Data privacy

2. What’s it about?

This privacy policy fulfils the legal requirements for transparency in the processing of personal data. Personal data means any information which relates to an identified or identifiable natural person. It includes information such as your name, age, address, telephone number, date of birth, email address, IP address and your user behaviour when visiting a website. Information which does not allow us to establish a connection with you personally (or only does so with disproportional effort), such as information that has been anonymised, is not considered personal data. The processing of personal data (such as its collection, request, use, storage and transmission) must always have a legal basis and a defined purpose.

Stored personal data is deleted as soon as the purpose of processing has been achieved and there are no more legitimate grounds to continue to keep it. We will tell you about specific storage periods and criteria when we come to the different processing operations. Aside from that though, we store your personal data in particular instances in order to assert, exercise or defend legal rights and if there are laws that say we must retain it.

3. Who gets my data?

We only share your personal data that we process on our website with third parties if we need to in order to fulfil the purposes, and if doing so is justified by the legal basis in each case (e.g. consent, or safeguarding legitimate interests). We also disclose personal data to third parties in particular cases if doing so serves the purpose of asserting, exercising or defending legal rights. Potential recipients can include law enforcement agencies, lawyers, auditors, courts and similar.

If in operating our website we use service providers who process personal data on our behalf as described in to Art. 28 GDPR, they may receive your personal data. More information on the use of data processors and web services can be found in the overview of different processing operations.

4. Active components

We use JavaScript for our website’s search function and email address encryption. You can switch off this function in your browser’s settings.

5. Do we use cookies?

Cookies are small text files that are sent to and stored in your device’s browser when you visit our website. Information can also be stored in your browser’s local storage as an alternative to cookies. Some of our website’s features will not work without using cookies or local storage (technically necessary cookies). Other cookies, however, enable us to perform a range of analyses so that, for instance, we are able to recognise the browser you use when you return to our website, and to have various kinds of information sent to us (non-essential cookies). Cookies help us make our website more user-friendly and effective by tracking the way you use it and recording your preferred settings (such as country and language settings). If third parties process information using cookies, they collect the information directly via your browser. Cookies will not damage your device. They cannot run programs or contain viruses. We will tell you about the services for which we use cookies when we come to the different processing operations. You will find detailed information about the cookies used in your cookie settings and in this website’s consent manager.

6. What are my rights?

As a data subject, the General Data Protection Regulation (GDPR) gives you the following rights:

• Information, pursuant to Art. 15 GDPR, about data stored that relates to you, in the form of meaningful details of how it is processed as well as a copy of your data.;
• Correction, pursuant to Art. 16 GDPR, of any inaccurate or incomplete data which we are storing.;
• Deletion, pursuant to Art. 17 GDPR, of data we are storing, if its processing is not required in order to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest, or to assert, exercise or defend legal rights.;
• Restriction of processing, pursuant to Art. 18 GDPR, if the accuracy of the data is disputed, its processing is unlawful, we no longer need the data but you object to its deletion because you need it in order to assert, exercise or defend legal rights, or you have objected to its processing pursuant to Art. 21 GDPR.
• Data portability, pursuant to Art. 20 GDPR, if you have provided us with personal data with your consent pursuant to Art. 6 (1) a GDPR, or on the basis of a contract pursuant to Art. 6 (1) b GDPR, and we have processed it using automated processes. You will receive your data in a structured, common and machine-readable format, or we will send it directly to another controller, provided doing so is technically feasible.
• Objection, pursuant to Art. 21 GDPR, to the processing of your personal data, if done on the basis of Art. 6 (1) e, f GDPR and there are reasons relating to your particular situation or your objection is to direct advertising. You have no right to object if overriding, compelling, legitimate reasons for the processing can be demonstrated, or the processing is done in order to assert, exercise or defend legal rights. You will be told if you have no right to object when we come to particular processing operations.
• Revocation of your consent with effect for the future, pursuant to Art. 7 (3) GDPR.
• Complaint to a supervisory authority pursuant to Article 77 GDPR, if you think that the processing of your personal data violates GDPR. Generally speaking, you can appeal to the supervisory authority at your usual place of residence, your place of work or our company headquarters. You can reach them using the following contact details:
  
  Postal address:
  Postfach 10 29 32
  70025 Stuttgart
  
  Physical address:
  Lautenschlagerstraße 20
  70173 Stuttgart
  Tel.: +49 (0) 711 615541-0
  Fax: +49 (0) 711 615541-15
  Email: poststelle(at)lfdi.bwl.de

7. How exactly is my data processed?

We will now explain the different processing operations, the scope and purpose of data processing, its legal basis, the duty to provide your data and the storage periods involved. There is no automated decision-making in specific cases, and that includes profiling.

