Privacy Policy

 

Newsletters and Electronic Notifications

​

We send newsletters, emails, and other electronic notifications (hereinafter “newsletters”) exclusively with the recipients’ consent or on a legal basis. If the newsletter’s content is specified during the sign-up process, that content is decisive for the user’s consent. To subscribe to our newsletter, providing your email address is usually sufficient. However, in order to offer you a personalized service, we may ask you to provide your name so we can address you personally in the newsletter, or to provide additional information if it is necessary for the purpose of the newsletter.

​

Deletion and Restriction of Processing: We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them, in order to be able to demonstrate that consent was previously given. The processing of this data is limited to the purpose of potentially defending against claims. An individual request for deletion is possible at any time, provided that the prior existence of consent . In the event of obligations to permanently honor objections, we reserve the right to store the email address solely for this purpose in a blocklist.

​

The registration process is logged based on our legitimate interests for the purpose of verifying that it was carried out properly. To the extent that we engage a service provider to send emails, this is done based on our legitimate interests in an efficient and secure mailing system.

​

Content:

 

Information about us, our services, promotions, and offers.

​

• Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., mailing and email addresses or phone numbers). Meta, communication, and process data (e.g., IP addresses, time stamps, identification numbers, individuals involved).

• Data subjects: Communication partners.

• Purposes of processing and legitimate interests: Direct marketing (e.g., via email or mail).

• Legal basis: Consent (Art. 6(1)(a) GDPR).

• Right to object (opt-out): You may unsubscribe from our newsletter at any time, i.e., revoke your consent or object to receiving further communications. You will find a link to unsubscribe from the newsletter either at the end of each newsletter or you may use one of the contact options listed above—preferably email—for this purpose.
  
   

Promotional Communications via Email, Mail, Fax, or Telephone

 

We process personal data for the purpose of sending promotional communications, which may be sent via various channels—such as email, phone, mail, or fax—in accordance with legal requirements.

​

Recipients have the right to revoke their consent at any time or to object to promotional communications at any time, free of charge, using the contact options listed above.

​

Following revocation or objection, we store the data necessary to prove prior authorization for contacting you or sending communications for up to three years after the end of the year in which the revocation or objection occurred, based on our legitimate interests. The processing of this data is limited to the purpose of potentially defending against claims.

 

Based on the legitimate interest in permanently honoring users’ revocations or objections, we also store the data necessary to prevent further contact (e.g., depending on the communication channel, the email address, phone number, or name).

​

• Types of data processed: Master data (e.g., full name, home address, contact information, customer number, etc.); contact data (e.g., mailing and email addresses or phone numbers); content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation).

• Data Subjects: Communication partners.

• Purposes of Processing and Legitimate Interests: Direct marketing (e.g., via email or mail); marketing; sales promotion.

• Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.”

• Legal Bases: Consent (Art. 6(1), sentence 1, lit. a) of the GDPR). Legitimate interests (Art. 6(1), sentence 1, lit. f) of the GDPR).

 

 

Web Analytics, Monitoring, and Optimization

 

Web analytics (also referred to as “audience measurement”) is used to evaluate visitor traffic to our online offering and may include behavior, interests, or demographic information about visitors—such as age or gender—in pseudonymized form. With the help of reach analysis, we can, for example, determine at what times our online offering or its functions and content are used most frequently, or encourage repeat visits. We can also identify which areas require optimization.

​

In addition to web analytics, we may also use testing procedures to, for example, test and optimize different versions of our online service or its components.

​

Unless otherwise specified below, profiles—that is, data aggregated for a specific usage session—may be created for these purposes, and information may be stored in a browser or on a device and then retrieved. The data collected includes, in particular, websites visited and elements used there, as well as technical information such as the browser used, the computer system used, and details regarding usage times. If users have consented to the collection of their location data by us or by the providers of the services we use, the processing of location data is also possible.

​

In addition, users’ IP addresses are stored. However, we use an IP masking procedure (i.e., pseudonymization by truncating the IP address) to protect users. In general, no personally identifiable user data (such as email addresses or names) is stored in the context of web analytics, A/B testing, and optimization; instead, pseudonyms are used. This means that neither we nor the providers of the software we use know the actual identity of users, but only the information stored in their profiles for the purpose of the respective processes.

