Privacy Policy

Privacy Policy

We are delighted that you have shown interest in our website. Data protection is of particularly high priority for us. Our website can generally be used without providing any personal data. However, if a data subject wishes to make use of special services offered through our website, it may become necessary to process personal data. If the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain the consent of the data subject.

The processing of personal data, such as the name, address, e-mail address, or telephone number of a data subject, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection provisions applicable to us. By means of this privacy policy, we would like to inform you and the public about the nature, scope, and purpose of the personal data we collect, use, and process. Furthermore, data subjects are informed of the rights to which they are entitled by means of this privacy policy.

As the controller responsible for processing, andagon people GmbH has implemented numerous technical and organizational measures (TOMs) to ensure the most complete protection possible of the personal data processed through this website. Nevertheless, internet-based data transmissions may in principle have security gaps, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us by alternative means, for example by telephone.

1. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the member states of the European Union, and other provisions of a data-protection-related nature is:

andagon people GmbH
Management: Stefan Gogoll, Yana Gogoll
Scheidtweilerstrasse 4
50933 Cologne
Germany
Tel.: +49 221 - 4744 101 - 10
E-mail: info@andagon.com
Website: www.andagon.com

2. Contact details of the Data Protection Officer

Any data subject may at any time contact our Data Protection Officer directly with any questions or suggestions concerning data protection. The Data Protection Officer of the controller is:

BullProtect, a brand of NetBull GmbH
https://bullprotect.de/
Patrick Vaillant

You can reach our Data Protection Officer by post at our address given above, adding "Data Protection Officer", or by e-mail at: datenschutz@andagon.com

3. Collection of general data and information

Our website collects a series of general data and information each time the website is accessed by a data subject or an automated system. This general data and information is stored in the server's log files.

The following may be collected:
(1) the browser types and versions used,
(2) the operating system used by the accessing system,
(3) the website from which an accessing system reaches our website (so-called referrers),
(4) the sub-pages accessed via an accessing system on our website,
(5) the date and time of access to the website,
(6) an internet protocol address (IP address),
(7) the internet service provider of the accessing system, and
(8) other similar data and information used to avert danger in the event of attacks on our information technology systems.

No conclusions about the data subject are drawn from the use of this general data and information. Rather, this information is needed to

(1) deliver and display the content of our website correctly,
(2) optimize the content of our website as well as the advertising for it,
(3) ensure the long-term functionality of our information technology systems and the technology of our website, and
(4) provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyberattack.

This anonymously collected data and information is therefore evaluated by the controller, on the one hand, statistically, and further, with the aim of increasing data protection and data security at our company, in order to ultimately ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files is stored separately from any personal data provided by a data subject.

4. Web hosting

This website is hosted by an external service provider (host). Hosting of this website is provided by the host IONOS SE, headquartered at Elgendorfer Straße 57, 56410 Montabaur, Germany.

Personal data collected on this website is stored on the host's servers. This may include, in particular, IP addresses, contact requests, meta and communication data, website visits, and other data generated via a website.

The host is used for the purpose of fulfilling contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the legitimate interest of a secure, fast, and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR). Where corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) of the German Telecommunications-Digital-Services-Data-Protection Act (TDDDG), insofar as the consent covers the storage of cookies or access to information on the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

We have concluded a data processing agreement with the provider in accordance with the requirements of Art. 28 GDPR, under which we oblige the provider to protect our customers' data and not to pass it on to third parties.

5. Legal basis for the processing

Art. 6(1)(a) GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, with processing operations necessary for the supply of goods or the provision of any other service or consideration, the processing is based on Art. 6(1)(b) GDPR. The same applies to processing operations necessary for the performance of pre-contractual measures, for example in cases of inquiries concerning our products or services. If our company is subject to a legal obligation requiring the processing of personal data, such as for the fulfillment of tax obligations, the processing is based on Art. 6(1)(c) GDPR. In rare cases, the processing of personal data may become necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor were injured on our premises and their name, age, health insurance data, or other vital information had to be passed on to a doctor, hospital, or other third party. In that case, the processing would be based on Art. 6(1)(d) GDPR. Finally, processing operations could be based on Art. 6(1)(f) GDPR. This legal basis is used for processing operations which are not covered by any of the above legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Such processing operations are permitted to us in particular because they have been specifically mentioned by the European legislator, which took the view that a legitimate interest could be assumed if the data subject is a customer of the controller (recital 47, sentence 2 GDPR). If the processing of personal data is based on Art. 6(1)(f) GDPR, our legitimate interest is the pursuit of our business activities for the benefit of the well-being of all our employees and shareholders.

6. Duration for which the personal data is stored

The criterion for the duration of storage of personal data is the respective statutory retention period. After expiry of that period, the corresponding data is routinely deleted, provided it is no longer required for the performance or initiation of a contract, and no further statutory or legal provisions preclude deletion.

7. Routine erasure and blocking of personal data

The controller processes and stores personal data of the data subject only for the period necessary to achieve the purpose of storage, or as provided for by the European legislature or other legislators in laws or regulations to which the controller is subject. If the storage purpose ceases to apply, or if a storage period prescribed by the European legislature or another competent legislator expires, the personal data is routinely blocked or deleted in accordance with statutory provisions.