7.1. Provision of the website

7.1.1. Nature and scope of processing

When you open and use our website, we collect the personal data that your browser automatically sends to our server. The following information is temporarily stored in what is known as a log file:

• IP address of the requesting computer
• Date and time of access
• Name and URL of accessed file
• Website from which the site is accessed (referrer URL)
• Browser used and, if applicable, the operating system of your computer, and the name of your access provider

We ourselves do not host our website. This is done by a service provider which processes the aforementioned data on our behalf pursuant to Art. 28 GDPR:

Timme Hosting GmbH & Co. KG

Ovelgönner Weg 43

21335 Lüneburg

7.1.2. Purpose and legal basis

Processing is done to protect our prevailing legitimate interest in displaying our website and guaranteeing its security and stability on the basis of Art. 6 () f GDPR. Collecting data and storing it in log files is essential to the operation of the website. You have no right to object to this processing, on account of the exception defined in Art. 21 (1) GDPR. If continued storage of log files is stipulated by law, then the processing is done on the basis of Art. 6 (1) c GDPR. There is no legal or contractual obligation to provide the data, but it would be technically impossible to open our website without providing it.

7.1.3. Retention period

The aforementioned data is stored while the website is being displayed and, for technical reasons, for a maximum of seven days thereafter.

8. Contact form

8.1. Nature and scope of processing

Our website offers you the opportunity to contact us using a form. The information in the mandatory fields is required in order to process the request. You can also voluntarily provide additional information that you think we will need to respond to your enquiry.

Your personal data is not passed on to third parties when you use the contact form.

8.2. Purpose and legal basis

When you use our contact form, your data is processed for the purpose of communicating and processing your enquiry on the basis of your consent pursuant to Art. 6 (1) a GDPR. If your enquiry relates to an existing contractual relationship with us, then processing is done for the purpose of fulfilling the contract on the basis of Art. 6 (1) b GDPR. There is no legal or contractual obligation to provide the data, but it is impossible to process your enquiry if you do not provide the information in the mandatory fields. If you do not wish to provide this data, please contact us using another method.

8.3. Retention period

If you use the contact form on the basis of your consent, we store the data collected for your enquiry for a period of three years, beginning with when your enquiry is dealt with, or until you revoke your consent.
If you use the contact form as part of a contractual relationship, we store the data collected for your enquiry for a period of [three years], beginning at the end of the contractual relationship.

9. Contact form for applicants

9.1. Nature and scope of processing

Our website enables you to submit an application to us using a form. The information in the mandatory fields is required in order to process the request. You can also voluntarily provide additional information that you think we will need to respond to your enquiry.

If you have provided us with separate consent, independent of the use of the application form, we will pass on your application to our affiliated subsidiaries.

Data is not passed on to third parties when you use the application form.

9.2. Purpose and legal basis

Processing your data based on your use of the application form is done for the purpose of handling your application and deciding whether to establish an employment relationship on the basis of § 26 BDSG (German Federal Data Protection Act). There is no legal or contractual obligation to provide your data, but it is impossible to process your application if you do not provide the information in the mandatory fields. If you do not wish to provide this data, please use another method to apply.

9.3. Retention period

We store the data collected for as long as the application process lasts and, if you do not take up a position with us, for six months from the date on which this is decided; if you do take up a position with us, then for three years after you finish working with us.