​

Notes on Legal Bases:

If we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e., an interest in providing efficient, cost-effective, and user-friendly services). In this context, we would also like to draw your attention to the information regarding the use of cookies in this Privacy Policy.

​

• Types of data processed: Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved) .

• Data subjects: Users (e.g., website visitors, users of online services).

• Purposes of processing and legitimate interests: Audience measurement (e.g., access statistics, identification of returning visitors); profiles containing user-related information (creation of user profiles). Provision of our online services and user-friendliness.

• Retention and Deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion.” Storage of cookies for up to 2 years (Unless otherwise specified, cookies and similar storage methods may be stored on users’ devices for a period of two years.).

• Security Measures: IP masking (pseudonymization of the IP address).

• Legal bases: Consent (Art. 6(1)(a) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).

 

 

Additional Information on Processing Operations, Procedures, and Services:

​

Google Analytics: We use Google Analytics to measure and analyze the use of our online services based on a pseudonymous user identification number. This identification number does not contain any unique data, such as names or email addresses. It serves to associate analytical information with a device in order to determine which content users have accessed during one or more sessions, which search terms they have used, whether they have revisited that content, or how they have interacted with our online offering. The time of use and its duration are also stored, as well as the sources from which users were referred to our online offering and technical details about their devices and browsers. In this process, pseudonymous user profiles are created using information from the use of various devices, and cookies may be used for this purpose. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides rough geographic location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based equivalents). For EU data traffic, IP address data is used exclusively for this derivation of geolocation data before being immediately deleted. It is not logged, is not accessible, and is not used for any other purposes. When Google Analytics collects measurement data, all IP queries are performed on EU-based servers, before the traffic is forwarded to Analytics servers for processing; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; security measures: IP masking (pseudonymization of the IP address); Privacy Policy: https://policies.google.com/privacy; Data Processing Agreement: https://business.safety.google/adsprocessorterms/; Legal Basis for Transfers to Third Countries: Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms) ; Right to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of advertisements: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/ (Types of processing and data processed).

 

​Social Media Presence

 

We maintain online presences on social media platforms and, in this context, process user data to communicate with users active on those platforms or to provide information about us.

​

Please note that user data may be processed outside the European Union in this context. This may pose risks to users, as it could, for example, make it more difficult to enforce user rights.

​

Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles may be created based on users’ behavior and the resulting interests. These profiles may in turn be used, for example, to display advertisements within and outside the networks that are presumed to correspond to users’ interests. For this reason, cookies are typically stored on users’ computers to record their usage behavior and interests. In addition, data may also be stored in the usage profiles regardless of the devices used by the users (particularly if they are members of the respective platforms and are logged in there).

​

For a detailed description of the respective forms of processing and the options to opt out, please refer to the privacy policies and information provided by the operators of the respective networks.

​

We also note that requests for information and the exercise of data subject rights are most effectively addressed directly with the providers.

 

Only the latter have access to the user data and can directly take appropriate measures and provide information. If you still need assistance, however, you can contact us.

​

• Types of Data Processed: Contact data (e.g., postal and email addresses or phone numbers); Content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation); Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features).

• Data Subjects: Users (e.g., website visitors, users of online services).

• Purposes of Processing and Legitimate Interests: Communication; feedback (e.g., collecting feedback via an online form). Public relations.

• Retention and deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.”

• Legal bases: Legitimate interests (Art. 6(1), first sentence, lit. f) of the GDPR).

 

Additional information on processing activities, procedures, and services:

​

• LinkedIn: Social network—We are jointly responsible with LinkedIn Ireland Unlimited Company for the collection (but not the further processing) of visitor data used to generate “Page Insights” (statistics) for our LinkedIn profiles. This data includes information about the types of content users view or interact with, as well as the actions they take. In addition, details about the devices used are collected, such as IP addresses, operating system, browser type, language settings, and cookie data, as well as information from user profiles, such as job title, country, industry, hierarchical level, company size, and employment status. Information regarding the processing of user data by LinkedIn can be found in LinkedIn’s Privacy Policy: https://www.linkedin.com/legal/privacy-policy. We have entered into a specific agreement with LinkedIn Ireland (“Page Insights Joint Controller Addendum,” https://legal.linkedin.com/pages-joint-controller-addendum), which specifically outlines the security measures LinkedIn must adhere to and in which LinkedIn has agreed to honor the rights of data subjects (i.e., users may, for example, submit requests for access or deletion directly to LinkedIn). Users’ rights (in particular the right to access, erasure, objection, and the right to lodge a complaint with the competent supervisory authority) are not restricted by the agreements with LinkedIn. Joint controllership is limited to the collection and transfer of data to LinkedIn Ireland Unlimited Company, a company headquartered in the EU. Further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, particularly with regard to the transfer of data to the parent company, LinkedIn Corporation, in the United States; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Legal basis for transfers to third countries: Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa). Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

 

 

Plug-ins, Embedded Features, and Content

 

We integrate functional and content elements into our online offering that are retrieved from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos, or city maps (hereinafter collectively referred to as “content”).

