Privacy Policy

I. General Information

1. Scope

1. the use of our website/s and all other internet pages referring to it (for details see section "Websites");
2. the use of the learning platform integrated into our website, if this is provided to users by ourselves (for details see section "Learning platform");
3. the use of our external websites (for details see section "External sites"); and
4. the application process (for details see section "Applications").

2. Data Controller

3. Definitions

4. General information on data processing

5. Duration of storage

6. Automated decisions in individual cases including profiling

7. Rights of data subjects

8. Notification obligations of the controller

9. Duty to provide

10. Data transfer to third countries

1. If the transfer is based on an adequacy decision within the meaning of Art. 45 GDPR, you can find an overview of the adequacy decisions here.
2. If the transfer is based on so-called standard data protection clauses of the EU Commission within the meaning of Art. 46 (c) GDPR, you can find the EU Commission's implementing decision (EU 2021/914) containing the contractual clauses here.

11. Right of objection

12. Revocation of consent

II. Interaction of the Privacy Policy and the Cookie Policy and Consent Tool

III. Data processing during the use of our website

IV. Data processing in the application procedure

V. Data processing when using our Learning platform

VI. External (Web-)sides

VII. Information about Joint Controllers 

VIII. Definitions

Additional definitions:

1. Master data (e.g., names, address, dates of birth).
2. Contact data (e.g. e-mail addresses, telephone number, messenger services)
3. Content data (e.g., text entries, photographs, videos, contents of documents/files)
4. Contract data (e.g., subject matter of contract, terms, customer category)
5. Payment data (e.g. bank details, payment history, use of other payment service providers)
6. Usage data (e.g., history on our website, use of certain content, access times, contact or order history)
7. Connection data (e.g., device information, IP addresses, URL referrers).
8. Location data (e.g. GPS data, IP geolocation, access points).
9. Diagnostic data (e.g., crash logs, website/app performance data, other technical data used to analyze malfunctions and errors)
10. Applicant and employee data (e.g. employment history, working hours, vacation periods, periods of incapacity to work, appraisals, training and further education, social data, bank details, social security number, health insurance/health insurance number, salary expectations and salary data as well as tax identification number, proofs and documents, working hours, public offices held, social security data, occupational integration management data)

1. Advertising and personalized marketing measures: Includes, for example, the opening of public and, where applicable, restricted-access websites, apps and/or external pages for general information about our products/services (e.g., general website about our company, press pages, social media pages), personalized communication with users, interested parties and/or customers (e.g., newsletters), playout of (personalized) recommendations and advertising activities (e.g. e.g., personalized newsletters, playout of advertising on other websites, search engines, social media pages and/or apps, and generally in advertising networks), merging and linking of data (possibly involving other parties such as publishers in advertising networks) to ensure commission claims for advertising materials.
2. Safety and emergency management: all processes are recorded which, in the respective context, serve to ensure the relevant safety requirements and the prevention and/or treatment of accidents and emergencies, such as access controls, video monitoring, logging, evacuation, personal rescue and damage limitation.
3. Analysis and performance measurement as well as optimization of products and/or services: Includes e.g. opinion polls and voting, comparison tests (so-called A/B testing), analysis and (usually aggregated) evaluation of user, prospect and/or customer behavior in the online and/or offline area (e.g. through click paths, mouse movements and heat maps), analysis and evaluation of the success of general and, if applicable, personalized marketing measures, needs-based design of our (digital) products and services based on the analyzed demand and/or usage behavior.
4. Order fulfillment and contract management: Includes all processing operations required for the fulfillment of the relevant orders/contracts, such as the processing of master data and contact data for the fulfillment of the customer's orders, payment processing including any necessary transfer of data to payment service providers, processing of returns, license verification.
5. Operation and further development of internal IT systems: Includes, among other things, user management, authentication and technical logging, as well as IT support and the further development and adaptation of systems and the associated processing of personal data. This applies regardless of whether the IT systems are operated by the controller itself or by a service provider (processor).
6. Applicant management: Includes, among other things, personnel marketing and processes in the context of initiating employment, such as processing applications (digital and analog), communicating with applicants, conducting interviews, assessment center procedures and trial work, setting up talent pools, and documenting the outcome of applications.
7. Business partner maintenance: All processes are recorded that serve to analyze and select suitable business partners and to maintain existing business relationships.
8. Warranty, guarantee, goodwill and general service: Includes in particular the processing of warranty, guarantee and goodwill cases, as well as any information on updates, improvements and recall campaigns.
9. Identity and/or creditworthiness check: The aim of the processing is to check the identity of the data subject, insofar as this is necessary for the respective process, and/or to check the creditworthiness and/or solvency of an interested party or contractual partner.
10. Information security: Processing operations are recorded that serve to protect against risks and to secure IT systems, as well as to achieve the protection goals of confidentiality, availability and integrity of data, systems and processes (e.g., differentiation of human access and bot access, detection and defense against abusive access, security-relevant analysis of the use of digital products and services).
11. Logistics and fleet management: Includes, among other things, the planning, management, and control of our logistics, including external logistics service providers, and the management of our fleet, including compliance with legal obligations.
12. User, prospect and/or customer support: Includes, for example, contact forms, chat systems including chat bots and callback options, and generally the processing of various inquiries (e.g., advice, service, complaints).
13. Human resources and personnel management: Includes all processes for implementing employment or processes that are closely related to employment, such as onboarding, personnel administration, fulfillment of employer obligations, personnel development including training, and continuing education, voluntary employer benefits, personnel planning and controlling, company health management, company social counseling, company co-determination, measures to terminate employment, investigative and disciplinary measures, and offboarding.
14. Project management including project collaboration: project coordination and execution, project planning, project schedule management, project information sharing, project collaboration.
15. Legal matters and compliance measures: Covers, for example, the assertion, exercise and enforcement of legal claims and processes for compliance with legal requirements (e.g., as part of data protection consent management) and for the prevention and/or clarification and prosecution of legal violations.
16. Event management: All processes required for the implementation of offline and online events (e.g., registration, participant management, implementation of the event, processing of personal preferences and needs, data processing in the context of video conferencing and/or instant messaging services), photo, audio and/or video documentation of events, issuance of certificates of participation are recorded.
17. Administration: Covers processes that include basic functions of business operations such as communication, accounting, billing and reporting, documentation and archiving, knowledge and contact management.
    

