Personal data is information relating to an identified or identifiable person. This includes, in particular, information that allows conclusions to be drawn about your identity, such as your name, your telephone number, your address or e-mail address. Statistical data, however, that we collect when you visit our website, for example, cannot be linked to your person, and does not fall under the concept of personal data.
- 1. Contact Person
- 2. Data Processing on Our Website
- 2.1 Visiting Our Website / Data Access
- 2.2 Contacting Us
- 2.3 Applications
- 3.1 Legal Basis and Revocation
- 3.2 Required Tools
- 3.3 Analysis Tools
- 3.4 Mouse Flow
- 3.5 Marketing Tools
- 3.6 Social Media Plugins and External Media
- 4. Online Presence in Social Networks
- 5. Data Sharing
- 6. Data Transfer to Third Countries
- 7. Duration of Storage
- 8. Your Rights, in Particular Revocation and Objection
- 9. Individual Deactivation of Tracking/Cookies
1. Contact person
The contact person and so-called person responsible for the processing of your personal data when you visit this website within the frames of the General Data Protection Regulation (GDPR) is
Telephone: +49 (0) 89 242 111 0
You can also contact our data protection officer any time for any questions on the subject of data privacy related to our services or the use of our website. This can be reached at the postal address and at the email address provided above (subject: “to the attention of the data protection officer”). We would like to point out that when using this e-mail address, the content will be taken note of not only by our data protection officer. Therefore, if you wish to exchange confidential information, please first contact us directly via this e-mail address.
2. Data processing on our website
2.1 Visiting Our Website / Data Access
Every time you visit our website, we collect the access data that your browser automatically transmits to enable you to visit the website. The access data includes in particular:
- IP address of the requesting device;
- Date and time of the request;
- Amount of data transferred;
- Notification of successful retrieval (HTTP response code);
- Address of the accessed website and the requesting website;
- Information about the browser and operating system used;
- Online identifiers (e.g. device identifiers, session IDs);
- Name and URL of the retrieved file;
- Referrer URL (i.e. the previously visited page);
- Internet service provider of the user
The processing of this access data is necessary to enable visits to the website and to ensure the permanent functionality and security of our systems. The access data is also temporarily stored in internal log files for the purposes described above in order to generate statistical information about the use of our website. This will further develop our website with regard to the usage habits of our visitors (e.g. if the proportion of mobile devices increases, with which the pages are called up) and for general administrative maintenance of our website.
The legal basis is set forth in GDPR, Article 6, Paragraph 1, Item (b) – if the page is accessed in the course of initiating or executing a contract, and otherwise GDPR, Article 6, Paragraph 1, Item (f) on the basis of our legitimate interest in the long-term functionality and security of our systems.
The log files are stored for 14 days.
2.2 Contacting Us
You have various options for contacting us. This includes the contact form, live chat, registration for events or the callback function. In this context, we process data exclusively for the purpose of communicating with you.
The legal basis is set forth in GDPR, Article 6, Paragraph 1, Item (b) – insofar as your information is required to answer your inquiry or to initiate or execute a contract, and otherwise in GDPR, Article 6, Paragraph 1 Item (f), due to our legitimate interest that you contact us and that we can address your request. We only make promotional phone calls if you have given us your consent. If you are not a current customer, we will only send you promotional emails considering your consent. In these cases, the legal basis is set forth in GDPR, Article 6, Paragraph 1, Item (a).
The data collected by us while using the contact form will be automatically deleted after your request has been processed in full, unless your request will still be required to fulfill contractual or legal obligations (see Section 7 “Storage period”).
You can apply for our vacancies via our applicant management system at Personio GmbH, Rundfunkplatz 4, 80335 Munich (“Personio”). The purpose of the data collection is to select applicants for the possible establishment of an employment relationship. In order to receive and process your application, we collect particularly the following data: first and last name, e-mail address, application documents (e.g. certificates, curriculum vitae), date of the earliest possible job start and salary expectations. The legal basis for the processing of your application documents is set forth in GDPR, Article 6, Paragraph 1, Item (b) as well as GDPR Article 88, Paragraph 1 in conjunction with BDSG, Article 26, Paragraph 1.