​

This integration always requires that the third-party providers of this content process the users’ IP addresses, as they would not be able to send the content to the users’ browsers without an IP address. The IP address is therefore necessary for the display of this content or these features. We make every effort to use only content whose respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. “Pixel tags” allow information—such as visitor traffic on the pages of this website—to be analyzed. The pseudonymous information may also be stored in cookies on the user’s device and may include, among other things, technical information about the browser and operating system, referring websites, the time of visit, and other details regarding the use of our online service, but may also be linked to such information from other sources.

​

Notes on Legal Bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is that consent. Otherwise, user data is processed based on our legitimate interests (i.e., our interest in providing efficient, cost-effective, and user-friendly services). In this context, we would also like to draw your attention to the information regarding the use of cookies in this Privacy Policy.

​

• Types of Data Processed: Usage data (e.g., page views and time spent on pages, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features) . Meta, communication, and procedural data (e.g., IP addresses, time stamps, identification numbers, individuals involved).

• Data subjects: Users (e.g., website visitors, users of online services).

• Purposes of processing and legitimate interests: Provision of our online services and user-friendliness.

• Retention and deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.” Cookies may be stored for up to 2 years (unless otherwise specified, cookies and similar storage methods may be stored on users’ devices for a period of two years).

• Legal bases: Consent (Art. 6(1), first sentence, lit. a) GDPR). Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR).

 

​

Additional information on processing operations, procedures, and services:

​

• Font Awesome (retrieved from the provider’s server): Retrieval of fonts (and icons) for the purpose of technically secure, maintenance-free, and efficient use of fonts and icons with regard to up-to-date content and loading times, their consistent display, and compliance with any applicable licensing restrictions. The provider of the fonts is notified of the user’s IP address so that the fonts can be made available in the user’s browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted, which is necessary for the provision of the fonts depending on the devices used and the technical environment; Service provider: Fonticons, Inc., 6 Porter Road, Apartment 3R, Cambridge, MA 02140, USA; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://fontawesome.com/. Privacy Policy: https://fontawesome.com/privacy.

 

 

Processing of Data in the Context of Employment Relationships

 

In the context of employment relationships, personal data is processed with the aim of effectively establishing, carrying out, and terminating such relationships. This data processing supports various operational and administrative functions necessary for managing employee relationships.

​

This data processing encompasses various aspects, ranging from the initiation of a contract to its termination. It includes the organization and administration of daily working hours, the management of access rights and authorizations, as well as the handling of employee development measures and performance reviews. The processing also serves the purpose of payroll accounting and the administration of wage and salary payments, which are critical aspects of contract execution.

​

In addition, data processing takes into account the legitimate interests of the responsible employer, such as ensuring workplace safety or collecting performance data to evaluate and optimize operational processes. Furthermore, data processing includes the disclosure of employee data as part of external communication and publication processes, where this is necessary for operational or legal purposes.

​

This data is always processed in compliance with the applicable legal framework, with the goal of creating and maintaining a fair and efficient work environment. This also includes safeguarding the privacy of the affected employees, as well as anonymizing or deleting data once the purpose of processing has been fulfilled or in accordance with statutory retention periods.

