a href=\"https:\/\/business.safety.google\/privacy\/\" target=\"_blank\">https:\/\/business.safety.google\/privacy\/<\/a>; <strong>Data processing agreement:<\/strong> <a href=\"https:\/\/cloud.google.com\/terms\/ data-processing-addendum\u2018 target=\" _blank\"=\"\">https:\/\/cloud.google.com\/terms\/data-processing-addendum<\/a>. <strong>Basis for transfers to third countries:<\/strong> Data Privacy Framework (DPF), Standard Contractual Clauses (<a href=\"\u2019https:\/\/cloud.google.com\/terms\/sccs\/\" eu-c2p\"=\"\" target=\"_blank\">https:\/\/cloud.google.com\/terms\/sccs\/eu-c2p<\/a>).<\/li>\n<\/ul>\n<h2 id=\"m723\">Management, organisation and support tools<\/h2>\n<p>We use services, platforms and software from other providers (hereinafter referred to as \u201cthird-party providers\u201d) for the purposes of organising, administering, planning and delivering our services. When selecting third-party providers and their services, we comply with the statutory requirements. <\/p>\n<p>In this context, personal data may be processed and stored on the servers of third-party providers. This may involve various types of data, which we process in accordance with this privacy policy. This data may include, in particular, users\u2019 master data and contact details, as well as data relating to transactions, contracts, other processes and their contents.<\/p>\n<p>Where users are referred to third-party providers or their software or platforms in the context of communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, to optimise their services or for marketing purposes. We therefore ask that you to refer to the privacy policies of the respective third-party providers.<\/p>\n<ul class=\"m-elements\">\n<li><strong>Types of data processed:<\/strong> Content data (e.g. text or image-based messages and posts, as well as related information such as details of authorship or the time of creation); usage data (e.g. page views and time spent on pages, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved).<\/li>\n<li><strong>Data subjects:<\/strong> Communication partners. Users (e.g. website visitors, users of online services).<\/li>\n<li><strong>Purposes of processing and legitimate interests:<\/strong> Provision of contractual services and fulfilment of contractual obligations. Office and organisational procedures.<\/li>\n<li><strong>Retention and deletion:<\/strong> Deletion in accordance with the information provided in the section \u2018General information on data storage and deletion\u2019.<\/li>\n<li class=\"\"><strong>Legal bases:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).<\/li>\n<\/ul>\n<p><strong>Further information on processing operations, procedures and services:<\/strong><\/p>\n<ul class=\"m-elements\">\n<li><strong>Confluence: <\/strong>Software for creating and administering wiki and knowledge platforms; <strong>Service provider:<\/strong> Atlassian Pty Ltd, 350 Bush Street, Floor 13, San Francisco, CA 94104, USA; <span class=\"\"><strong>Legal basis:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); <\/span><strong>Website:<\/strong> <a href=\"https:\/\/www.atlassian.com\/software\/confluence\" target=\"_blank\">https:\/\/www.atlassian.com\/software\/confluence<\/a>; <strong>Privacy policy: <\/strong> <a href=\"https:\/\/www.atlassian.com\/legal\/privacy-policy\" target=\"_blank\">https:\/\/www.atlassian.com\/legal\/privacy-policy<\/a>. <strong>Basis for transfers to third countries:<\/strong> Data Privacy Framework (DPF), Standard Contractual Clauses (<a href=\"https:\/\/www.atlassian.com\/legal\/data -processing-addendum#europe-uk-switzerland\" target=\"_blank\">https:\/\/www.atlassian.com\/legal\/data-processing-addendum#europe-uk-switzerland<\/a>).<\/li>\n<li><strong>Jira: <\/strong>web application for bug tracking, issue resolution and operational project management; <strong>service provider:<\/strong> Atlassian Pty Ltd, 350 Bush Street, Floor 13, San Francisco, CA 94104, USA; <span class=\"\"><strong>Legal basis:<\/strong> Legitimate interests (Art. 6(1)(f) GDPR); <\/span><strong>Website:<\/strong> <a href=\"https:\/\/ www.atlassian.com\/software\/jira\" target=\"_blank\">https:\/\/www.atlassian.com\/software\/jira<\/a>; <strong>Privacy policy:<\/strong> <a href=\"https:\/\/www.atlassian.com\/legal\/privacy-policy\" target=\"_blank\">https:\/\/www.atlassian.com\/legal\/privacy-policy<\/a>; <strong>Data Processing Agreement:<\/strong> <a href=\"https:\/\/www.atlassian.com\/legal\/data-processing-addendum\" target=\"_blank\">https:\/\/www.atlassian.com\/legal\/ data-processing-addendum<\/a>. <strong>Basis for transfers to third countries:<\/strong> Data Privacy Framework (DPF), Standard Contractual Clauses (<a href=\"https:\/\/www.atlassian.com\/legal\/data-processing-addendum#europe-uk-switzerland\" target=\"_blank\">https:\/\/www.atlassian.com\/ legal\/data-processing-addendum#europe-uk-switzerland<\/a>).