Data Protection Statement
We are glad you are interested in learning more about our company. Data protection is a key priority for the senior management of IWP Hohental Plan- und Generalbau GmbH. Using the websites of IWP Hohental Plan- und Generalbau GmbH is principally possible without any personal data disclosure. However, if a data subject seeks to contract our company’s services via our websites, processing personal data may be required. Whenever it becomes necessary to process personal data and there is no legal basis for such processing, we generally seek the data subject’s consent before proceeding.
The processing of personal data, including e.g. the name, address, e-mail address or phone number of a data subject, is always done in accordance with the General Data Protection Regulation (GDPR) and according to the state-level data protection regulations that apply to IWP Hohental Plan- und Generalbau GmbH.
Our company has published this Data Protection Statement to brief the general public about the type, scope and purpose of the personal data that we collect and process. The Data Protection Statement is also meant to brief data subjects on their rights in this context.
IWP Hohental Plan- und Generalbau GmbH in its function as controller has implemented a number of technical and organisational safeguards to ensure the greatest possible end-to-end protection for the personal data processed via this website. However, data transmissions via the Internet are principally subject to security gaps, making it impossible to guarantee absolute protection. For this reason, data subjects are at liberty to communicate their personal data in alternative ways to us, e.g. by phone.
1. Definitions
The Data Protection Statement of IWP Hohental Plan- und Generalbau GmbH is based on terminology that is used by the European legislator when enacting the General Data Protection Regulation (GDPR).
Our Data Protection Statement is supposed to be easy to read and understand both for the general public and for our clients and business partners. In order to ensure this, we would like to start by explaining the terminology we use.
In this Data Protection Statement, we use the following terms, among others:
• a) personal data
Personal data are any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”). A natural person is considered identifiable if he or she can be identified directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier or one or more special characteristics that express the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• b) data subject
A data subject is any identified or identifiable natural person whose personal data are processed by the controller.
• c) processing
Processing means any operation or set of operations that are performed on personal data with or without automated means, such as collecting, recording, organising, structuring, storing, adapting or altering, retrieving, querying, using, disclosing by transmitting, disseminating or providing in some other form, reconciling or combining, restricting, deleting or destroying such data.
• d) restriction of processing
Restriction of processing is the marking of stored personal data for the purpose of limiting its processing in future.
• e) profiling
Profiling means any form of automated processing of personal data in a manner that uses the personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
• f) pseudonymisation
Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to any specific data subject without the use of additional information, assuming that such additional information is kept separately and that it is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
• g) controller or data controller
The controller or data controller is the natural person or legal entity, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of personal data processing. Wherever the purposes and means of such processing are prescribed by EU law or EU member state law, the controller or the specific criteria for its nomination may be specified by EU law or EU member state law.
• h) commissioned data processor
A commissioned data processor is a natural person or legal entity, public authority, agency or another body which processes personal data on behalf of the controller.
• i) recipient
The recipient is any natural person or legal entity, public authority, agency or another body to which personal data are disclosed, regardless of whether it represents a third party or not. However, authorities which may receive personal data within the scope of a specific inquiry under EU law or EU member state law are not considered recipients.
• j) third party
A third party is any natural person or legal entity, public authority, agency or another body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
• k) consent
Consent is any freely given, specific, informed and unambiguous indication of a data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
2. Name and address of the controller
The controller within the meaning of the General Data Protection Regulation (GDPR), other data protection laws applicable in the member states of the European Union and other provisions governing privacy is this company:
IWP Hohental Plan- und Generalbau GmbH
Ehrenbergstr. 11-14
D-10245 Berlin
Phone: +49 30 9789646-0
E-mail: info@hohental.de
Homepage: www.hohental.de
3. Name and address of the data protection officer
The controller’s data protection officer is:
in-Praxis
Holger von Eicken
Hoffgarten 18
D-56096 Hamm
Phone: +49 2385 913361
E-mail: info@in-praxis.de
Homepage: www.in-praxis.de
Any person affected may contact our data protection officer directly with any question or suggestion regarding data protection at any time.