​

• Types of Data Processed: Employee data (information about employees and other individuals in an employment relationship); payment data (e.g., bank account information, invoices, payment history); Contract data (e.g., subject matter of the contract, term, customer category); master data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., mailing and email addresses or phone numbers); Content data (e.g., text or image-based messages and posts, as well as related information, such as details regarding authorship or the time of creation); Social data (data subject to social confidentiality and processed, for example, by social insurance agencies, social assistance agencies, or pension authorities); Log data (e.g., log files regarding logins, data retrieval, or access times); Performance and behavioral data (e.g., performance and behavioral aspects such as performance evaluations, feedback from supervisors, training participation, compliance with company policies, self-assessments, and behavioral assessments); ); Work Time Data (e.g., start of work, end of work, actual work time, scheduled work time, break times, overtime, vacation days, special leave days, sick days, absences, work-from-home days, business trips); Salary data (e.g., base salary, bonus payments, incentives, tax bracket information, night shift/overtime premiums, tax deductions, social security contributions, net pay); Image and/or video recordings (e.g., photographs or video recordings of a person); Usage data (e.g., page views and time spent on pages, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, individuals involved).

• Special categories of personal data: Health data; religious or philosophical beliefs; union membership.

• Data subjects: Employees (e.g., staff members, applicants, temporary workers, and other personnel).

• Purposes of processing and legitimate interests: Establishment and performance of employment relationships (processing of employee data in connection with the establishment and performance of employment relationships); business processes and operational procedures; provision of contractual services and fulfillment of contractual obligations; public relations; security measures; office and organizational procedures.

• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR); Legal obligation (Art. 6(1), first sentence, lit. c) GDPR); Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR). Processing of special categories of personal data relating to health, profession, and social security (Art. 9(2), lit. h) GDPR).

 

 

Additional information on processing operations, procedures, and services:

​

• Time tracking: Procedures for tracking employees’ working hours include both manual and automated methods, such as the use of time clocks, time-tracking software, or mobile apps. This involves activities such as entering arrival and departure times, break times, overtime, and absences. Verification and validation of recorded working hours include cross-checking against work schedules or shift schedules, reviewing absences, and the approval of overtime by supervisors. Reports and analyses are generated based on the recorded working hours to provide timesheets, overtime reports, and absence statistics for management and the HR department; Legal Bases: Contract performance and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR) .

• Authorization Management: Procedures required for the definition, administration, and control of access rights and user roles within a system or organization (e.g., creation of authorization profiles, role- and access-based control, review and approval of access requests, regular review of access rights, tracking and auditing of user activities, creation of security policies and procedures); Legal Bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR), Legal obligation (Art. 6(1), first sentence, lit. c) GDPR), Legitimate interests (Art. 6(1), first sentence, lit. f) of the GDPR).

• Special categories of personal data: Special categories of personal data are processed in the context of the employment relationship or to fulfill legal obligations. The special categories of personal data processed include data concerning employees’ health, union membership, or religious affiliation. This data may, for example, be disclosed to health insurance providers or processed to assess employees’ ability to work, for occupational health management, or for reporting to the tax authorities; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR), legal obligation (Art. 6(1), first sentence, lit. c) GDPR), legitimate interests (Art. 6(1), first sentence, lit. f) GDPR).

• Sources of the Processed Data: Personal data obtained in connection with the employee’s job application and/or employment relationship is processed. In addition, where required by law, personal data is collected from other sources. These may include tax authorities for tax-related information, the respective health insurance provider for information regarding incapacity to work, third parties such as employment agencies, or publicly accessible sources such as professional social networks in the context of application processes; Legal bases: Legal obligation (Art. 6(1), sentence 1, lit. c) of the GDPR), legitimate interests (Art. 6(1), sentence 1, lit. f) of the GDPR).

• Purposes of data processing: Employees’ personal data is primarily processed for the establishment, execution, and termination of the employment relationship. In addition, the processing of this data is necessary to fulfill legal obligations under tax and social security law. In addition to these primary purposes, employees’ data is also used to meet regulatory and supervisory requirements, to optimize electronic data processing procedures, and to compile internal or cross-company data, which may include statistical data. Furthermore, employees’ data may be processed to assert legal claims and to defend against legal disputes ; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), Legal obligation (Art. 6(1), sentence 1, lit. c) GDPR), Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).

• Disclosure of Employee Data: Employee data is processed internally only by those departments that require it to fulfill operational, contractual, and legal obligations. Data is disclosed to external recipients only if required by law or if the affected employees have given their consent. Possible scenarios for this include requests for information from government agencies or in the case of asset-building benefits. Furthermore, the data controller may transfer personal data to other recipients to the extent necessary to fulfill its contractual and legal obligations as an employer. These recipients may include: a) Banks b) health insurance providers, pension insurance providers, retirement plan providers, and other social insurance providers; c) government agencies, courts (e.g., tax authorities, labor courts, and other regulatory agencies in connection with the fulfillment of reporting and disclosure obligations); d) tax and legal advisors; e) third-party debtors in the event of wage garnishments; f) other entities to which legally required disclosures must be made. In addition, data may be disclosed to third parties if this is necessary for communication with business partners, suppliers, or other service providers. Examples include information in the “From” field of emails or letterhead, as well as the creation of profiles on external platforms; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR), legitimate interests (Art. 6(1), first sentence, lit. f) GDPR).