10. Matomo

10.1. Nature and scope of processing

We use the open source software tool Matomo on our website, provided that you give us consent to do so. This software places cookies in your browser (for cookies, see above).
When you open specific pages of our website, the following data is stored:

• Two bytes of your system’s IP address (anonymised IP address)
• The web page accessed
• The website from which you accessed the page (referrer)
• The particular pages that are accessed from the accessed website
• The length of time you stay on the website
• How often you visit the website

The software only runs on the our website’s servers. Your personal data is only stored there. The data is not given to third parties.

10.2. Purpose and legal basis

We process your data using the analysis software Matomo for the purpose of assessing the use of particular components and items of content of our website, and on the basis of your consent pursuant to Art. 6 (1) a GDPR. You provide your consent using the cookie settings (cookie banner / consent manager), which you can also use to revoke your consent at any time with effect for the future, pursuant to Art. 7 (3) GDPR. There is no legal or contractual obligation to provide your data. If you do not give us your consent, you can still visit our website without restrictions, but some of its features may not work properly.

10.3. Retention period

The period for which the processed data is stored is six months.

11. Google Ads

11.1. Nature and scope of storage

We use Google Ads campaigns provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland for the purpose of online marketing – provided you have given us your consent to do so. This Google service processes:

• Your IP address
• Access statistics
• The places from which you access the site
• Device data
• Access duration and time
• Navigation behaviour
• Click behaviour

The data collected is transferred to Google’s servers in the USA and stored there.

Google Ads uses cookies (for cookies, see above) and other browser technologies to evaluate user behaviour and recognise returning users.

This information is used partly to compile reports about our online marketing.

11.2. Purpose and legal basis

We process data using Google Ads for the purpose of improving our advertising campaigns and for marketing based on your consent pursuant to Art. 6 (1) a GDPR.

We also have a legitimate interest in using Google Ads Conversion Tracking to improve our online service and marketing activities. The legal basis for this is Art. 6 (1) f GDPR (legitimate interests). Having said that, we only use Google Ads Conversion Tracking if you give us your consent.

11.3. Retention period

We cannot change the length of time for which the processed data is stored; it is determined by Google Ireland Limited. You will find further information in the Google Analytics privacy policy: https://policies.google.com/privacy?hl=de&gl=de

12. Google Maps

12.1 Nature and scope of processing

Our website uses Google Maps, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in order to provide you with an interactive map – provided you have given us your consent. When the map is shown, data, including your IP address and your location, is transmitted to Google’s servers in the USA and stored there. Google Maps uses cookies (for cookies, see above) and other browser technologies to evaluate user behaviour and recognise returning users.

12.2. Purpose and legal basis

We use Google Maps on our website to provide you with an interactive map of our locations and to assist with route planning. This is done on the basis of your consent pursuant to Art. 6 (1) a GDPR.

12.3. Retention period

We cannot change the length of time for which the processed data is stored; it is determined by Google Ireland Limited. You will find further information in the Google Analytics privacy policy: https://policies.google.com/privacy?hl=de&gl=de

13. Social media platforms

We maintain fan pages, accounts and channels on the networks listed below in order to provide you with information and offer services on social networks, and to give you additional ways of contacting us and finding out about what we offer. We will now tell you about the data we and the social networks process when you open and use our fan pages / accounts.

13.1. Your data which we process

If you want to contact us using a messenger service or a direct message on a social network, we usually process the user name with which you contact us and we may store other data you provide, if we need it to process and respond to your enquiry.

The legal basis for this is Art. 6 (1) 1 f GDPR; processing is necessary to pursue the controller’s legitimate interests.

13.2. (Statistical) usage data we receive from the social networks

The features of Insights provide us with automated statistics relating to our accounts. These statistics include the total number of page views, likes, details of page activities and post interactions, reach, video views and details of the ratio of men to women among our fans/followers.

These statistics only contain aggregated data that cannot be associated with individuals. You cannot be identified using them.

13.3. Data relating to you which social networks process

You do not have to be a member of a social network to view the content of our fan page or account, which means you do not require a user account.

Please note, however, that social networks collect and store data from website visitors who do not have user accounts when they visit them (such as technical data that allows them to display their websites for you), and they use cookies and similar technologies over which we have no control. For details, please see the privacy policy of the social network concerned (see the links above).