4. Cookies
The websites of IWP Hohental Plan- und Generalbau GmbH use so-called cookies. Cookies are text files that are placed on a computer system via an internet browser and stored there.
Most websites and servers use such cookies. Many cookies contain a so-called cookie ID. A cookie ID is the cookie’s unique identifier. It consists of a string of characters that can be used to assign websites and servers to the specific web browser in which the cookie was stored. This enables the visited websites and servers to distinguish the specific browser of the data subject from other web browsers that contain other cookies. A certain web browser can be recognised and identified via the unique cookie ID.
The use of cookies enables IWP Hohental Plan- und Generalbau GmbH to provide the users of this website with user-friendly services in ways that would be impossible without the placement of cookies.
Cookies make it possible to optimise the information and offers of our website in the best interest of the user. As mentioned above, cookies enable us to recognise the visitors of our website. The purpose of recognising users is to make it easier for them to use the website. For example, users of websites that use cookies do not have to re-enter their login details every time they visit the website, because this step is taken care of by the website itself and the cookie stored on the user’s computer system. Another example would be the cookie of a shopping cart in an online shop. The online shop uses a cookie to memorise the items placed in the virtual shopping cart by the client.
The data subject may keep our website from placing cookies by adjusting the settings of the used web browser accordingly, and thereby permanently objecting to the placement of cookies. In addition, cookies that have already been placed can be deleted via the web browser or other software programs at any time. All standard web browsers provide such an option. If the data subject disables the placement of cookies in the web browser used, he or she may not be able to take advantage of all the features of our website.
5. Collection of general data and information
The website of IWP Hohental Plan- und Generalbau GmbH will collect a variety of general data and information every time the website is called up by a data subject or by an automated system. General data and information of this type are stored in the log files of our server. Among the data captured could be (1) the browser type and version used, (2) the operating system used by the accessing device, 3) the website from which an accessing device reaches our website (so-called referrer), (4) the sub-websites that are accessed via an accessing device on our website, (5) the date and time of access to the website, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing device, and (8) other similar data and information that help to avert danger in the event of attacks on our information technology systems.
During the use of these general data and information, IWP Hohental Plan- und Generalbau GmbH draws no conclusions regarding the data subject. The information is needed to (1) deliver the content of our website correctly, (2) optimise the content of our website and the advertising for it, (3) ensure the long-term functionality of our information technology systems and the technology of our website, and (4) provide law enforcement authorities with the information they need for criminal prosecution purposes in the event of a cyber attack. Accordingly, the anonymously collected data and information are statistically evaluated by IWP Hohental Plan- und Generalbau GmbH while also being evaluated for the purpose of enhancing the data protection and data security within our company and to ultimately ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data disclosed by a given data subject.
6. Routine deletion and blocking of personal data
The controller processes and stores personal data of the data subject only for as long as is necessary to achieve the storage purpose or if the processing and storing is prescribed by the European legislator or another legislator through laws or regulations to which the controller is subject.
If the storage purpose ceases to apply or if a storage period prescribed by European directives and regulations or other competent legislators expires, personal data is routinely blocked or deleted in accordance with the relevant legal requirements.
7. Data subject rights
• a) right of confirmation
Every data subject has the right as granted by the European legislator to request confirmation from a given controller as to whether personal data concerning them is being processed. Any data subject wishing to exercise this right of confirmation may contact a member of the controller’s staff at any time.
• b) right to access
Every person affected by personal data processing has the right as granted by the European legislator to obtain from the controller information about the stored personal data concerning them and a copy of this information at any time and free of charge. In addition, the European legislator has granted data subjects access to the following information:
the purposes of processing
the categories of personal data that are processed
the recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly in regard to recipients in third countries or international organisations
if possible, the period for which the personal data are planned to be stored, or, if impossible, the criteria used to determine that period
the existence of a right to rectification or deletion of personal data concerning them or to restriction of processing by the controller or a right to object to such processing
the right to lodge a complaint with a regulator
if the personal data are not collected from the data subject: all available information about the origin of the data
the existence of automated decision-making, including profiling, referred to in Art. 22, Sec. 1 and 4, GDPR, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the sought effects of such processing for the data subject
In addition, the data subject has the right to obtain information as to whether his or her personal data have been transferred to any third country or to any international organisation. If this is the case, the data subject also has the right to obtain information about the appropriate safeguards relating to the transfer.