<\/li>\n<\/ul>\n<h2 id=\"m210\">Recruitment process<\/h2>\n<p>The recruitment process requires applicants to provide us with the data required for their assessment and selection. The information required is set out in the job description or, in the case of online forms, in the details provided there. <\/p>\n<p>As a general rule, the required details include personal details, such as name, address, contact details, and evidence of the qualifications required for a post. Upon request, we are also happy to provide further details on what information is required are required.<\/p>\n<p>Where available, applicants are welcome to submit their applications via our online form, which is secured using state-of-the-art encryption Alternatively, it is also possible to send applications to us by email. However, we would like to point out that emails are generally not sent in encrypted form over the internet. Although emails are usually encrypted whilst in transit, this is not the case on the servers from which they are sent and received. We are therefore unable to accept any responsibility for the security of your application whilst it is being transmitted between the sender and our server &amp; <\/p>\n<p>For the purposes of candidate search, submission of applications and selection of candidates, we may, in compliance with legal requirements, utilise applicant tracking systems, recruitment software, platforms and services provided by third parties.<\/p>\n<p>Applicants are welcome to contact us regarding the method of submit their application or send it to us by post.<\/p>\n<p><strong>Processing of special categories of data:<\/strong> Insofar as, in the context of the application process, special categories of personal data (Article 9(1) of the GDPR, e.g. health data, such as severe disability status or ethnic origin) are requested from or provided by applicants, such data will be processed to enable the data controller or the data subject to exercise their rights and fulfil their obligations arising from labour law and the law on social security and social protection, in the event of the protection of the vital interests of applicants or other persons, or for the purposes of preventative healthcare or occupational medicine, for the assessment of an employee\u2019s fitness for work, for medical diagnosis, for care or treatment in the health or social sector, or for the administration of systems and services in the health or social sector.<\/p>\n<p><strong>Deletion of data:<\/strong> The data provided by applicants may be further processed by us in the event of a successful application for the purposes of the employment relationship. Otherwise, if the application for a vacancy is unsuccessful, applicants\u2019 data will be deleted. Applicants\u2019 data will also be deleted if an application is withdrawn , which applicants are entitled to do at any time. Subject to a valid withdrawal by the applicant, the data will be deleted no later than six months after the application was submitted, so that we can answer any follow-up questions regarding the application and fulfil our obligations to provide evidence under the regulations on equal treatment of applicants. Invoices for any travel expense reimbursements are archived in accordance with tax regulations.<\/p>\n<p><strong>Inclusion in a candidate pool:<\/strong> Inclusion in a candidate pool, where offered, is based on consent. Applicants are informed that their consent to be included in the talent pool is voluntary, has no influence on the current application process, and that they may withdraw their consent at any time with future effect.<\/p>\n<ul class=\"m -elements\">\n<li><strong>Types of data processed:<\/strong> Master data (e.g. full name, home address, contact details, customer number, etc.); contact details (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or visual messages and posts, as well as information relating to them, such as details of authorship or the time of creation). Applicant data (e.g. personal details, postal and contact addresses, the documents forming part of the application and the information contained therein, such as cover letters, CVs, certificates, as well as further information relating to a specific position or provided voluntarily by applicants regarding their personal details or qualifications).<\/li>\n<li><strong>Data subjects:<\/strong> Applicants. <\/li>\n<li><strong>Purposes of processing and legitimate interests:<\/strong> Recruitment process (justification and any subsequent implementation, as well as possible termination of the employment relationship).<\/li>\n<li><strong>Retention and deletion:<\/strong> Deletion in accordance with the information provided in the section \u2018General information on data storage and deletion\u2019.