1. Promotion of sales activities: e.g., promotion of our sales by evaluating the demand of our customers, analysis of the interests and purchasing and demand behavior of our prospects, users and/or customers.
2. Promotion of economic interests: e.g., measures to reduce costs and cut costs, avoid/reduce significant additional costs, generally increase earnings (esp. by outsourcing to service providers) and avoid competitive disadvantages.
3. Advertising and image enhancement, market and opinion research: e.g., opinion surveys, voting, product and/or service ratings and other reviews, and the integration of these results.
4. Analysis and optimization of our own offers, services and advertising measures: e.g., analysis of user, prospective customer and/or customer behavior for the optimization of processes, services and products, needs-based design of our products, services and marketing measures and direct customer approach.
5. Design, operation, and availability of digital products: includes, for example, the integration of general functions of websites, apps, and other digital products.
6. Operation, integrity and security of digital products: in particular, defense against requests overloading the service (denial of service attacks) or excessive use of bots to destabilize a platform, IT security measures such as saving log files and, in particular, IP addresses for a longer period of time in order to detect and ward off misuse, including beyond the legally required level.
7. Direct advertising (personalized marketing): in particular, direct approaches to prospective customers and customers that are not based on consent, such as product recommendations based on previous demand behavior, including the processing of data in preparation for direct advertising (e.g., customer segmentation, affinity ratings).
8. Integration of desired or required functionalities: integration of functionalities that are in the interest of the customer, are played out at the request of the customer and/or are necessary for the provision of the service (e.g., the integration of contact options on websites or in apps or, for example, the possibility of saving configurations by the user (e.g., language selection).
9. Assertion, exercise or defense of legal claims: e.g., preservation of evidence, to clarify the facts in the event of a foreseeable legal dispute.
10. Customer acquisition, customer retention, customer recovery: e.g. operation of a customer relationship management (CRM)for prospect and customer care.
11. Freedom of opinion, press and broadcasting: in particular, processing that previously fell under the so-called media privilege.
12. Protection of the body and health of the data subjects 
13. Promotion of legitimate interests in a group of companies: performance of organizational, procedural or entrepreneurial tasks from the cooperation of several affiliated companies (see the explanations for Art. 48 GDPR).
14. Prevention of criminal offences, administrative offences and other detrimental actions: in particular fraud prevention, preventive measures within the framework of an internal control system, measures to clarify risks following corresponding suspicious cases or other indications of possible actions to the detriment of the controller or other persons.
15. Reduction of default risks: identification of economic, technical, procedural or organizational risks for the company that could lead to a complete or partial failure of the company, parts of the company or products or services of the company
16. Other legitimate interests: Where relevant, these interests are explained separately at the respective points.
    

1. Banks and other financial service providers
2. Public authorities and other public bodies
3. Professional secrecy providers and their companies/entities
4. IT service providers
5. Opponents in legal disputes
6. Group companies and other affiliated companies
7. Customers and interested parties
8. Suppliers
9. Personnel service providers
10. Platform operators and media
11. Associations, organizations and interest groups
12. Landlords
13. Insurance companies
14. Contractors (without customers)