• Transfer of Employee Data to Third Countries: The transfer of employee data to third countries—that is, countries outside the European Union (EU) and the European Economic Area (EEA)—takes place only if it is necessary for the fulfillment of the employment relationship, required by law, or if employees have given their consent. Employees will be informed separately of the details, to the extent required by law; Legal basis: Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR).

• Business Travel and Travel Expense Reimbursement: Procedures necessary for the planning, execution, and settlement of business trips (e.g., booking travel, organizing accommodations and transportation, managing travel expense advances, submitting and reviewing travel expense reports, verifying and posting incurred costs, complying with travel policies, and handling travel expense management) ; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, letter b) of the GDPR), Legal obligation (Art. 6(1), first sentence, letter c) of the GDPR), Legitimate interests (Art. 6(1), first sentence, letter f) of the GDPR).

• Payroll processing and payroll accounting: Processes required for the calculation, payment, and documentation of employees’ wages, salaries, and other compensation (e.g., recording of working hours, calculation of deductions and premiums, withholding of taxes and social security contributions, preparation of pay stubs, maintenance of payroll accounts, reporting to tax authorities and social security agencies); Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, subparagraph b) of the GDPR), Legal obligation (Art. 6(1), sentence 1, letter c) of the GDPR).

• Deletion of employee data: Employee data is deleted in accordance with German law when it is no longer necessary for the purpose for which it was collected, unless they must be retained or archived due to legal obligations or the employer’s interests. In this regard, the following retention and archiving requirements are observed:

  • General personnel records—General personnel records (such as employment contracts, employment references, and supplementary agreements) are retained for up to three years after the termination of the employment relationship (Section 195 of the German Civil Code (BGB)) . Tax-related documents—Tax-related documents in the personnel file are retained for six years (Section 147 of the German Tax Code (AO), Section 257 of the German Commercial Code (HGB)). Information on wages and working hours—Information on wages and working hours for individuals covered by (accident) insurance, along with proof of wages, is retained for five years (Section 165(1)(1), (4)(2) of Book VII of the Social Code (SGB VII)) .

  • Payroll Lists, Including Lists for Special Payments - Payroll lists, including lists for special payments, provided that an accounting voucher exists, are retained for ten years (Section 147 AO, Section 257 HGB).

  • Payroll Lists for Interim, Final, and Special Payments - Payroll lists for interim, final, and special payments are retained for six years (Section 147 AO, § 257 HGB).

  • Employee insurance documents—Employee insurance documents, provided that accounting vouchers are available, are retained for ten years (§ 147 AO, § 257 HGB).

  • Contribution statements for social insurance agencies—Contribution statements for social insurance agencies are retained for ten years (§ 165 SGB VII) .Payroll records - Payroll records are retained for six years (Section 41(1)(9) of the Income Tax Act (EStG)).

  • Job applicant data - Retained for up to six months from receipt of the rejection notice.

  • Time records (for workdays exceeding 8 hours) - Retained for two years (Section 16(2) of the Working Hours Act (ArbZG)).

  • Job application documents (following an online job posting) — Are retained for three to a maximum of six months after receipt of the rejection notice (Section 26

  • Federal Data Protection Act (BDSG), as amended; Section 15(IV) of the General Equal Treatment Act (AGG)) .

  • Certificates of incapacity for work (AU)—Are retained for up to five years (Section 6(1) of the Expense Reimbursement Act (AAG)).

  • Documents related to company pension plans—Are retained for 30 years (Section 18a of the Act on the Improvement of Company Pension Plans (BetrAVG)).

  • Employee medical records—Retained for twelve months after the onset of the illness if absences do not exceed six weeks in a year.

  • Documents related to maternity leave—Retained for two years (Section 27(5) of the Maternity Protection Act (MuSchG)).

Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), legal obligation (Art. 6(1), sentence 1, lit. c) GDPR), Legitimate Interests (Art. 6(1), first sentence, lit. f) GDPR), processing of special categories of personal data relating to health, employment, and social security (Art. 9(2), lit. h) GDPR).

• Personnel record management: Procedures required for the organization, updating, and administration of employee data and documents (e.g., recording of employee master data, retention of employment contracts, references, and certificates, updating data in the event of changes, compiling documents for performance reviews, archiving personnel files, compliance with data protection regulations) ; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, subparagraph (b) of the GDPR), legal obligation (Art. 6(1), sentence 1, subparagraph (c) of the GDPR), legitimate interests (Art. 6(1), sentence 1, subparagraph (f) of the GDPR), processing of special categories of personal data relating to health, employment, and social security (Art. 9(2)(h) GDPR).

• Employee development, performance evaluation, and performance reviews: Procedures necessary for the promotion and further development of employees, as well as for the assessment of their performance and in the context of performance reviews (e.g., needs analysis for continuing education, planning and conducting training programs, preparing performance evaluations, conducting goal-setting and feedback meetings, career planning and talent management, succession planning); Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, subparagraph (b) of the GDPR), Legal obligation (Art. 6(1), sentence 1, subparagraph (c) of the GDPR) , legitimate interests (Art. 6(1), sentence 1, letter f) GDPR), processing of special categories of personal data relating to health, employment, and social security (Art. 9(2), letter h) GDPR).

• Obligation to Provide Data: The data controller informs employees that the provision of their data is required. This is generally the case when the data is necessary for the establishment and performance of the employment relationship or when its collection is required by law. The provision of data may also be required when employees assert claims or are entitled to claims. The implementation of these measures or the fulfillment of obligations depends on the provision of this data (for example, providing data for the purpose of receiving wages); Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, subparagraph b) of the GDPR), Legal obligation (Art. 6(1), sentence 1, letter c) GDPR), Legitimate interests (Art. 6(1), sentence 1, letter f) GDPR).

• Publication and Disclosure of Employee Data: Employee data will only be published or disclosed to third parties if this is necessary, on the one hand, for the performance of work duties in accordance with the employment contract. This applies, for example, when employees are named as contact persons in correspondence, on the website, or in public registries following consultation or an agreed-upon job description, or when their job responsibilities include representative functions. This may also be the case when, as part of their duties, they appear in public or communicate with the public, such as in photographs taken as part of public relations activities. Otherwise, employee data is published only with their consent or on the basis of the employer’s legitimate interests, for example, in the case of stage or group photographs taken during a public event; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR) , Legitimate Interests (Art. 6(1), first sentence, lit. f) GDPR).
  
   

Changes and Updates

​

We ask that you review the content of our Privacy Policy regularly. We will update the Privacy Policy as soon as changes to our data processing activities make this necessary. We will notify you as soon as the changes require action on your part (e.g., consent) or any other individual notification.

​

If we provide addresses and contact information for companies and organizations in this Privacy Policy, please note that these addresses may change over time, and we ask that you verify the information before contacting them.

​

​

Definitions of Terms

​

This section provides an overview of the terms used in this Privacy Policy.

 

To the extent that the terms are defined by law, their legal definitions apply. The explanations below, however, are primarily intended to aid understanding.

​

• Employees: Employees are defined as individuals who are in an employment relationship, whether as staff members, salaried employees, or in similar positions. An employment relationship is a legal relationship between an employer and an employee that is established by an employment contract or agreement. It includes the employer’s obligation to pay the employee compensation in exchange for the employee’s work. The employment relationship comprises various phases, including the establishment phase, during which the employment contract is concluded; the performance phase, during which the employee performs their work; and the termination phase, when the employment relationship ends, whether through termination, a mutual termination agreement, or otherwise. Employee data refers to all information relating to these individuals and pertaining to their employment. This includes aspects such as personal identification data, identification numbers, salary and bank details, working hours, vacation entitlements, health data, and performance evaluations.

• Master Data: Master data comprises essential information necessary for the identification and management of contractual partners, user accounts, profiles, and similar assignments. This data may include, among other things, personal and demographic details such as names, contact information (addresses, phone numbers, email addresses), dates of birth, and specific identifiers (user IDs). Master data forms the basis for any formal interaction between individuals and services, institutions, or systems by enabling unique assignment and communication.