A cookie is a small text file that is stored on your device by the browser. Cookies are not used to run programs or load viruses onto your computer. Comparable technologies are in particular web storage (local / session storage), fingerprints, tags or pixels. By default, most browsers are set to accept cookies and similar technologies. However, you can usually adjust your browser settings so that cookies or similar technologies are rejected or only saved with your prior consent. If you decline cookies or similar technologies, not all of our offerings may work properly for you.
Below are the tools we use that are listed as per categories, whereby we inform you in particular about the providers of the tools, the storage period of the cookies and the transfer of the data to third parties. It is also explained in which cases we obtain your voluntary consent to use the tools and how you can revoke it.
3.1 Legal Basis and Revocation
3.1.1 Legal Basis
We use the tools required for website operation based on our legitimate interest in accordance with Paragraph 1 of Article 6 of GDPR. In certain cases, these tools may also be required to fulfill a contract or to carry out pre-contractual measures. Here processing takes place in accordance with Item (b) of Paragraph 1 of Article 6 of GDPR.
We use all other tools, in particular those for marketing purposes, based on your consent in accordance with Paragraph 1 of Article 6. Data processing and use of these tools will only take place if we have received your prior consent.
If personal data is transferred to third countries, we refer to Chapter 5. (“Transfer of personal data to third countries”), also with regard to the risks that may be associated with it. We will inform you when we have standard contractual clauses or other guarantees in place with the providers of certain tools. If you have given your consent to the use of certain tools, we will (also) transfer the data processed when using the tools to third countries on the basis of this consent.
3.1.2 Withdrawing Your Consent or Changing Your Choices
You can revoke your consent for certain tools at any time. To do so, click on the following link. There you can also change the selection of the tools that you would like to give your permission to use, as well as additional information about the cookies and the respective storage period. Alternatively, you can assert your revocation for certain tools directly with the provider.
3.2 Required Tools
We use certain tools to enable the basic functions of our website (“required tools”). Without these tools we would not be able to provide our service. Therefore, these tools are used without any permission on the basis of our legitimate interests in accordance with Item (f) of Paragraph 1 of Article 6 of GDPR or to fulfill a contract or to carry out pre-contractual measures in accordance with Item (b) of Paragraph 1 of Article 6 of GDPR.
3.2.1 Own Cookies
We use our own cookies, in particular
- Pseudonym identification of the user
3.2.2 Google Tag Manager
Our website uses Google Tag Manager, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for users from the European Economic Area and Switzerland and by Google LLC (1600 Amphitheater Parkway Mountain View, CA 94043, USA) for all other users (collectively referred to as “Google”).
The Tag Manager is used to manage tracking tools and other services, so-called website tags. A tag is an element that is stored in the source code of our website, for example to record specified usage data. The Google Tag Manager ensures that the usage data required by our partners is forwarded to them.
The Google Tag Manager sets the following cookies for technical debugging purposes: “gtm”; “gtm_auth”; “gtm_debug”; “gtm_preview”; “gtm_mt”.
The legal basis is set forth in GDPR, Article 6, Paragraph 1 Item (f), based on our legitimate interest in integrating and managing multiple tags on our website in an uncomplicated manner.
We have concluded an order processing contract with Google. Some data is processed on a Google server in the USA. In the event that personal data is transferred to the USA or other third countries, we have concluded standard contractual clauses with Google in accordance with Article 46 (2) (c) of GDPR. For more information, please refer to Chapter 5 (“Transfer of Data to Third Countries”).
You can find more information on this in Google’s information on Tag Manager.
3.3 Analysis Tools
In order to improve our website, we use tools for statistical recording and analysis of general usage behavior based on access data (“analysis tools”). We also use analysis services to evaluate the use of our various marketing channels.