If you want to interact with the content on our fan pages / accounts – such as if you want to comment on, share or like our posts/articles and/or contact us using messenger services – you will first have to register with the respective social network and provide personal data.

We cannot influence the way in which social networks process data when you use them. As far as we know, your data is stored and processed, especially in conjunction with providing a social network’s services, and is also used to analyse user behaviour (by means of cookies, pixels / web beacons and similar technologies), on the basis of which, advertising tailored to your interests is shown to you both inside and outside the respective social network. It is possible that your data will be stored by the social networks outside of the EU/EEA and passed on to third parties.

The social network’s data privacy policy and cookie policy will contain information about the exact extent and purpose of processing your personal data, the length of time for which it is stored and its deletion, and guidelines on the use of cookies and similar technologies associated with registering with and using social networks. They will also contain information about your rights and about ways of objecting.

13.4. Facebook page

When you visit our Facebook page, Facebook collects your IP address and other information that is on your computer in the form of cookies. This information is used to provide us, as operators of the Facebook page, with statistical information about how it is used. Facebook provides more information about this under the following link: https://facebook.com/help/pages/insights.

The statistical information sent does not allow us to draw conclusions the individual users it relates to. We only use it to respond to the interests of our users and to continuously improve and ensure the quality of our website.

We only collect your data via our fan page so that we can use it when you communicate and interact with us. This data usually includes your name, message content, comments and public profile information.

The processing of your personal data for these purposes is done on the basis of our legitimate business and marketing objective of offering an information and communication channel pursuant to Art. 6 (1) f GDPR. If you, as a user, have given the provider of the social network your consent to the processing of data, then the legal basis for processing also includes Art. 6 (1) a, Art. 7 GDPR.

Because the actual data processing is done by the provider of the social network, our access to your data is limited. Only the provider of the social network is entitled to full access to your data. Because of this, only the provider can actually take the steps necessary to fulfil your user rights (information requests, deletion requests, objections and so on). The most effective way of asserting such rights is therefore to contact the provider directly.

We and Facebook are jointly responsible for anything on the fan page that relates to particular individuals. Data subject rights can be asserted vis-à-vis Facebook Ireland and us. According to GDPR, primary responsibility for the processing of Insights data lies with Facebook, and Facebook complies with all of its GDPR obligations relating to the processing of Insights data; Facebook Ireland provides data subjects with the substance of the Insights add-in.

We do not make any decisions regarding the processing of Insights data or any other information arising from Art. 13 GDPR, including legal basis, controller identity and storage periods for cookies on user devices.

You can obtain further information from Facebook itself (supplementary agreement with Facebook): https://www.facebook.com/legal/terms/page_controller_addendum.

13.5. Instagram page

When you visit our Instagram page, Instagram collects your IP address and other information that is on your computer in the form of cookies. This information is used to provide us, as operators of the Instagram page, with statistical information about its use. Instagram provides more information about this under the following link: https://www.facebook.com/help/instagram/788388387972460?helpref=related.

The statistical information sent does not allow us to draw conclusions the individual users it relates to. We only use it to respond to the interests of our users and to continuously improve and ensure the quality of our website.

We only collect your data via our fan page so that we can use it when you communicate and interact with us. This data usually includes your name, message content, comments and public profile information.

The processing of your personal data for these purposes is done on the basis of our legitimate business and marketing objective of offering an information and communication channel pursuant to Art. 6 (1) f GDPR. If you, as a user, have given the provider of the social network your consent to the processing of data, then the legal basis for processing also includes Art. 6 (1) a, Art. 7 GDPR.

Because the actual data processing is done by the provider of the social network, our access to your data is limited. Only the provider of the social network is entitled to full access to your data. Because of this, only the provider can actually take the steps necessary to fulfil your user rights (information requests, deletion requests, objections and so on). The most effective way of asserting such rights is therefore to contact the provider directly.

We and Instagram are jointly responsible for anything on the fan page that relates to particular individuals. Data subject rights can be asserted vis-à-vis Facebook Ireland and us. According to GDPR, primary responsibility for the processing of Insights data lies with Instagram, and Instagram complies with all of its GDPR obligations relating to the processing of Insights data; Facebook Ireland provides data subjects with the substance of the Insights add-in.