<\/li>\n<li class=\"\"><strong>Legal basis:<\/strong> Recruitment process as a pre-contractual or contractual relationship (Article 6(1), first sentence, point (b) of the GDPR). Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).<\/li>\n<\/ul>\n<p><strong>Further information on processing operations, procedures and services:<\/strong><\/p>\n<ul class=\"\u2018m-elements\u2019\">\n<li><strong>Personio: <\/strong>recruitment platform and applicant management services (job advertisements, candidate search and recruitment processes); <strong>service provider:<\/strong> Personio SE &amp; Co. KG, Seidlstra\u00dfe 3, 80335 Munich, Germany; <span class=\"\u2018\u2019\"><strong>Legal basis:<\/strong> Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); <\/span><strong>Website:<\/strong> <a href=\"https: \/\/www.personio.de\/\" target=\"_blank\">https:\/\/www.personio.de\/<\/a>. <strong>Privacy Policy:<\/strong> <a href=\"https:\/\/www.personio.de\/datenschutzerklaerung\/\" target=\"_blank\">https:\/\/www.personio.de\/datenschutzerklaerung\/<\/a>.<\/li>\n<\/ul>\n<h2 id=\"m2324\">Privacy information for whistleblowers<\/h2>\n<p>In this section, you will find information on how we handle data relating to individuals who submit reports (whistleblowers), as well as from data subjects and other parties involved, as part of our whistleblowing procedure. Our aim is to provide a straightforward and secure way to report potential misconduct by us, our employees or service providers, particularly in relation to actions that contravene laws or ethical guidelines . We also ensure that reports are processed and handled appropriately.<\/p>\n<ul class=\"m-elements\">\n<li><strong>Types of data processed:<\/strong> Master data (e.g. full name, home address, contact details, customer number, etc.); employment data (information on employees and other individuals in an employment relationship) ; contact details (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or visual messages and posts, as well as related information such as details of authorship or the time of creation); usage data (e.g. page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and functions).<\/li>\n<li><strong>Data subjects:<\/strong> Service recipients and clients; employees (e.g. staff, job applicants, temporary staff and other personnel) ; third parties. Whistleblowers.<\/li>\n<li><strong>Purposes of processing and legitimate interests:<\/strong> Protection of whistleblowers.<\/li>\n<li><strong>Retention and deletion:<\/strong> Deletion in accordance with the information provided in the section \u2018General information on data storage and deletion\u2019.<\/li>\n<li class=\"\"><strong>Legal bases:<\/strong> Consent (Art. 6(1), first sentence, point (a) of the GDPR); Legal obligation (Art. 6(1), first sentence, point (c) of the GDPR). Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).<\/li>\n<\/ul>\n<h2 id=\"m4319\">Whistleblower systems<\/h2>\n<p>We use external providers as part of our whistleblower procedure. In doing so, we act in accordance with legal requirements and ensure that the technical and organisational security requirements we adhere to&amp; are also met by the external providers.<\/p>\n<ul class=\"m-elements\">\n<li><strong>Types of data processed:<\/strong> Master data (e.g. full name, residential address, contact details, customer number, etc.); employee data (information on employees and other individuals in an employment relationship); contact details (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image-based messages and posts, as well as related information such as details of authorship or the time of creation) . Usage data (e.g. page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and functions).<\/li>\n<li><strong>Data subjects: <\/strong> Employees (e.g. staff, job applicants, temporary staff and other personnel) ; third parties. Whistleblowers.<\/li>\n<li><strong>Purposes of processing and legitimate interests:<\/strong> Whistleblower protection.<\/li>\n<li><strong>Retention and erasure:<\/strong> Erasure in accordance with the information provided in the section \u2018General information on data storage and erasure\u2019. <\/li>\n<li class=\"\"><strong>Legal bases:<\/strong> Consent (Art. 6(1), first sentence, point (a) of the GDPR); Legal obligation (Art. 6(1), first sentence, point (c) of the GDPR). Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).<\/li>\n<p><\/p>\n<h2 id=\"m15\">Amendments and updates<\/h2>\n<p>We ask you to check the content of our privacy policy regularly. We will amend the privacy policy as soon as changes to the data processing activities we carry out make this necessary. We will inform you as soon as the changes require action on your part (e.g. consent) or any other individual notification is required.