Unless otherwise stated, the legal basis for the analysis tools is your consent in accordance with Item (a) of Paragraph 1 of Article 6, GDPR. In order to withdraw your consent, please refer to 3.1.2: “
3.3.1 Google Analytics
Our website uses Google Analytics, a web analytics service provided by Google LLC, (1600 Amphitheater Parkway, Mountain View, CA 94043, USA). According to Google, the contact for all data protection issues is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
We have made the following data protection settings for Google Analytics:
- IP anonymization (shortening of the IP address before evaluation, so that no conclusions can be drawn about your identity)
- Automatic deletion of old logs / limitation of the storage period
- Advertising feature disabled (including audience remarketing by GA Audience)
- Opt out of personalized ads
- Deactivated Measurement Protocol
- Disabled cross-site tracking (Google signals)
- Disabled data sharing with other Google products and services
The following data is processed by Google Analytics:
- Anonymized IP address;
- Referrer URL (previously visited page);
- Pages accessed (date, time, URL, title, length of stay);
- Downloaded files;
- Clicked links to other websites
- Achievement of certain goals (conversions), if required;
- Technical information: operating system; browser type, version and language; device type, brand, model and resolution;
- Approximate location (country and city, if applicable, based on anonymized IP address).
Google Analytics sets the following cookies for the specified purpose with the respective storage period:
- “_ga” for 2 years and “_gid” for 24 hours (both to recognize and differentiate website visitors with a user ID);
- “_gat” for 1 minute (to reduce requests to the Google servers);
- “_gid” for 1 day (Registers a unique ID used to generate statistical data on how the visitor uses the website.);
- “_gat_gtag_*” browser session (this cookie is used in conjunction with Google Universal Analytics to throttle the request rate and limit the collection of data on busy websites.);
- “IDE” for 13 months (third-party cookie for recognizing and distinguishing between website visitors with a user ID, for recording interaction with advertising and for displaying personalized advertising).
We have concluded an order processing contract with Google for the use of Google Analytics as well as standard contractual clauses in the event that personal data is transferred to the USA or other third countries.
3.4 Mouse Flow
We use Mouseflow, a web analysis tool from Mouseflow ApS, (Flaesketor-vet 68, 1711 Copenhagen, Denmark) on our website to record randomly selected individual visits (only with an anonymized IP address). This creates a log of mouse movements and clicks with the intention of randomly playing back individual website visits and deriving potential improvements for the website from them. The information is not personal and will not be passed on.
The cookies used by Mouseflow are:
- mf_replace hashes
If you do not want a recording, you can alternatively use it on all websites that use Mouseflow, using the following link: www.mouseflow.de/opt-out/.
3.5 Marketing Tools
We also use tools for advertising purposes (“Marketing Tools”). Some of the access data generated when using our website is used for interest-based advertising. By analyzing and evaluating this access data, we are able to show you personalized advertising, i.e. advertising that corresponds to your actual interests and needs, on our website and on the websites of other providers.
The legal basis for the marketing tools is your consent in accordance with Item (a) of Paragraph 1 of Article 6, GDPR. In order to withdraw your consent, please refer to Item 3.1.2: “Withdrawing your consent or changing your choices”. In the event that personal data is transferred to the USA or other third countries, your consent also expressly extends to the data transfer (GDPR, Article 49, Paragraph 1, Item (a). Please refer to the chapter for the associated risks
In the following section we would like to explain these technologies and the providers used for them in more detail. The data collected may include in particular:
- The IP address of the device;
- The identification number of a cookie;
- The device identifier of mobile devices (Device ID);
- Referrer URL (previously visited page);
- Pages accessed (date, time, URL, title, length of stay);
- Downloaded files;
- Clicked links to other websites;
- Achievement of certain goals (conversions);
- Technical information: operating system; browser type, version and language; device type, brand, model and resolution;
- Approximate location (country and city if applicable).
However, the data collected is only stored pseudonymously, so that no direct conclusions can be drawn about the person.