Any data subject wishing to exercise this right of confirmation may contact a member of the controller’s staff at any time.
• c) right to rectification
Any person affected by personal data processing has the right as granted by the European legislator to request the immediate correction of inaccurate personal data concerning them.
In addition, the data subject has the right to request the completion of incomplete personal data, considering the purposes of the data processing – including by means of a supplementary statement.
Any data subject wishing to exercise this right of rectification may contact a member of the controller’s staff at any time toward this end.
• d) right to erasure (right to be forgotten)
Any person affected by personal data processing has the right as granted by the European legislator to request that the controller delete any personal data concerning them promptly if one of the following reasons applies and to the extent that the processing is unnecessary:
The personal data was collected or otherwise processed for purposes for which they are no longer needed.
The data subject withdraws his or her consent on which the processing was based pursuant to Art. 6, Sec. 1, Lit. a, GDPR, or Art. 9, Sec. 2, Lit. a, GDPR, and there is no other legal basis for data processing.
The data subject objects to the data processing pursuant to Art. 21, Sec. 1, GDPR, and there exist no overriding legitimate grounds for the processing, or the data subject objects to the data processing pursuant to Art. 21, Sec. 2, GDPR.
The personal data were unlawfully processed.
The deletion of personal data is necessary to fulfil a legal obligation under EU law or under the laws of that EU member state that applies to the controller.
The personal data were collected in connection with information society services offered pursuant to Art. 8, Sec. 1, GDPR.
If any of the above reasons applies and a data subject wishes to request the deletion of personal data stored by IWP Hohental Plan- und Generalbau GmbH, they may contact a member of the controller’s staff at any time. The staff member of IWP Hohental Plan- und Generalbau GmbH will ensure that the deletion request is promptly fulfilled.
If the personal data has been made public by IWP Hohental Plan- und Generalbau GmbH GmbH and if the company is obliged to delete the personal data as the controller pursuant to Art. 17, Sec. 1, GDPR, IWP Hohental Plan- und Generalbau GmbH will take reasonable steps, including technical measures, with available technology and implementation costs duly taken into account, to inform other controllers who process the published personal data that the data subject has requested the deletion of all links to this personal data or copies or replications of this personal data by these other data controllers if no data processing is actually necessary. Any necessary action, as the case may be, will be taken by a staff member of IWP Hohental Plan- und Generalbau GmbH.
• e) right to restriction of processing
Any person affected by the processing of personal data has the right as granted by European legislator to request the controller to restrict processing if any of the following conditions is met:
The accuracy of the personal data is disputed by the data subject, provided the controller is given enough time to verify the accuracy of the personal data.
The processing is unlawful and the data subject rejects the deletion of the personal data, requesting instead that the use of the personal data be restricted.
The controller no longer needs the personal data for processing purposes but the data subject needs them for asserting, exercising or defending legal claims.
The data subject has objected to the processing pursuant to Art. 21, Sec. 1, GDPR, and it is not yet clear whether or not the legitimate grounds of the controller override those of the data subject.
If any of the above reasons applies and a data subject wishes to request that the processing of personal data stored by IWP Hohental Plan- und Generalbau GmbH be restricted, they may contact a member of the controller’s staff at any time.
The competent staff member of IWP Hohental Plan- und Generalbau GmbH will ensure that data processing is restricted.