<\/p>\n<p>Where we provide addresses and contact details for companies and organisations in this privacy policy, please note that these details may change over time and we ask that you check the details before making contact.<\/p>\n<h2 id=\"m42 \">Definitions of Terms<\/h2>\n<p>This section provides an overview of the terms used in this privacy policy. Where the terms are defined by law, their statutory definitions apply. The explanations below, however, are primarily intended to aid understanding.<\/p>\n<ul class=\"glossary\">\n<li><strong>Employees:<\/strong> The term \u2018employees\u2019 refers to persons who are in an employment relationship, whether as staff members, staff or in similar roles. An employment relationship is a legal relationship between an employer and an employee, established by an employment contract or an agreement. It entails the employer\u2019s obligation to pay the employee remuneration, whilst the employee performs their work . The employment relationship comprises various phases, including the establishment phase, during which the employment contract is concluded; the performance phase, during which the employee carries out their work; and the termination phase, when the employment relationship ends, whether through dismissal, a mutual termination agreement or otherwise. Employee data refers to all information relating to these individuals and arising in the context of their employment. This includes aspects such as personal identification data, identification numbers, salary and bank details, working hours, holiday entitlements, health data and performance appraisals. <\/li>\n<li><strong>Master data:<\/strong> Master data comprises essential information that is necessary for the identification and management of contractual partners, user accounts, profiles and similar assignments. This data may include, amongst other things, personal and demographic details such as names, contact information<br> (addresses, telephone numbers, email addresses), dates of birth and specific identifiers (user IDs). Master data forms the basis for any formal interaction between individuals and services, organisations or systems, by enabling unambiguous identification and communication. <\/li>\n<li><strong>Content data:<\/strong> Content data comprises information generated in the course of the creation, editing and publication of all types of content. This category of data may include text, images, videos, audio files and other multimedia content published on various platforms and media. Content data is not limited to the actual content itself, but also includes metadata that provides information about the content itself, such as tags , descriptions, author information and publication details <\/li>\n<li><strong>Contact details:<\/strong> Contact details are essential information that enables communication with individuals or organisations. They include, amongst other things, telephone numbers, postal addresses and email addresses, as well as means of communication such as social media handles and instant messaging identifiers. <\/li>\n<li><strong>Meta, communication and procedural data:<\/strong> Meta, communication and procedural data are categories that contain information about the manner in which data is processed, transmitted and managed. Metadata, also known as \u2018data about data\u2019, comprises information that describes the context, origin and structure of other data. It may include details such as file size, creation date, the author of a document and revision histories. Communication data records the exchange of information between users via various channels, such as email correspondence, call logs, social media messages and chat histories, including the individuals involved, timestamps and transmission routes. Process data describes the processes and procedures within systems or organisations, including workflow documentation, transaction and activity logs, as well as audit logs used for tracking and &amp; verifying processes. <\/li>\n<li><strong>Usage data:<\/strong> Usage data refers to information that records how users interact with digital products, services or platforms. This data encompasses a wide range of information that reveals how users utilise applications, which features they prefer, how long they remain on specific pages, and \u00fcthe paths they take when navigating through an application. Usage data may also include the H&amp; frequency of use, timestamps of activities, IP addresses, device information and location data. It is particularly valuable for analysing user behaviour, optimising user experiences, personalising content and improving products or services. Furthermore, usage data play a crucial role in identifying trends, preferences and potential problem areas within digital services <\/li>\n<li><strong>Personal data:<\/strong> \u201cPersonal data\u201d refers to any information relating to an identified or