8. Statutory or contractual provisions for the provision of personal data

We inform you that the provision of personal data is partly required by law (e.g. tax regulations) or may result from contractual or pre-contractual arrangements (e.g. details of the contractual partner). Sometimes it may be necessary for a data subject to conclude a contract to provide us with personal data that must subsequently be processed by us. For example, the data subject is obliged to provide us with personal data when our company concludes a contract with them. Failure to provide the personal data would mean that the contract with the data subject could not be concluded. Before personal data is provided by the data subject, the data subject must contact one of our employees. Our employee will inform the data subject, on a case-by-case basis, whether the provision of the personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data, and the consequences of failure to provide such data.

9. Registration on our website / use of input forms

The data subject has the option of registering on the website of the controller by providing personal data, or of entering personal information into input forms. This may be necessary, for example, for a newsletter subscription, contact via the contact form, registration for participation in events, or other similarly structured registration options. Which personal data is transmitted to the controller in this regard is determined by the respective input form used for registration. The personal data entered by the data subject is collected and stored exclusively for the purposes stated, for internal use by the controller, and for the controller's own purposes. The controller may arrange for the data to be passed on to one or more processors, for example a hosting provider, SaaS provider, or parcel service provider, who likewise processes the personal data exclusively for the purposes stated (including in this privacy policy).

If you contact us (e.g. via the contact form), personal data is collected. This data is stored and used exclusively for the purpose of responding to your inquiry and the related technical administration. The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at the conclusion of a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data is deleted after your inquiry has been finally dealt with, which is the case when the matter concerned has been conclusively clarified and provided no statutory or legal retention obligations preclude deletion.

By registering on the controller's website, the IP address assigned by the data subject's internet service provider (ISP), as well as the date and time of registration, are also stored. This data is stored because it is the only way to prevent misuse of our services, and, if necessary, to enable offenses committed to be investigated. Storage of this data is therefore necessary to safeguard the controller. This data is generally not passed on to third parties unless there is a statutory or legal obligation to do so or the disclosure serves the purpose of criminal prosecution.

Voluntary registration by the data subject, with provision of personal data, serves the purpose of enabling the controller to offer the data subject content or services that, by their nature, can only be offered to registered users or to those who explicitly request them. Such persons are free to change the personal data provided at any time, or to have it deleted entirely from the controller's data stock.

Upon request, the controller shall provide any data subject with information at any time as to which personal data concerning them is stored. Furthermore, the controller shall correct or delete personal data at the request or upon notice of the data subject, provided this does not conflict with any statutory or legal retention obligations. All employees of the controller are available to the data subject as points of contact in this regard.

We also process such personal data as our customers/clients make available to us in the course of using the service — for example by uploading or electronically transmitting it — and which is required for the provision of our service or other purposes named in this privacy policy.

10. Data protection in connection with events, and with registration for and participation in a webinar

In connection with the registration, preparation, conduct, and follow-up of our events (e.g. IT training courses, courses, and seminars), we process personal data of participants as well as of interested parties. This includes, in particular, contact and communication data (e.g. name, e-mail address, telephone number, company and, where applicable, position information), information on event participation, as well as information required for organizational purposes. In connection with webinar participation, further data may be processed that arises or may be transmitted due to the techniques used or the online webinar tool; this may include, for example, log files, the IP address, active participation in chats and polls, and metadata. When registering for the respective webinar, we also store the IP address assigned by the internet service provider (ISP), as well as the date and time of registration, in order to be able to trace any misuse of your e-mail address at a later date. We record webinars, anonymize them by blurring names and chats, and subsequently make them available on various platforms and media.

By registering for the webinar, you accept the terms of participation provided ("Terms of Use"), so that registration and participation in the webinar are based on pre-contractual or contractual grounds pursuant to Art. 6(1)(b) GDPR. Contacting you regarding identical or similar webinars and presented products and solutions is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in optimizing, presenting, and utilizing our offerings, or for documentation purposes. If you have consented to individual processing operations, your personal data is processed pursuant to Art. 6(1)(a) GDPR.

In the course of registering for events, it may be necessary to agree to certain event terms and conditions. This may also include the possibility that the data collected during registration may be used as "data in exchange for services" in order to inform participants and interested parties, following the event, about similar offers, follow-up events, or related content. We would inform you clearly about this.

Advertising contact is carried out exclusively within the framework of applicable statutory requirements. Regardless of this, participants have the right at any time to object to the processing of their personal data for direct marketing purposes. The objection may be made informally at any time via the contact channels indicated in this privacy policy and will result in no further advertising contact being made.

11. Data protection in connection with newsletters

After you register for our e-mail newsletter, we regularly send you information about us, our offers, or information requested as part of the registration. The only mandatory information for sending the newsletter is your e-mail address. The provision of any further data is voluntary and is used, for example, to be able to address you personally. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an e-mail newsletter once you have expressly confirmed that you consent to the sending of newsletters. We will then send you a confirmation e-mail asking you to confirm, by clicking on a corresponding link, that you wish to receive newsletters in future. In addition, you may withdraw your consent to receiving the newsletter at any time by e-mail to our company's e-mail address given above, or you may declare the withdrawal by postal message to the contact details given above or in the legal notice (Impressum).