• f) right to data portability
Any person affected by personal data processing has the right, granted by the European legislator, to demand that the own personal data that he or she provided to a controller be disclosed to him or her in a structured, commonly used and machine-readable format. Such a person also has the right to transmit the data to another controller without being hindered by the controller to whom the personal data was provided, assuming that the processing is based on consent pursuant to Art. 6, Sec. 1, Lit. a, GDPR, or Art. 9, Sec. 2, Lit. a, GDPR, or on a contract pursuant to Art. 6, Sec. 1, Lit. b, GDPR, and the processing is carried out by automated methods, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
In addition, when exercising his or her right to data portability pursuant to Art. 20, Sec. 1, GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, to the extent that doing so is technically feasible and assuming that it does not adversely affect the rights and freedoms of others.
To assert the right to data portability, the data subject may contact a member of staff at IWP Hohental Plan- und Generalbau GmbH any time.
• g) right to object
Any person affected by personal data processing has the right as granted by the European legislator to object to the processing of his or her personal data that is carried out on the basis of Art. 6, Sec. 1, Lit. e or f, GDPR, on grounds relating to their particular situation at any time. The same applies to profiling based on the same provisions.
If a data subject files such an objection, IWP Hohental Plan- und Generalbau GmbH will cease to process these personal data unless we can substantiate compelling legitimate grounds for processing his or her personal data which outweigh his or her interests, rights and freedoms, or unless the processing serves the assertion, exercise or defence of legal claims.
If IWP Hohental Plan- und Generalbau GmbH processes personal data for the purpose of direct marketing, the data subject has the right to object to the processing of personal data for the purpose of such marketing at any time. The same is true for profiling if it is connected to direct marketing of this type. If the data subject objects vis-à-vis IWP Hohental Plan- und Generalbau GmbH to personal data processing for direct marketing purposes, then IWP Hohental Plan- und Generalbau GmbH will cease to process the personal data for these purposes.
In addition, the data subject has the right to object, on grounds relating to his or her particular situation, to the processing of his or her personal data that IWP Hohental Plan- und Generalbau GmbH conducts for scientific or historical research purposes or for statistical purposes pursuant to Art. 89, Sec. 1, GDPR, unless such processing is necessary to perform a task that is in the public interest.
To assert the right to object, the data subject may contact a member of staff at IWP Hohental Plan- und Generalbau GmbH or another employee any time. In the context of using information society services, the data subject has the option, notwithstanding Directive 2002/58/EC, to exercise his or her right to object via automated procedures that use technical specifications.
• h) automated decision-making in individual cases including profiling
Any person affected by personal data processing has the right, granted by the European legislator, not to be subject to a decision that is based solely on automated processing—including profiling—which produces legal effects concerning or similarly significantly affecting him or her, unless the decision (1) is not necessary for the conclusion or performance of a contract between the data subject and the controller, or (2) is authorised by EU law or EU member state law to which the controller is subject and which also specifies appropriate measures to safeguard the data subject’s rights and freedoms and legitimate interests, or (3) is based on the data subject’s explicit consent.
If the decision (1) is necessary for concluding or fulfilling a contract between the data subject and the controller, or (2) if it is made with the data subject’s explicit consent, IWP Hohental Plan- und Generalbau GmbH shall take appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject, including, at a minimum, the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
Any data subject wishing to assert his or her rights in regard to automated decisions may contact a member of the controller’s staff at any time toward this end.
• c) right to withdraw consent under data protection law
Any person affected by personal data processing has the right, as granted by the European legislator, to request the immediate correction of inaccurate personal data concerning him or her.
Any data subject wishing to exercise his or her right to revoke his or her consent may contact a member of the controller’s staff at any time toward this end.
8. Data protection policy for applicants
Which of your data will be processed by us? And for what purposes?
We will process any data you send us in connection with your application in order to assess your eligibility for the position (or other open positions in our company, where applicable) and to carry out the application process.
What is the legal basis for such processing?