identifiable natural person (hereinafter \u2018data subject\u2019); a natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person. <\/li>\n<li><strong>Profiles containing user-related information:<\/strong> The processing of \u201cprofiles containing user-related information\u201d, or \u201cprofiles\u201d for short, &#8220;, comprises any form of automated processing of personal data which consists of using such personal data to analyse certain personal aspects relating to a natural person (depending on the nature of the profiling, this may include various information concerning demographics, behaviour and interests, such as interaction with websites and their content, etc.) , to evaluate them or to predict them (e.g. interests in specific content or products, clicking behaviour on a website or location). Cookies and web beacons are frequently used for profiling purposes. <\/li>\n<li><strong>Log data:<\/strong> Log data is information \u00fcber events or activities auml;ten that have been logged in a system or network. This data typically contains information such as timestamps, IP addresses, user actions, error messages and other details \u00fcber the use or operation of a system. Log data is often used to analyse system problems, for security&amp; monitoring or to generate performance reports. <\/li>\n<li><strong>Web analytics:<\/strong> Web analytics (also known as web analytics) is used to analyse visitor traffic to an online service and may include the behaviour or interests of visitors regarding specific information, such as website content. With the help of web analytics, operators of online services can, for example, identify at what times users visit their websites and what content they are interested in. This enables them, for example, to better tailor the content of their websites to the needs of their visitors. <\/li>\n<li><strong>Location data:<\/strong> Location data is generated when a mobile device (or another device with the technical capabilities for location determination) connects to a mobile network cell, a Wi-Fi network or similar technical means and functions for location determination. Location data is used to indicate the geographically determinable position on Earth at which the respective device is located. Location data can be used, for example, to display map functions or other location-dependent information. <\/li>\n<li><strong>Data controller:<\/strong> The term \u2018data controller\u2019 refers to the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. <\/li>\n<li><strong>Processing:<\/strong> \u201cProcessing\u201d means any operation or set of operations which is carried out on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, be it collection, analysis, storage, transmission or erasure. <\/li>\n<li><strong>Contract data:<\/strong> Contract data is specific information relating to the formalisation of an agreement between two or more parties. It documents the terms under which services or products are provided, exchanged or sold. This data category is essential for the administration and fulfilment of contractual obligations and encompasses both the identification of the contracting parties and the specific terms and conditions of the agreement. Contract data may include the start and end dates of the contract, the nature of the agreed services or products, pricing arrangements, payment terms, termination rights, renewal options and special terms or clauses. It serves as the legal basis for the relationship between the parties and is crucial for clarifying rights and obligations, enforcing claims and resolving disputes. <\/li>\n<\/ul>\n<\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Data protection notices Privacy Policy Preamble In this Privacy Policy, we aim to explain to you what types of your personal data (hereinafter also referred to simply as \u2018data\u2019) we process, for what purposes and to what extent. This Privacy Policy applies to all processing of personal data carried out by us, processing of personal&hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-8229","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/sternico.com\/en\/wp-json\/wp\/v2\/pages\/8229","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sternico.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sternico.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sternico.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sternico.com\/en\/wp-json\/wp\/v2\/comments?post=8229"}],"version-history":[{"count":13,"href":"https:\/\/sternico.com\/en\/wp-json\/wp\/v2\/pages\/8229\/revisions"}],"predecessor-version":[{"id":11434,"href":"https:\/\/sternico.com\/en\/wp-json\/wp\/v2\/pages\/8229\/revisions\/11434"}],"wp:attachment":[{"href":"https:\/\/sternico.com\/en\/wp-json\/wp\/v2\/media?parent=8229"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}