By clicking the confirmation link, you grant us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. When registering for the newsletter, we store the IP address assigned by the internet service provider (ISP), as well as the date and time of registration, in order to be able to trace any misuse of your e-mail address at a later date. The data collected by us when registering for the newsletter is used exclusively for advertising purposes by means of the newsletter. You may unsubscribe from the newsletter at any time via the link provided for that purpose in the newsletter. Following unsubscription, your e-mail address will be deleted from our newsletter distribution list without delay, unless you have expressly consented to further use of your data or we reserve the right to further use of the data that is legally permitted and about which we inform you in this policy.

Based on the data thus obtained, we create a user profile pursuant to Art. 6(1)(f) GDPR, on the basis of our legitimate interest in optimizing our external presentation and our advertising measures, in order to tailor the newsletter to your individual interests. In doing so, we record when you read our newsletter and which links you click on, and draw conclusions about your personal interests from this. We link this data to actions you have taken on our website. You may object to this tracking at any time by clicking the separate link provided in each e-mail or by informing us via another contact channel, as described above. The information is stored for as long as you are subscribed to the newsletter. After unsubscribing, we store the data on a purely statistical and anonymous basis.

Such tracking is also not possible if you do not click on any links in your e-mail program or if the display of images is deactivated by default. In this case, the newsletter will not be displayed in full and you may not be able to use all functions. If you enable the display of images manually, the tracking described above will take place.

12. Advertising communication via e-mail, post, fax, or telephone

We process personal data for the purposes of advertising communication, which may be carried out via various channels such as e-mail, telephone, post, or fax, in accordance with statutory requirements. In doing so, we rely on the legal bases of consent (Art. 6(1)(a) GDPR) as well as legitimate interest (Art. 6(1)(f) GDPR).

Recipients have the right to withdraw any consent given, or to object to advertising communication, at any time. Following withdrawal or objection, we may store the data required to demonstrate consent for up to three years on the basis of our legitimate interests before deleting it. From that point, processing of this data is limited to the purpose of possible defense against claims. An individual request for erasure is possible at any time, provided that the former existence of consent is confirmed at the same time.

13. Social networks and online platforms

We are represented on various social networks and online platforms in order to be able to present our offering and related information to a wide range of interested parties.

The networks and online platforms we use are globally operating social media, so it cannot be guaranteed that your personal data is processed solely within the EU. To protect your data, transmission to third countries takes place only in accordance with Art. 44 et seq. GDPR.

We would like to point out that the operators of the respective platforms process personal data about you and may combine it into user profiles. This may occur regardless of whether you are registered with the respective platform or not. If you have a user account with the relevant social network, the data we provide is evaluated and assigned to you personally. This is done for the purpose of target-group-oriented marketing. Further information in this regard can be found in the privacy policy of the respective social medium as well as in the information below. If you wish to exercise your rights as a data subject, please contact the respective operator of the online platform. As a general rule, we have no access to the personal data processed about you by the operators. Exceptions to this are data such as name, user ID, profile picture, age (group), gender, language, country, friends or followers list, and your follower list. This data is provided only to the extent to which you have given your consent or to the extent permitted by the settings you have made on the social network. The purpose of processing the personal data made available is to share your opinion on the linked social media and to optimize our presence and reach on the online platforms. Processing is carried out primarily on the basis of our legitimate interest in possible media coverage of our products and public relations.

In this context, the following categories of data may be processed (depending on settings and online platform): master data (e.g. name, user ID), contact data (e.g. e-mail address, telephone number), metadata (e.g. cookie data, device ID, network, connection), content data (e.g. comments), and usage data (e.g. usage activity, usage time), whereby, in principle, all users of the online platform or social network, or the owner of the device on which the service is run, may be affected by these processing operations.

In this regard, we rely on the following legal bases for processing: Art. 6(1)(f) GDPR (our legitimate interest or that of third parties, e.g. the provider of the online platform) as well as Art. 6(1)(a) GDPR (provided you have a user account with a social network and have consented to the transmission of data to third parties).

14. Recipients or categories of recipients

Depending on the purpose for which the personal data is collected, we transmit this data to, for example, the following recipients or categories of recipients, or these are directly involved in the processing of the personal data:

• Providers (see the "Web hosting" section)
• IT service providers and other recipients, depending on the tools used (please also refer to the last section of this policy, "Use and application of further applications, plugins, and tools", in which the possible recipients in this regard are described in detail).

Insofar as links are provided to websites of other providers, this privacy policy does not apply to their content. We have no knowledge of, and no influence over, what data the operators of such sites may collect.

15. Transfer to third countries

Should we transfer personal data to service providers outside the European Economic Area (EEA), such transfer takes place only insofar as the European Commission has confirmed an adequate level of data protection for the third country in question, or other appropriate data protection safeguards exist (e.g. binding corporate rules or EU standard contractual clauses). In this regard, please also refer, in addition to the further information provided in this policy, in particular to the last section of this policy, in which the tool-related possible recipients, together with their locations, are described in detail.

16. Automated decision-making / profiling

As a responsible company, we refrain from automated decision-making or profiling.