We do not make any decisions regarding the processing of Insights data or any other information arising from Art. 13 GDPR, including legal basis, controller identity and storage periods for cookies on user devices.

You can obtain further information from Instagram itself:
https://help.instagram.com/519522125107875.

13.6. LinkedIn page

LinkedIn is a social network belonging to LinkedIn Inc., Sunnyvale, California, USA, which enables people to set up private and professional profiles. Users can maintain existing contacts and make new ones. Companies can create profiles and upload photos and other company details there. Other LinkedIn users have access to this information and can write their own articles and share this content with others.

The emphasis is on professional communication about specialist topics with people who share the same professional interests. LinkedIn is also used by many businesses and other organisations to recruit employees and present themselves as attractive employers.

For more information about LinkedIn, please visit: https://about.linkedin.com/

More information about data privacy at LinkedIn: https://www.linkedin.com/legal/privacy-policy

We do not collect or process any personal data via our LinkedIn company page.

13.7. XING page

XING is a social network belonging to XING SE, which his based in Hamburg, Germany, which enables people to create private and professional profiles. Users can maintain existing contacts and make new ones. Companies can create profiles and upload photos and other company details there. Other XING users have access to this information and can write their own articles and share this content with others.

The emphasis is on professional communication about specialist topics with people who share the same professional interests. XING is also used by many businesses and other organisations to recruit employees and present themselves as attractive employers.

For more information about XING, please visit: https://corporate.xing.com/de/unternehmen/

More information about data privacy at XING: https://privacy.xing.com/de/datenschutzerklaerung.

We do not collect or process any personal data via our XING company page.

14. Google CDN

14.1. Nature and scope of processing

We use Google CDN to deliver our website content properly. Google CDN is a service provided by Google Ireland Limited, which acts as a content delivery network (CDN) for our website.

A CDN uses local and international servers to make the content of our website available more quickly, especially files such as graphics and scripts. When you browse this content, you connect to servers operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and your IP address and possibly some browser data such as your user agent are sent there. This data is processed exclusively for the aforementioned purposes and to ensure Google CDN remains operational and secure.

14.2. Purpose and legal basis

We use this content delivery network on the basis of our legitimate interests, i.e. our objective of improving our website and delivering it securely and efficiently pursuant to Art. 6 (1) f GDPR.

14.3. Retention period

We cannot change the length of time for which the processed data is stored; it is determined by Google Ireland Limited. You will find further information in the Google Analytics privacy policy: https://policies.google.com/privacy?hl=de&gl=de

15. Google Fonts

15.1. Nature and scope of processing

We use Google Fonts, which are delivered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as fonts for our website. To obtain these fonts, you connect to servers belonging to Google Ireland Limited, to which your IP address is sent.

15.2. Purpose and legal basis

Using Google Fonts is based on our legitimate interests, i.e. our objective of uniformly delivering and improving our website pursuant to Art. 6 (1) f GDPR.

15.3. Retention period

We cannot change the length of time for which the processed data is stored; it is determined by Google Ireland Limited. You will find further information in the Google Fonts privacy policy: https://policies.google.com/privacy?hl=de&gl=de

16. Google reCAPTCHA

16.1. Nature and scope of processing

We have incorporated Google reCAPTCHA components into our website. Google reCAPTCHA is a service supplied by Google Ireland Limited which enables us to determine whether a contact request is coming from a natural person or is automated by a program. When you browse this content, you connect to servers operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and your IP address and possibly some browser data such as your user agent are sent there. Google reCAPTCHA also records a user’s dwell time and mouse movements, so as to distinguish automated enquiries from human ones. This data is processed exclusively for the aforementioned purposes and to ensure Google reCAPTCHA remains operational and secure.

16.2. Purpose and legal basis

The service is used on the basis of our legitimate interests, i.e. protecting ourselves when receiving forms pursuant to Art. 6 (1) f GDPR.