The legal basis for processing your personal data in conjunction with this application process is Art. 6, Sec. 1, Sent. 1, Lit. b, GDPR. According to the latter, the processing of data necessary to make a qualified decision whether or not to establish an employment relationship is permissible. If the data is required for legal purposes after the application process is concluded, data processing may be carried out on the basis of the requirements of Art. 6, GDPR, in particular for the purposes of legitimate interests pursuant to Art. 6, Sec. 1, Lit. f, GDPR. In this case, our interest consists in the assertion of, or defence against, any claims. If special types of personal data within the meaning of Art. 9, GDPR, are processed (e.g. health data), the legal basis is Art. 26, Sec. 3, German Data Protection Act (BDSG), or Art. 9, Sec. 2, Lit. b, GDPR, i.c.w. Art. 6, Sec. 1, Lit. b, GDPR.
How long will the data be stored?
In case the job application is rejected, the personal data of the applicant will be deleted after 6 months. In case you consented to an extended storage of your personal data, we will add your data to our pool of applicants. The data in that pool are deleted at the end of a two-year period. If you were hired for the position at the end of the application process, your data will be transferred from our applicant data system to our human resources information system.
To which recipients will the data be disclosed?
Your application data will be screened by the human resources department after their receipt. Next, eligible applications will be forwarded in-house to the persons responsible for the open position within the respective department. The next steps will then be coordinated. In principle, only those persons within our company who need your data to ensure that the application process is properly conducted will have access to them.
9. Privacy policy regarding the use of Facebook
The controller has integrated components belonging to the company Facebook into this website. Facebook is a social network.
A social network represents an online third place or online community that generally allows users to communicate with each other and interact in a virtual space. A social network can serve as platform for the exchange of opinions and experiences or it permits the online community to disseminate personal or corporate information. Facebook enables the users of its social networking website to create private profiles, to upload images and to engage in networking via friendship requests, among other features.
Facebook is operated by Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. For data subjects residing outside the United States or Canada, the controller is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Every time one of the individual pages of this website that is operated by the controller and that features a Facebook component (Facebook plug-in), the browser on the data subject’s IT system is automatically prompted by the respective Facebook component to download from Facebook a representation of the corresponding Facebook component. For a general overview of all Facebook plug-ins, go to https://developers.facebook.com/docs/plugins/?locale=de_EN. During this technical process, Facebook receives information about the specific subpage of our website that is being visited by the data subject.
If the data subject is logged into Facebook at the same time, Facebook will recognise which specific subpage of our website the data subject visits each time the data subject accesses our website and this applies to his or her entire stay on our website. These details are collected by the Facebook component and attributed to the data subject’s respective Facebook account by Facebook. If the data subject clicks on one of the Facebook buttons integrated into our website, e.g. the “Like” button, or if the data subject posts a comment, Facebook attributes this information to the data subject’s personal Facebook user account and stores these personal data.
Whenever the data subject is logged into Facebook at the time he or she is visiting our website, the Facebook component notifies Facebook that the data subject has visited our website; this occurs regardless of whether or not the data subject clicks on the Facebook component. If the data subject does not wish this information to be transferred to Facebook, he or she can prevent the transfer by logging out of his or her Facebook account before visiting our website.
The privacy policy published by Facebook at https://facebook.com/about/privacy/ provides details on the collection, processing and use of personal data by Facebook. The policy page also elaborated which settings Facebook offers to protect the data subject’s privacy. In addition, several applications are available that enable you to block any data transmission to Facebook. The data subject may use such applications to prevent the transfer of personal data to Facebook.
10. Privacy policy regarding the use of Instagram
The controller has integrated components belonging to the Instagram service into this website. Instagram is a service that could be characterised as an audio-visual platform and that enables its users to share images and videos as well as to share such data with other social networking websites.
Instagram services are operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Every time one of the individual pages of this website that is operated by the controller and that features an Instagram component (Instagram button) is visited, the respective Instagram component will automatically prompt the browser on the data subject’s IT system to download a representation of the corresponding component from Instagram. During this technical process, Instagram gains knowledge of the specific subpage of our website that is being visited by the data subject.