3.5.1 Google Marketing Platform und Ad Manager (ehemals DoubleClick)
Unsere Website verwendet die Google Marketing Platform und den Google Ad Manager, Dienste die für Nutzer aus dem Europäischen Wirtschaftsraum und der Schweiz von der Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland und für alle übrigen Nutzer von der Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (zusammen „Google“) angeboten werden.
Diese Dienste verwenden Cookies und ähnliche Technologien, um Ihnen für Sie relevante Werbeanzeigen zu präsentieren. Die Verwendung der Dienste ermöglicht Google und seinen Partner-Websites die Schaltung von Anzeigen auf Basis vorheriger Besuche auf unserer oder anderen Websites im Internet.
Die in diesem Zusammenhang anfallenden Daten können von Google zur Auswertung an einen Server in den USA übertragen und dort gespeichert werden. Für den Fall, dass personenbezogene Daten in die USA übertragen werden, haben wir mit Google Standardvertragsklauseln abgeschlossen.
Wenn Sie der Verwendung von Google Marketing Platform und Ad Manager nicht zugestimmt haben, wird Google nur noch generelle Werbung anzeigen, die nicht anhand der über Sie erfassten Informationen auf dieser Website ausgewählt wurde. Neben dem Widerruf Ihrer Einwilligung haben Sie zudem die Möglichkeit, personalisierte Werbung in den Einstellungen für Werbung bei Google zu deaktivieren.
Folgende Cookies werden durch Google gesetzt:
Nähere Informationen hierzu finden Sie in der Datenschutzerklärung von Google.
3.5.1 Facebook Pixel
For marketing purposes, our website uses the “Facebook Pixel” service from Facebook social network, a service provided by Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) for users outside the USA and Canada, and for all other users by Facebook Inc., (1601 Willow Road, Menlo Park, California 94025, USA (collectively referred to as “Facebook”).
We use Facebook pixels to analyze the general use of our websites and to understand the effectiveness of Facebook advertising (“conversion tracking”). We also use Facebook pixels to show you individualized advertising messages based on your interest in our products (“retargeting”). Target group remarketing is also carried out by Custom Audience. For this purpose, Facebook processes data that the service collects via cookies, web beacons and comparable storage technologies on our websites.
The data generated in this context can be transferred from Facebook to a server in the USA for evaluation and stored there. In the event that personal data is transferred to the USA, we have concluded standard contractual clauses with Facebook.
If you have a Facebook account and have allowed via the privacy settings of your account, Facebook can also link the information collected about your visit to your member account and use it for the targeted placement of Facebook ads. You can view and change the privacy settings of your Facebook profile at any time.
If you have not agreed to the use of Facebook pixels, Facebook will only display general Facebook ads that are not selected on this website based on the information collected about you.
You can find more information on this in Facebook’s data protection policy.
3.5.2 Lead Forensics
Products and services from Lead Forensics (http://www.leadforensics.com) are used on this website for marketing and optimization purposes. Lead Forensics’ head office is at Communication House 26 York Street, London, W1U 6PZ United Kingdom. Lead Forensics can assign the user to a company based on the business IP address by comparing the IP address with the Lead Forensics database. In addition, Lead Forensics shows the actual history of your visit to our website, including all the pages you visited and viewed and how long you spent on that page. Your data will not be used to personally identify your visit and we cannot see any further information from you. If IP addresses are collected, they will be anonymized immediately after collection. Lead Forensics supports us in evaluating visits to our website and compiles reports for us on website activity. They also provide us with other services related to website activity and internet usage.
The following cookies are set by Lead Forensics:
3.6 Social Media Plugins and External Media
We also use tools from social networks that are used to log in with the existing user accounts on the website or to share posts and content via these networks (“social media plugins”), as well as other external media, such as embedded videos or Cards.
Unless otherwise stated, the legal basis for this is your consent in accordance with Article 6 Paragraph 1. In order to withdraw your consent refer to item 3.1.2 “Withdrawing your consent or changing your choices”. In the event that personal data is transferred to the USA or other third countries, your consent also expressly extends to the data transfer (Article 49 (1), item (a) GDPR). Please refer to section for the associated risks.