17. Data protection in job applications and the application process

If you send us an application, we process the personal data associated with it (e.g. contact and communication data, application documents, notes taken during interviews, etc.), insofar as this is necessary for the decision on establishing an employment relationship. The legal basis for this is Section 26 of the German Federal Data Protection Act (BDSG) under German law (initiation of an employment relationship), Art. 6(1)(b) GDPR (general pre-contractual measures), and — if you have given consent — Art. 6(1)(a) GDPR. Consent may be withdrawn at any time. Within our company, your personal data is passed on exclusively to persons involved in processing your application.

If the application is successful, the data you have submitted will be stored in our data processing systems on the basis of Section 26 BDSG and Art. 6(1)(b) GDPR for the purpose of carrying out the employment relationship.

If we are unable to offer you a position, if you decline a job offer, or if you withdraw your application, we reserve the right to retain the data you have submitted on the basis of our legitimate interests (Art. 6(1)(f) GDPR) for up to 7 months from the end of the application process (rejection or withdrawal of the application). The data will then be deleted and the physical application documents destroyed. Retention serves, in particular, evidentiary purposes in the event of legal disputes. If it is apparent that the data will be required after expiry of the 7-month period (e.g. due to a threatened or pending legal dispute), deletion will only take place once the purpose for further retention no longer applies.

Longer retention may also take place if you have given corresponding consent (Art. 6(1)(a) GDPR) or if statutory retention obligations preclude deletion.

Inclusion in the applicant pool
If we are unable to offer you a position, we may include you in our applicant pool. In the event of inclusion, all documents and information from the application are transferred to the applicant pool in order to contact you should suitable vacancies arise.

Inclusion in the applicant pool takes place exclusively on the basis of your express consent (Art. 6(1)(a) GDPR). Giving consent is voluntary and is not related to the ongoing application process. The data subject may withdraw their consent at any time. In this case, the data will be irrevocably deleted from the applicant pool, unless there are statutory grounds for retention.

Data from the applicant pool will be irrevocably deleted no later than two years after consent was given.

18. Data protection in the context of contact and address management / CRM

The controller collects and processes the personal data of customers and other contacts for the purpose of carrying out initiations of business relationships, contact management, contract performance, and other similarly structured matters. For this purpose, we use Odoo. The provider is Odoo Deutschland, Mühlenstraße 15, 10243 Berlin. Among other things, this CRM system enables us to manage existing and potential contacts and to organize sales and communication processes. The use of the CRM system may also enable us to analyze our customer-related processes.

This CRM system is used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the most efficient possible contact management and contact communication. Where corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR as well as Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time. Further details can be found in the provider's privacy policy at: https://www.odoo.com/de_DE/privacy. Where necessary, we have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a data-protection agreement that ensures that this provider processes personal data only in accordance with our instructions and in compliance with the GDPR.

19. Definitions

This privacy policy is based on the terms used by the European legislature in adopting the General Data Protection Regulation (GDPR). Our privacy policy is intended to be easy to read and understand for the public as well as for our customers and business partners. To ensure this, we would like to explain the terminology used in advance.

In this privacy policy, we use, among others, the following terms:

a) Personal data
"Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

b) Data subject
"Data subject" means any identified or identifiable natural person whose personal data is processed by the controller.

c) Processing
"Processing" means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

d) Restriction of processing
"Restriction of processing" means the marking of stored personal data with the aim of limiting its processing in the future.

e) Profiling
"Profiling" means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

f) Pseudonymization
"Pseudonymization" means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures ensuring that the personal data is not attributed to an identified or identifiable natural person.

g) Filing system
"Filing system" means any structured set of personal data which is accessible according to specific criteria, whether centralized, decentralized, or dispersed on a functional or geographical basis.

h) Controller
"Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller, or the specific criteria for its nomination, may be provided for by Union or Member State law.

i) Processor
"Processor" means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.

j) Recipient
"Recipient" means a natural or legal person, public authority, agency, or another body to which the personal data is disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

k) Third party
"Third party" means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

l) Consent
"Consent" of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

m) Undertaking
"Undertaking" means a natural or legal person engaged in economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in economic activity.

20. Rights of the data subject

a) Right of confirmation
Every data subject has the right, granted by the European legislature, to obtain confirmation from the controller as to whether personal data concerning them is being processed. If a data subject wishes to exercise this right of confirmation, they may contact an employee of the controller at any time.

b) Right of access
Every person affected by the processing of personal data has the right, granted by the European legislature, to obtain from the controller, at any time and free of charge, information about the personal data stored about them, as well as a copy of that information. Furthermore, the European legislature has granted the data subject access to the following information:

• the purposes of the processing
• the categories of personal data concerned
• the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organizations
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
• the existence of the right to request from the controller rectification or erasure of personal data, or restriction of processing, or to object to such processing
• the existence of the right to lodge a complaint with a supervisory authority
• where the personal data is not collected from the data subject: any available information as to its source
• the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and — at least in those cases — meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject
• furthermore, the data subject has the right to be informed of whether personal data has been transferred to a third country or to an international organization. Where this is the case, the data subject also has the right to be informed of the appropriate safeguards relating to the transfer
• if a data subject wishes to exercise this right of access, they may contact an employee of the controller at any time

c) Right to rectification
Every person affected by the processing of personal data has the right, granted by the European legislature, to demand the immediate rectification of inaccurate personal data concerning them. Furthermore, the data subject has the right to request the completion of incomplete personal data — including by means of providing a supplementary statement — taking into account the purposes of the processing. If a data subject wishes to exercise this right to rectification, they may contact an employee of the controller at any time.