If the data subject is logged into Instagram at the same time, Instagram will recognise which specific subpage of our website the data subject visits each time the data subject accesses our website, and this applies to his or her entire stay on our website. These details are collected by the Instagram component and attributed to the data subject’s respective Instagram account by Instagram. If the data subject clicks on one of the Instagram buttons integrated into our website, the data and information transmitted will be attributed to the data subject’s personal Instagram user account and will be stored and processed by Instagram.
Whenever the data subject is logged into Instagram at the time he or she is visiting our website, the Instagram component notifies Instagram that the data subject has visited our website; this occurs regardless of whether or not the data subject clicks on the Instagram component. If the data subject does not wish this information to be transferred to Instagram, he or she can prevent the transfer by logging out of his or her Instagram account before visiting our website.
For more information and to see the privacy policy of Instagram as amended, go to https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/ respectively.
11. Privacy policy regarding the use of LinkedIn
The controller has integrated components belonging to the LinkedIn Corporation into this website. LinkedIn is a social networking website for professionals that enables members to connect to their existing business contacts and to engage in active networking with new ones. More than 900 million members in over 200 countries use LinkedIn. This makes LinkedIn currently the largest professional network and one of the most-visited websites in the world.
LinkedIn is operated by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. The controller responsible for privacy issues outside the United States is LinkedIn Ireland, Privacy Policy Issues, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
Each time our website which features a LinkedIn component (LinkedIn plug-in) is visited, the component will cause the browser used by the data subject to download from LinkeIn a corresponding representation of the component. For more details on the LinkedIn plug-ins, go to https://developer.linkedin.com/plugins. During this technical process, LinkedIn gains knowledge of the specific subpage of our website that is being visited by the data subject.
If the data subject is logged into LinkedIn at the same time, LinkedIn will recognise which specific subpage of our website the data subject visits each time the data subject accesses our website, and this applies to his or her entire stay on our website. These details are collected by the LinkedIn component and attributed to the data subject’s respective LinkedIn account by LinkedIn. If the data subject clicks on one of the LinkedIn buttons integrated into out website, LinkedIn will attribute the information to the data subject’s personal LinkedIn user account and store the personal data.
Whenever the data subject is logged into LinkedIn at the time he or she is visiting our website, the LinkedIn component notifies LinkedIn that the data subject has visited our website; this occurs regardless of whether or not the data subject clicks on the LinkedIn component. If the data subject does not wish this information to be transferred to LinkedIn, he or she can prevent the transfer by logging out of his or her LinkedIn account before visiting our website.
LinkedIn gives you the option to discontinue the receipt of emails, short message and targeted advertisements, as well as to manage advertisement settings at https://www.linkedin.com/psettings/guest-controls. In addition, LinkedIn uses partners like Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua and Lotame, which may place cookies of their own. You can reject the placement of such cookies under https://www.linkedin.com/legal/cookie-policy. For the privacy policy of LinkedIn as amended, go to https://www.linkedin.com/legal/privacy-policy. For the cookie policy of LinkedIn, go to https://www.linkedin.com/legal/privacy-policy.
12. Google Maps
This website uses the Google Maps service. It is provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
Using the functions of Google Maps necessitates saving your IP address. Such information is, as a rule, transmitted to a Google server in the United States and stored there. The provider of this website has no way to influence the transmission of such data. Once Google Maps is enabled, Google may use Google Fonts to ensure that fonts are uniformly displayed. Whenever you access Google Maps, your browser will load the required web fonts into your browser cache to properly display texts and fonts.
The purpose of using Google Maps is to provide an engaging representation of our online services and to facilitate the traceability of places we identify on our website. Using this service is in the legitimate interest within the meaning of Art. 6, Sec. 1, Lit. f, GDPR. Assuming that a corresponding consent was obtained, the data are processed exclusively on the basis of Art. 6, Sec. 1. Lit. a, GDPR, and Art. 25, Sec. 1, German Telecommunications Digital Services Data Protection Act (TTDSG), to the extent that the consent covers the storage of cookies or the access to information on the user endpoint (e.g. device fingerprinting) within the meaning of the TTDSG. The consent may be revoked at any time.