3.6.1 YouTube Videos
We have embedded videos on our website that are stored on YouTube and can be played from our websites, provided you have given your consent. YouTube is a multimedia service provided by YouTube LLC (901 Cherry Ave., San Bruno, CA 94066, USA) (“YouTube”), a group company of Google LLC (1600 Amphitheater Parkway, Mountain View, CA 94043, USA), (“Google”).
By visiting our website, YouTube and Google receive the information that you have accessed the corresponding subpage of our website. This happens regardless of whether you are logged in to YouTube or Google or not. YouTube and Google use this data for advertising, market research and needs-based design of their websites. If you access YouTube on our website while you are logged into your YouTube or Google profile, YouTube and Google can also link this event to the respective profiles. If you do not wish to be assigned, you must log out of Google before accessing our website.
In addition to revoking your consent, you also have the option of deactivating personalized advertising in the Google advertising settings. In this case, Google will only display non-personalised advertising.
3.6.2 Google Maps
Our website uses the Google Maps map service, which is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for users from the European Economic Area and Switzerland and by Google LLC (1600 Amphitheater Parkway Mountain View, CA) for all other users 94043, USA (collectively referred to as “Google”).
In order for the Google map material we use to be integrated and displayed in your web browser, your web browser must connect to a Google server, which may also be located in the USA, when you visit our website. In the event that personal data is transferred to the USA or other third countries, we have concluded standard contractual clauses with Google.
By integrating the map material, Google receives the information that a page on our website was accessed from the IP address of your device. If you call up the Google map service on our website while you are logged into your Google profile, Google can also link this event to your Google profile. If you do not wish to be assigned to your Google profile, you must log out of Google before calling up our contact page. Google stores your data and uses it for advertising, market research and personalized Google Maps display purposes.
4. Online Presence in Social Networks
We maintain online presences in social networks in order to communicate with customers and interested parties and to provide information about our services.
User data is usually processed by the relevant social networks for market research and advertising purposes. In this way, usage profiles can be created based on the interests of the users. For this purpose, cookies and other identifiers are stored on the users’ computers. To this refer advertisements within social networks as well as on third-party websites.
As part of the operation of our online presence, it is possible for us to access information such as statistics on the use of our online presence that is provided by the social networks. These statistics is aggregated and may contain, in particular, demographic information and data on interaction with our online presence and the contributions and content distributed via it. Please refer to the list below for details and links to the data of the social networks that we, as the operator of the online presence, can access.
The legal basis for data processing is set forth in GDPR, Article 6 Paragraph 1, Item (f), based on our legitimate interest in effective user information and communication with users, or GDPR, Article 6, Paragraph 1, Item (b) in order to stay in contact with our customers and to inform them as well as to carry out pre-contractual measures with future customers and interested parties.
We would like to point out that data protection inquiries can be made most efficiently with the respective provider of the social network, since only these providers have access to the data and can take appropriate measures directly. Below is a list of information about the social networks on which we operate online presences:
- Facebook (USA and Canada: Facebook Inc., 1601 Willow Road, Menlo Park, California 94025, USA; all other countries: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)
- Operation of the Facebook fan page in joint responsibility on the basis of an agreement on joint processing of personal data (so-called page insights supplement regarding the responsible person)
- Information on the processed page insights data and contact options in the event of data protection requests: https://www.facebook.com/legal/terms/information_about_page_insights_data
- Opt-Out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com.
- Instagram (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)
- Google/ YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)
- Twitter (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland)
- LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland)
- Operation of the LinkedIn company page in joint responsibility on the basis of an agreement on the joint processing of personal data (so-called Page Insights Joint Controller Addendum)
- Information on the processed Page Insights data and how to contact us in the event of data protection requests: https://legal.linkedin.com/pages-joint-controller-addendum
- Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
- Xing/Kununu (XING SE, Dammtorstrasse 30, 20354 Hamburg)
5. Data Sharing
In principle, the data collected by us will only be passed on if:
- You have given your consent to it in accordance with Item (f) of Paragraph 1 of Article 6 of GDPR,
- Disclosure pursuant to Item (f) of Paragraph 1 of Article 6 of GDPR is required to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding legitimate interest in not disclosing your data,
- We are legally obliged to pass it on according to Item (c) of Paragraph 1 of Article 6 of GDPR
- This is set forth by law and is required pursuant to Item (b) of Paragraph 1 of Article 6 of GDPR for the processing of contractual relationships with you or for the implementation of pre-contractual measures that take place at your request.