• Content data: Content data includes information generated in the course of creating, editing, and publishing of all types of content. This category of data may include text, images, videos, audio files, and other multimedia content published on various platforms and media. Content data is not limited to the actual content itself but also includes metadata that provides information about the content itself, such as tags, descriptions, author information, and publication dates

• Contact data: Contact data is essential information that enables communication with individuals or organizations. It includes, among other things, phone numbers, mailing addresses, and email addresses, as well as communication channels such as social media handles and instant messaging identifiers.

• Performance and behavioral data: Performance and behavioral data refer to information related to how individuals perform tasks or behave in a specific context, such as in an educational, work, or social setting. This data may include metrics such as productivity, efficiency, work quality, attendance, and compliance with policies or procedures. Behavioral data could include interactions with colleagues, communication styles, decision-making processes, and reactions to various situations. These types of data are often used for performance evaluations, training and development initiatives, and decision-making within organizations.

• Meta-, communication, and procedural data: Meta-, communication, and procedural data are categories that contain information about how data is processed, transmitted, and managed. Meta-data, also known as data about data, includes information that describes the context, origin, and structure of other data. It may include details on file size, creation date, the author of a document, and revision histories. Communication data captures the exchange of information between users via various channels, such as email correspondence, call logs, social media messages, and chat histories—including the individuals involved, timestamps, and transmission channels. Procedural data describes the processes and workflows within systems or organizations, including workflow documentation, transaction and activity logs, as well as audit logs used to track and verify operations.

• Usage Data: Usage data refers to information that tracks how users interact with digital products, services, or platforms. This data encompasses a wide range of information that reveals how users utilize applications, which features they prefer, how long they stay on specific pages, and the paths they take when navigating through an application. Usage data may also include frequency of use, timestamps of activities, IP addresses, device information, and location data. It is particularly valuable for analyzing user behavior, optimizing user experiences, personalizing content, and improving products or services. In addition, usage data plays a crucial role in identifying trends, preferences, and potential problem areas within digital offerings

• Personal Data: “Personal data” refers to any information relating to an identified or identifiable natural person (hereinafter “data subject”); a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier (e.g., a cookie), or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

• Profiles containing user-related information: The processing of “profiles containing user-related information,” or “profiles” for short, encompasses any type of automated processing of personal data that consists of using such personal data to analyze, evaluate, or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include various information regarding demographics, behavior, and interests—such as interactions with websites and their content, etc.) or to predict them (e.g., interests in specific content or products, click behavior on a website, or location). Cookies and web beacons are frequently used for profiling purposes.

• Log data: Log data consists of information about events or activities that have been logged in a system or network. This data typically includes information such as timestamps, IP addresses, user actions, error messages, and other details regarding the use or operation of a system. Log data is often used to analyze system issues, monitor security, or generate performance reports.

• Audience measurement: Audience measurement (also known as web analytics) is used to evaluate visitor traffic to an online service and may include information about visitors’ behavior or interests regarding specific content, such as website content. With the help of audience analysis, operators of online services can, for example, determine at what times users visit their websites and what content interests them. This enables them, for example, to better tailor the content of their websites to the needs of their visitors. For the purposes of reach analysis, pseudonymous cookies and web beacons are frequently used to identify returning visitors and thus obtain more accurate analyses of the use of an online service.

• Data Controller: The “controller” refers to the natural or legal person, public authority, institution, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.

• Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and encompasses virtually any handling of data, whether it involves collection, evaluation, storage, transmission, or deletion.

• Contract Data: Contract data consists of specific information relating to the formalization of an agreement between two or more parties. It documents the terms under which services or products are provided, exchanged, or sold. This data category is essential for the administration and fulfillment of contractual obligations and includes both the identification of the contracting parties and the specific terms and conditions of the agreement. Contract data may include the start and end dates of the contract, the nature of the agreed-upon services or products, pricing agreements, payment terms, termination rights, renewal options, and special terms or clauses. They serve as the legal basis for the relationship between the parties and are crucial for clarifying rights and obligations, enforcing claims, and resolving disputes.

• Payment data: Payment data includes all information required to process payment transactions between buyers and sellers. This data is crucial for e-commerce, online banking, and any other form of financial transaction. It includes details such as credit card numbers, bank account information, payment amounts, transaction dates, verification codes, and billing information. Payment data may also include information about payment status, chargebacks, authorizations, and fees.

​

​