d) Right to erasure (right to be forgotten)
Every person affected by the processing of personal data has the right, granted by the European legislature, to obtain from the controller the erasure of personal data concerning them without undue delay, where one of the following grounds applies and insofar as processing is not necessary:

• The personal data was collected or otherwise processed for purposes for which it is no longer necessary.
• The data subject withdraws consent on which the processing was based pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing.
• The data subject objects to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21(2) GDPR.
• The personal data was processed unlawfully.
• Erasure of the personal data is required to comply with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data was collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.

If one of the above grounds applies and a data subject wishes to arrange for the erasure of personal data stored by us, they may contact an employee of the controller at any time. Our employee will ensure that the erasure request is complied with without delay.

Where we have made the personal data public and are obliged, as controller, to erase the personal data pursuant to Art. 17(1) GDPR, we shall take reasonable steps, taking into account available technology and the cost of implementation, including technical measures, to inform other controllers processing the published personal data that the data subject has requested erasure by such other controllers of any links to, or copies or replications of, that personal data, insofar as processing is not required. Our employee will arrange the necessary steps on a case-by-case basis.

e) Right to restriction of processing
Every person affected by the processing of personal data has the right, granted by the European legislature, to obtain from the controller the restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the data.
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead.
• The controller no longer needs the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise, or defense of legal claims.
• The data subject has objected to processing pursuant to Art. 21(1) GDPR pending verification as to whether the legitimate grounds of the controller override those of the data subject.

If one of the above conditions is met and a data subject wishes to request restriction of the processing of personal data stored by us, they may contact an employee of the controller at any time. The employee will arrange for the restriction of processing.

f) Right to data portability
Every person affected by the processing of personal data has the right, granted by the European legislature, to receive the personal data concerning them, which was provided to a controller by the data subject, in a structured, commonly used, and machine-readable format. They also have the right to transmit that data to another controller without hindrance from the controller to which the personal data was provided, provided that the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, or on a contract pursuant to Art. 6(1)(b) GDPR, and that the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, in exercising their right to data portability pursuant to Art. 20(1) GDPR, the data subject has the right to have personal data transmitted directly from one controller to another, where technically feasible and where this does not adversely affect the rights and freedoms of others. To assert the right to data portability, the data subject may contact one of our employees at any time using the contact details given above.

g) Right to object
Every person affected by the processing of personal data has the right, granted by the European legislature, to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them which is based on Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions.

In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise, or defense of legal claims.

Where we process personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data for such marketing. This also applies to profiling to the extent it is related to such direct marketing. If the data subject objects to us regarding processing for direct marketing purposes, we will no longer process the personal data for these purposes.

In addition, the data subject has the right, on grounds relating to their particular situation, to object to the processing of personal data concerning them carried out by us for scientific or historical research purposes, or for statistical purposes pursuant to Art. 89(1) GDPR, unless such processing is necessary for the performance of a task carried out for reasons of public interest.

To exercise the right to object, the data subject may contact one of our employees directly. In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject is also free to exercise their right to object by automated means using technical specifications.

h) Automated individual decision-making, including profiling
Every person affected by the processing of personal data has the right, granted by the European legislature, not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning them, or similarly significantly affects them, unless the decision is

(1) necessary for entering into, or the performance of, a contract between the data subject and the controller, or

(2) authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or

(3) based on the data subject's explicit consent.

If the decision

(1) is necessary for entering into, or the performance of, a contract between the data subject and the controller, or

(2) is based on the data subject's explicit consent,

we shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least including the right to obtain human intervention on the part of the controller, to express their own point of view, and to contest the decision.

If the data subject wishes to exercise rights relating to automated decisions, they may contact an employee of the controller at any time.

i) Right to withdraw consent under data protection law
Every person affected by the processing of personal data has the right, granted by the European legislature, to withdraw consent to the processing of personal data at any time.

If the data subject wishes to exercise their right to withdraw consent, they may contact an employee of the controller at any time.

j) Right to lodge a complaint with the data protection supervisory authority
If, in your opinion, the processing of your personal data infringes the GDPR, you have the option, pursuant to Art. 77 GDPR, to lodge a complaint with the Data Protection Officer named above or with a data protection supervisory authority.

The supervisory authority responsible for us is:
Die Landesbeauftragte für den Datenschutz Nordrhein-Westfalen (Data Protection Authority of the State of North Rhine-Westphalia)
Kavalleriestraße 2-4
40213 Düsseldorf

Our Data Protection Officer is also happy to assist you, using the contact details given under item 2 above!

21. Cookies

Our website, apps, or other services may use cookies. Cookies are text files that are stored and saved via an internet browser on an information technology system (e.g. computer, notebook, smartphone, tablet).