In addition, data may be passed on in connection with official inquiries, court orders and legal proceedings if it is required for legal prosecution or enforcement.
6. Data Transfer to Third Countries
Where this is not possible, we base the data transfer on exceptions of Article 49 GDPR, in particular your consent or the necessity of the transfer to fulfill the contract or to carry out pre-contractual measures.
If a transfer to a third country is planned and there is no respective decree available or suitable guarantees, it is possible and there is a risk that authorities in the respective third country (e.g. security services) may gain access to the transferred data in order to collect and analyze it, and that the enforceability of your rights as a data subject cannot be guaranteed. If you obtain your consent via the cookie banner, you will also be informed of this.
7. Duration of Storage
In principle, we only store personal data for as long as it is required to fulfill contractual or legal obligations for which we have collected the data. We then delete the data immediately, unless we still need the data until the end of the statutory limitation period as evidence for civil claims or due to statutory retention requirements.
For evidence purposes, we must keep contract data for three years after the end of the business relationship with you. Any claims become statute-barred according to the statutory limitation period at the earliest at this point in time.
Even after that, we still have to store some of your data for accounting purposes. We are obligated to do so due to legal documentation obligations that may result from the German Commercial Code, the Tax Code, the Banking Act, the Money Laundering Act and the Securities Trading Act. The periods specified there for storing documents range is from two to ten years.
8. Your Rights, in Particular Revocation and Objection
You are at any time entitled to the data subject rights set forth in Articles 15 – 21, Article 77 GDPR as follows:
- Right to withdraw your consent;
- Right to object to the processing of your personal data (Article 21 GDPR);
- Right to information about your personal data processed by us (Article 15 GDPR);
- Right to rectification of your incorrectly stored personal data (Article 16 GDPR);
- Right to erasure of your personal data (Article 17 GDPR);
- Right to restrict the processing of your personal data (Article 18 GDPR);
- Right to portability of your personal data (Article 20 GDPR);
- Right to lodge a complaint with a supervisory authority (Article 77 GDPR).
In order to exercise your rights described above, you can contact us at any time using the contact details provided above. This also applies if you would like to receive copies of guarantees to prove an appropriate level of data protection. If the respective legal requirements are met, we will comply with your data protection request.
Your requests to assert data protection rights and our responses to them will be kept for documentation purposes for a period of up to three years and, in individual cases, for the assertion, exercise or defense of legal claims also beyond that. The legal basis is set forth in GDPR Article 6 (1), Item (f), based on our interest in defending against any civil claims under Article 82 GDPR, avoiding fines under Article 83 GDPR and fulfilling our accountability under Article 5 paragraph 2 GDPR.
You are entitled to revoke any consent you have given us at any time. As a result, we will no longer continue the data processing based on this consent for the future. The revocation of the consent does not affect the legality of the processing carried out on the basis of the consent up to the point of revocation.
If we process your data on the basis of legitimate interests, you are entitled to object to the processing of your data at any time for reasons that arise from your particular situation. If you object to data processing for direct marketing purposes, you have a general right to object, which we will implement without giving reasons.
If you would like to exercise your right of revocation or objection, you can send an informal message via the above mentioned contacts.
Finally, you are entitled to complain to a data protection supervisory authority. You can exercise this right with a supervisory authority in the member state of your place of residence, your place of work or the place of the alleged infringement. In Bavaria, where we are based, the responsible supervisory authority is: Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Munich.
Version: 2.0 / Stand: Februar 2021