14.3. Retention period

We cannot change the length of time for which the processed data is stored; it is determined by Google Ireland Limited. You will find further information in the Google reCAPTCHA privacy policy: https://policies.google.com/privacy?hl=de&gl=de

17. YouTube Video

17.1. Nature and scope of processing

We have incorporated YouTube video into our website. YouTube Video is a component of the video platform run by YouTube, LLC, which allows users to upload content, share it via the internet and obtain detailed statistics.

YouTube Video allows us to integrate this platform’s content into our website.

YouTube Video uses cookies and other browser technologies to analyse user behaviour, recognise returning users and create user profiles. This information is used to analyse the activity of content that is listened to and to generate reports. If a user is registered with YouTube, LLC, then YouTube Video can link their profile with any videos they play.

When you access this content, you connect to servers at YouTube, LLC, Google Ireland Limited, Gordon House, Barrow Street Dublin 4 Ireland, to which your IP address and possibly some browser data such as your user agent are sent.

17.2. Purpose and legal basis

The use of this service is based on your consent pursuant to Art. 6 (1) a GDPR.

17.3. Retention period

We cannot change the length of time for which the processed data is stored; it is determined by YouTube, LLC. You will find further information in the YouTube Video privacy policy: https://policies.google.com/privacy?hl=de&gl=de

18. YouTube Video NoCookie

18.1. Nature and scope of processing

We have integrated YouTube NoCookie into our website. YouTube NoCookie is a component of the video platform run by YouTube, LLC, which allows users to upload content, share it via the internet and obtain detailed statistics.

YouTube NoCookie allows us to integrate this platform’s content into our website.

YouTube NoCookie uses cookies and other browser technologies to analyse user behaviour, recognise returning users and create user profiles. This information is used to analyse the activity of content that is listened to and to generate reports. If a user is registered with YouTube, LLC, then YouTube NoCookie can link their profile with any videos they play.

When you access this content, you connect to servers at YouTube, LLC, Google Ireland Limited, Gordon House, Barrow Street Dublin 4 Ireland, to which your IP address and possibly some browser data such as your user agent are sent.

18.2. Purpose and legal basis

The use of this service is based on your consent pursuant to Art. 6 (1) a GDPR.

18.3. Retention period

We cannot change the length of time for which the processed data is stored; it is determined by YouTube, LLC. You will find further information in the YouTube NoCookie privacy policy: https://policies.google.com/privacy?hl=de&gl=de

19. Cookiebot

19.1. Nature and scope of processing

We have incorporated Cookiebot into our website. Cookiebot is a consent solution provided by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark, which is used to obtain and document consent to store cookies. Cookiebot uses cookies and other browser technologies to recognise returning users and document any consent that is given or revoked.

19.2. Purpose and legal basis

The use of this service is based on obtaining the consent legally required before using cookies, pursuant to Art. 6 (1) c GDPR.

19.3. Retention period

We cannot change the length of time for which the processed data is stored; it is determined by Cybot A/S. You will find further information in the Cookiebot privacy policy: https://www.cookiebot.com/de/privacy-policy/

20. Cookiebot CDN

20.1. Nature and scope of processing

We use Cookiebot CDN to deliver the content of our website properly. Cookiebot CDN is a service provided by Cybot A/S, which acts as a content delivery network (CDN) for our website in order to ensure that further services provided by Cybot A/S remain operational. You will find details of these services in a separate section of this privacy policy. This section is only about using the CDN.

A CDN uses local and international servers to make the content of our website available more quickly, especially files such as graphics and scripts. When you access this content, you connect to servers belonging to Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark, to which your IP address and possibly some browser data such as your user agent are sent. This data is processed exclusively for the aforementioned purposes and to ensure that Cookiebot CDN remains secure and operational.

20.2. Purpose and legal basis

We use this content delivery network on the basis of our legitimate interests, i.e. our objective of improving our website and delivering it securely and efficiently pursuant to Art. 6 (1) f GDPR.

20.3. Retention period

We cannot change the length of time for which the processed data is stored; it is determined by Cybot A/S. You will find further information in the Cookiebot CDN privacy policy: https://www.cookiebot.com/de/privacy-policy/