Numerous websites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier of the cookie, consisting of a string of characters through which websites and servers can be assigned to the specific internet browser in which the cookie was stored. This enables the websites and servers visited, or the apps or other services used, to distinguish the individual browser of the data subject from other internet browsers containing other cookies. A particular internet browser can be recognized and identified using the unique cookie ID.

Through the use of cookies, we can provide users of our services with more user-friendly services that would not be possible without the setting of cookies.

A cookie enables the information and offers on our services to be optimized with the user in mind. As mentioned, cookies allow us to recognize the users of our website, apps, or other services. The purpose of this recognition is to make it easier for users to use our services. For example, a user of a service that uses cookies does not have to review the cookie banner and make a selection each time they visit, or re-enter their access data each time they visit the website, because this is taken over by the website and the cookie stored on the user's computer system. Another example is the cookie of a shopping cart in an online shop. This allows the online shop to remember, via a cookie, the items that a customer has placed in the virtual shopping cart.

The data subject may prevent the setting of cookies by our services at any time by means of a corresponding setting of the internet browser used, and may thus permanently object to the setting of cookies. Furthermore, cookies already set may be deleted at any time via an internet browser or other software programs. This is possible in all common internet browsers. If the data subject deactivates the setting of cookies in the internet browser used, not all functions of our services may be fully usable.

22. Consent management tool

In order to obtain the aforementioned cookie consent and your consent for any third-party connections (see the following section), we use a cookie consent tool, also known as a "cookie banner" or, more accurately, a "consent banner".

23. Use and application of further applications, plugins, and tools

As you know from our offering as a whole: we want to provide you with the best possible service. For this reason, we have integrated various applications, plugins, and tools (hereinafter: "tools") into our website. Depending on their function, these may, for example, optimize the loading times of our website, simplify its use, help us to improve our offering, or increase security.

Using the button below, you can adjust the consent settings controlled via the consent tool:

Consent Tool

We provide the specific information on the tools used in the following sections.

Amazon CloudFront

Privacy provisions on the use and application of Amazon CloudFront
We have integrated the content delivery network (CDN) Amazon CloudFront into our website. The operating company of Amazon CloudFront is Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA. Amazon CloudFront is a globally distributed content delivery network used to deliver content such as websites, images, videos, or other files to end users more quickly and reliably. In this process, copies of the content are cached on various servers (so-called edge locations) and delivered from the geographically nearest server. The use of Amazon CloudFront may give rise to technical connection data and personal data such as IP addresses, date and time of access, requested content, information on the browser used, operating system, and referrer URLs. This data is technically necessary to deliver content correctly, ensure the security and stability of the website, and detect and defend against misuse, such as DDoS attacks. Amazon CloudFront may also generate log data, which is used for error analysis, performance optimization, and ensuring trouble-free operation. To our knowledge, this data is not further combined with other data sources without a corresponding legal basis. We process personal data only for as long as necessary. Once the purpose of the data processing has been fulfilled, blocking and erasure take place in accordance with the standards of our erasure concept, unless statutory provisions preclude erasure. Should a cookie be set on your device in this context, it will be automatically deleted after expiry of the retention period, unless you have already deleted it yourself before that time.

Purposes of processing
The third-party product Amazon CloudFront is suitable for us to provide our website in a performant, stable, and secure manner. The worldwide distribution of content can reduce loading times, increase availability, and better absorb traffic peaks. In addition, its use serves to protect our systems against technical attacks and to optimize our online service.

Legal basis
We require your consent to use the tool, which constitutes the legal basis under Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent). We obtain this consent through our consent tool described above and also document it through that tool. We also have a legitimate interest in optimizing our online service and therefore rely in this regard on Art. 6(1)(f) GDPR (legitimate interest). Further information on the handling of personal data can be found in the privacy policy of Amazon Web Services: https://aws.amazon.com/de/privacy/.

Right to object
You always have the option to manage the setting, administration, and deletion of cookies in your browser as you wish. For example, if you do not want this tool to set cookies and collect information about you and, where applicable, your behavior, you can deactivate the general setting of cookies at any time in your browser settings. In individual cases, however, this may mean that certain functions (such as shopping carts) on the websites visited may no longer work, even if this is not what you intended.

Contentful

Privacy provisions on the use and application of Contentful
We have integrated the content management system Contentful into our website. The operating company of Contentful is Contentful GmbH, Max-Urich-Straße 3, 13355 Berlin, Germany. Contentful is a cloud-based headless content management platform (CMS) used to create, manage, and deliver digital content via application programming interfaces (APIs) to websites, apps, or other digital applications. The platform enables flexible management and delivery of content without it being tied directly to a particular frontend. In the course of its use, personal data may be processed. This includes, in particular, the IP address, technical information on the browser and operating system used, date and time of access, device information, log and diagnostic data, as well as other technical connection data required to provide, secure, and optimize the services. If content is delivered via the platform or administrative functions are used, usage data may also be processed to ensure the functionality of the platform, analyze errors, and ensure system security. Depending on the specific implementation, cookies or comparable technologies may also be used, insofar as technically necessary or covered by your consent. We process personal data only for as long as necessary. Once the purpose of the data processing has been fulfilled, blocking and erasure take place in accordance with the standards of our erasure concept, unless statutory provisions preclude erasure. Should a cookie be set on your device in this context, it will be automatically deleted after expiry of the retention period, unless you have already deleted it yourself before that time.