Data transfers to the United States are subject to the standard contractual clauses of the EU Commission. For details, go to https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.
For more details on the handling of user data, see Google’s data protection statement at: https://policies.google.com/privacy?hl=en
13. Google Fonts (local hosting)
This website uses so-called Google fonts that are provided by Google to ensure the uniform display of fonts. Google fonts are installed locally. The website does not connect to Google servers for this purpose.
For more details on Google Fonts, go to wwww.developers.google.com/fonts/faq and see Google’s privacy policy at: www.policies.google.com/privacy?hl=en.
14. Font Awesome (local hosting)
This website uses the uniform representation of the font called Font Awesome. Font Awesome is installed locally. The website does not connect to servers of Fonticons Inc. for this purpose.
For more details on Font Awesome, see the privacy policy of Font Awesome at: https://fontawesome.com/privacy.
15. Legal basis for data processing
Our company uses Art. 6, Sec. 1, Lit. a, GDPR, as legal basis for its data processing operations for which we obtain the consent for a specific processing purpose. If personal data processing is necessary for the performance of a contract to which the data subject is party, as is the case e.g. with processing operations necessary for the delivery of goods or the provision of other services or consideration, then processing is based on Art. 6, Sec. 1, Lit. b, GDPR. The same applies to processing operations that are necessary to implement pre-contractual measures, e.g. in cases of requests for information about our products or services. If our company is subject to a legal obligation that necessitates the processing of personal data, e.g. to meet fiscal obligations, then processing is based on Art. 6, Sec. 1, Lit. c, GDPR. In rare instances, personal data processing might become necessary to protect the vital interests of the data subject or another natural person. This would be the case, e.g., if a visitor were to be injured on our premises and his or her name, age, health insurance details or other vital information had to be passed on to a physician, hospital or other third party. In this case, processing would be based on Art. 6, Sec. 1, Lit. d, GDPR. Finally, processing operations could be based on Art. 6, Sec. 1, Lit. f, GDPR. This legal basis applies to processing operations that are not covered by any of the above legal bases if the processing is necessary to safeguard a legitimate interest of our company or a third party unless the interests, fundamental rights and freedoms of the data subject prevail. We are authorised to carry out such processing operations in particular because they have been expressly specified by the European legislator. In this regard, the European legislator took the view that a legitimate interest could be assumed whenever the data subject is one of the controller’s customers (Recital 47, Sentence 2, GDPR).
16. Legitimate interests in processing pursued by the controller or a third party
Whenever the processing of personal data is based on Art. 6, Sec. 1, Lit. f, GDPR, our legitimate interest is the performance of our business activities for the benefit of all our employees and shareholders.
17. Storage limitation for personal data
The criterion determining how long personal data may be stored is the applicable statutory retention period, as the case may be. After expiry of the period, the corresponding data will routinely be deleted, assuming they are no longer required to fulfil or initiate a contract.
18. Legal or contractual requirements for the provision of personal data; necessity for the conclusion of the contract; obligation of the data subject to provide the personal data; possible consequences of a failure to provide them
Please note that the disclosure of some personal data is required by law (e.g. tax regulations) or that it may be necessitated by contractual provisions (e.g. details regarding the contractual partner). Occasionally, it may be necessary for a data subject to disclose personal data to us in order to conclude a contract, and we will subsequently have to process those data. For instance, a data subject is obliged to disclose personal data to us if he or she is about to enter into a contract with our company. The consequence of failing to disclose his or her personal data would be that the contract with the data subject cannot be concluded. Prior to disclosing his or her personal data, the data subject should get in touch with one of our staff. Based on the case at hand, our staff will then explain to the data subject whether the disclosure of personal data is legally or contractually prescribed or is necessary to conclude a contract, whether there is an obligation to disclose personal data, and what the consequences of a failure to disclose the personal data would be.
19. Use of automated decision-making
As a responsible organisation, we refrain from the use of automated decision-making and profiling.