Purposes of processing
The third-party product Contentful is suitable for us to manage the content of our website centrally, maintain it efficiently, and provide it flexibly across various digital channels. In addition, Contentful helps us to provide a modern, performant, and scalable web presence, organize content in a structured manner, and implement changes quickly. This contributes to continuously improving our online service and ensuring reliable delivery of content.

Legal basis
We require your consent to use the tool, which constitutes the legal basis under Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent). We obtain this consent through our consent tool described above and also document it through that tool. However, this service may also be used on the basis of an existing contract, in which case the legal basis is Art. 6(1)(b) GDPR (contract). We also have a legitimate interest in optimizing our online service and therefore rely in this regard on Art. 6(1)(f) GDPR (legitimate interest). Further information on the handling of personal data can be found in Contentful's privacy policy: https://www.contentful.com/legal/privacy/.

Right to object
You always have the option to manage the setting, administration, and deletion of cookies in your browser as you wish. For example, if you do not want this tool to set cookies and collect information about you and, where applicable, your behavior, you can deactivate the general setting of cookies at any time in your browser settings. In individual cases, however, this may mean that certain functions (such as shopping carts) on the websites visited may no longer work, even if this is not what you intended.

Google Tag Manager

Privacy provisions on the use and application of Google Tag Manager
We have integrated the code organization tool Google Tag Manager, provided by Google Inc. The operating company of Google Tag Manager is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. For the European region, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is responsible for all Google services.

"Tags" refers to short sections of code. These can, for example, record (track) your activities on our website. By integrating Google Tag Manager, we can centrally implement and manage tags from various tracking tools used on our website. These need not be tags from Google itself but may also be tags from other companies that can be integrated via Tag Manager. This significantly broadens the range of usage possibilities, meaning that, for example, cookies may be set, user and browser data collected, or buttons integrated. However, Tag Manager itself does not set any cookies or collect any data, as it acts purely as a manager of the implemented tags.

Google reserves the right to collect anonymized data on our use of Tag Manager, whereby no data managed via the tool's regular functions is transmitted in this process. We process personal data only for as long as necessary. Once the purpose of the data processing has been fulfilled, blocking and erasure take place in accordance with the standards of our erasure concept, unless statutory provisions preclude erasure. Should a cookie be set on your device in this context, it will be automatically deleted after expiry of the retention period, unless you have already deleted it yourself before that time.

Purposes of processing
The purpose of Google Tag Manager is to optimize our offering technically and economically and to avert any potential harm to our company. For this, we need to implement and manage various source code in the core of our website, which can be very time-consuming and error-prone. Google Tag Manager supports us in this, as it greatly simplifies and centralizes this process and largely avoids errors.

Legal basis
We require your consent to use the tool, which constitutes the legal basis under Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent). We obtain this consent through our consent tool described above and also document it through that tool. However, this service may also be used on the basis of an existing contract, in which case the legal basis is Art. 6(1)(b) GDPR (contract).

We also have a legitimate interest in optimizing our offering technically and economically and in averting any potential harm to our company, and rely in this regard on Art. 6(1)(f) GDPR (legitimate interest). With the help of the tool, we may also identify website errors, detect attacks, and improve efficiency. Further information on the handling of user data can be found in Google's privacy policy: https://policies.google.com/privacy?hl=en. Google's terms of use can be viewed at https://policies.google.com/terms?hl=en&gl=en.

Right to object
You always have the option to manage the setting, administration, and deletion of cookies in your browser as you wish. For example, if you do not want this tool to set cookies and collect information about you and, where applicable, your behavior, you can deactivate the general setting of cookies at any time in your browser settings. In individual cases, however, this may mean that certain functions (such as shopping carts) on the websites visited may no longer work, even if this is not what you intended.

Onlyfy

Privacy provisions on the use and application of Onlyfy
We have integrated the third-party provider Onlyfy into our website. The operating company of Onlyfy is NEW WORK SE, Dammtorstraße 30, 20354 Hamburg, Germany. Onlyfy is an online recruiting tool that enables us to create and publish job vacancies and manage applications. In this process, Onlyfy processes personal data such as names, contact details, professional qualifications, CVs, and IP addresses. This data is used to support the application process and facilitate communication with applicants. We process personal data only for as long as necessary. Once the purpose of the data processing has been fulfilled, blocking and erasure take place in accordance with the standards of our erasure concept, unless statutory provisions preclude erasure. Should a cookie be set on your device in this context, it will be automatically deleted after expiry of the retention period, unless you have already deleted it yourself before that time.

Purposes of processing
Onlyfy is suitable for us to optimize the application process, fill open positions efficiently, and offer a user-friendly platform for managing applications. This allows us to identify the best candidates and speed up the entire recruiting process.

Legal basis
We require your consent to use the tool, which constitutes the legal basis under Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent). We obtain this consent through our consent tool described above and also document it through that tool. However, this service may also be used on the basis of an existing contract, in which case the legal basis is Art. 6(1)(b) GDPR (contract). We also have a legitimate interest in optimizing our online service and therefore rely in this regard on Art. 6(1)(f) GDPR (legitimate interest). Further information on the handling of personal data can be found in Onlyfy's privacy policy: https://onlyfy.com/de/datenschutz/.

Right to object
You always have the option to manage the setting, administration, and deletion of cookies in your browser as you wish. For example, if you do not want this tool to set cookies and collect information about you and, where applicable, your behavior, you can deactivate the general setting of cookies at any time in your browser settings. In individual cases, however, this may mean that certain functions (such as shopping carts) on the websites visited may no longer work, even if this is not what you intended.

jsDelivr

Privacy provisions on the use and application of jsDelivr
We have integrated the content delivery network (CDN) jsDelivr, operated by the Polish company ProspectOne, Królewska 65A/1, 30-081, Kraków, Poland, into our website. jsDelivr is an open-source service that helps reduce website loading times. This allows websites to be loaded quickly and as effectively as possible even under high load peaks. In order for jsDelivr to be provided, personal data may be sent from your browser to the service. This gives the provider the ability to collect and store user data such as your IP address, browser version, browser type, or the date of your page visit. However, jsDelivr states in its privacy policy that the company does not use cookies or other tracking services. We process personal data only for as long as necessary. Once the purpose of the data processing has been fulfilled, blocking and erasure take place in accordance with the standards of our erasure concept, unless statutory provisions preclude erasure. Should a cookie be set on your device in this context, it will be automatically deleted after expiry of the retention period, unless you have already deleted it yourself before that time.

Purposes of processing
jsDelivr is suitable for us to provide a well-functioning experience on our website. Our website can be loaded significantly faster with the help of jsDelivr and is particularly helpful for visitors to our website from abroad, since the CDN can also deliver our website from servers located nearby.

Legal basis
We require your consent to use the tool, which constitutes the legal basis under Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent). We obtain this consent through our consent tool described above and also document it through that tool. However, this service may also be used on the basis of an existing contract, in which case the legal basis is Art. 6(1)(b) GDPR (contract). We also have a legitimate interest in optimizing and making our online service more secure and therefore rely in this regard on Art. 6(1)(f) GDPR (legitimate interest). Further information on the handling of user data can be found in jsDelivr's privacy policy: https://www.jsdelivr.com/terms/privacy-policy-jsdelivrnet.

Right to object
You always have the option to manage the setting, administration, and deletion of cookies in your browser as you wish. For example, if you do not want this tool to set cookies and collect information about you and, where applicable, your behavior, you can deactivate the general setting of cookies at any time in your browser settings. In individual cases, however, this may mean that certain functions (such as shopping carts) on the websites visited may no longer work, even if this is not what you intended.

Writesonic

Privacy provisions on the use and application of Writesonic
We have integrated the AI-powered content and marketing tool Writesonic into our website. The operating company of Writesonic is Writesonic, Inc., 2261 Market Street #4608, San Francisco, CA 94114, USA. Writesonic is an AI-based platform for creating, optimizing, and analyzing texts and other digital content. Among other things, the platform supports the creation of marketing texts, blog posts, product descriptions, social media content, and search engine optimization. In addition, AI functions may be used to process inputs (prompts), generate outputs, and analyze and optimize content. In the course of its use, personal data may be processed. This includes, in particular, the IP address, device and browser information, operating system, usage and log data, access times, referrer information, account data such as name and e-mail address, company information, payment and billing data, as well as all content submitted to the service by users in the form of inputs (prompts), documents, or other data. In addition, Writesonic processes the content generated through use (outputs), settings, configurations, as well as technical error and diagnostic data, insofar as this is necessary for providing, securing, improving, and further developing the service. Depending on the function used, data may also be forwarded to further sub-processors or AI model providers, insofar as this is technically necessary to provide the desired function. Processing is carried out in particular to provide the AI functions, for error analysis, system security, misuse detection, authentication, and to improve the services offered. We process personal data only for as long as necessary. Once the purpose of the data processing has been fulfilled, blocking and erasure take place in accordance with the standards of our erasure concept, unless statutory provisions preclude erasure. Should a cookie be set on your device in this context, it will be automatically deleted after expiry of the retention period, unless you have already deleted it yourself before that time.

Purposes of processing
The third-party product Writesonic is suitable for us to create AI-supported content efficiently, optimize existing texts, and support editorial and marketing-related processes. In addition, the tool enables us to tailor content to target groups, automate workflows, and continuously improve the quality of our digital communication. Writesonic further helps us to make our online service more efficient and increase productivity in creating and managing content.

Legal basis
We require your consent to use the tool, which constitutes the legal basis under Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent). We obtain this consent through our consent tool described above and also document it through that tool. We also have a legitimate interest in optimizing our online service and therefore rely in this regard on Art. 6(1)(f) GDPR (legitimate interest). Further information on the handling of personal data can be found in Writesonic's privacy policy: https://writesonic.com/legal/privacy-policy.

Right to object
You always have the option to manage the setting, administration, and deletion of cookies in your browser as you wish. For example, if you do not want this tool to set cookies and collect information about you and, where applicable, your behavior, you can deactivate the general setting of cookies at any time in your browser settings. In individual cases, however, this may mean that certain functions (such as shopping carts) on the websites visited may no longer work, even if this is not what you intended.

Last updated: 30 July 2026