EINBLIQ.IO
← HomeLEGAL

Company information

Privacy Policy

Introduction

With the following data protection declaration, we would like to inform you about the types of your personal data (hereinafter also referred to as “data”) that we process, for what purposes and to what extent. The data protection declaration applies to all processing of personal data carried out by us, both in the context of the provision of our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offer”).

The terms used are not gender-specific.

Status: 31 October 2026

Content overview

Responsible entity

decover GmbH
Ligsalzstr. 36
80339 München
Germany

Authorised representatives: Sebastian Siepe, Ralf Neudel

E-mail address: team@einbliq.io.

Telephone: +49 89 9015 5865.

Imprint: Imprint

Contact Data Protection Officer

heyData GmbH
Schützenstraße 5
10117 Berlin
Germany

www.heydata.eu

datenschutz@heydata.eu

Overview of processing operations

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

  • Inventory data (e.g. names, addresses).

  • Content data (e.g. entries in online forms).

  • Contact data (e.g. e-mail, telephone numbers).

  • Meta/communication data (e.g. device information, IP addresses).

  • Usage data (e.g. websites visited, interest in content, access times).

  • Contract data (e.g. subject matter of contract, term, customer category).

  • Payment data (e.g. bank details, invoices, payment history).

Categories of data subjects

  • Employees (e.g. employees, applicants, former employees).

  • Business and contractual partners.

  • Interested parties.

  • Communication partners.

  • Customers.

  • Users (e.g. website visitors, users of online services).

Purposes of the processing

  • Provision of our online services and user friendliness.

  • Office and organisational procedures.

  • Direct marketing (e.g. by email or post).

  • Feedback (e.g. collecting feedback via online form).

  • Marketing.

  • Contact requests and communication.

  • Provision of contractual services and customer service.

  • Managing and responding to enquiries.

Security measures

We take appropriate technical and organisational measures in accordance with the law, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing, as well as the different probabilities of occurrence and the level of threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

The measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input of, disclosure of, assurance of availability of and segregation of the data. We also have procedures in place to ensure the exercise of data subjects’ rights and responses to data compromise. Furthermore, we already take the protection of personal data into account in the development or selection of hardware, software and procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

SSL encryption (https): In order to protect your data transmitted via our online offer, we use SSL encryption. You can recognise such encrypted connections by the prefix https:// in the address line of your browser.

Transmission of personal data

In the course of our processing of personal data, it may happen that the data is transmitted to other bodies, companies, legally independent organisational units or persons or that it is disclosed to them. The recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.

Data processing in third countries

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this will only be done in accordance with the legal requirements.

Subject to express consent or contractually or legally required transfer, we only process or have data processed in third countries with a recognised level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en).

Deletion of data

We retain personal data for as long as it is needed for the purposes described in this policy. Enquiry and booking correspondence is retained for as long as necessary to handle the enquiry or appointment and any resulting business relationship. Statutory retention obligations or the establishment, exercise or defence of specific legal claims may require longer retention.

Where data must be retained for these additional purposes, its processing is restricted to those purposes. Data that is no longer required and is not subject to a lawful retention requirement must be erased in accordance with applicable law. You can contact us to request erasure or restriction of processing, subject to the rights and exceptions described below.

Business services

We process data of our contractual and business partners, e.g. customers and interested parties (collectively referred to as “contractual partners”) in the context of contractual and comparable legal relationships as well as related measures and in the context of communication with contractual partners (or pre-contractual), e.g. to answer enquiries.

We process this data to fulfil our contractual obligations, to secure our rights and for the purposes of the administrative tasks associated with this information as well as for business organisation. Within the framework of applicable law, we only disclose the data of contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or for the fulfilment of legal obligations or with the consent of the persons concerned (e.g. to participating telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Contractual partners will be informed about further forms of processing, e.g. for marketing purposes, within the framework of this data protection declaration.

We inform the contractual partners which data is required for the aforementioned purposes before or in the course of data collection, e.g. in online forms, by means of special labelling (e.g. colours) or symbols (e.g. asterisks or similar), or in person.

For retention of business correspondence and related data, see Deletion of data. Any additional deletion requirements for data processed on behalf of a contractual partner depend on the agreed instructions and applicable legal obligations.

If we use third-party providers or platforms to provide our services, the terms and conditions and data protection notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.

Consulting: We process the data of our clients, customers as well as interested parties and other clients or contractual partners (uniformly referred to as “clients”) in order to be able to provide them with our consulting services. The data processed, the type, scope, purpose and necessity of its processing are determined by the underlying contractual and client relationship.

If it is necessary for the fulfilment of our contract, for the protection of vital interests or required by law, or if we have the consent of the client, we disclose or transfer the client’s data to third parties or agents, such as authorities, subcontractors or in the field of IT, office or comparable services, in compliance with the requirements of professional law.

Project and development services: We process the data of our customers and clients (hereinafter uniformly referred to as “customers”) in order to enable them to select, acquire or commission the selected services or works as well as related activities as well as their payment and provision or execution or performance.

The required information is identified as such in the context of the order, purchase order or comparable contract conclusion and includes the information required for the provision of services and billing as well as contact information in order to be able to hold any consultations. Insofar as we obtain access to information of the end customers, employees or other persons, we process this in accordance with the legal and contractual requirements.

Offering software and platform services: We process the data of our users, registered users and any test users (hereinafter uniformly referred to as “users”) in order to be able to provide our contractual services to them and on the basis of legitimate interests in order to be able to guarantee the security of our offer and to be able to develop it further. The required information is identified as such in the context of the conclusion of the order, purchase order or comparable contract and includes the information required for the provision of services and billing as well as contact information in order to be able to hold any consultations.

  • Types of data processed: inventory data (e.g. names, addresses), payment data (e.g. bank details, invoices, payment history), contact data (e.g. e-mail, telephone numbers), contract data (e.g. subject matter of contract, term, customer category).

  • Data subjects: Interested parties, business and contractual partners.

  • Purposes of processing: provision of contractual services and customer service, contact requests and communication, office and organisational procedures, administration and response to requests.

  • Legal basis: Contractual performance and pre-contractual enquiries (Art. 6 para. 1 p. 1 lit. b. GDPR), Legal obligation (Art. 6 para. 1 p. 1 lit. c. GDPR), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

Provision of the online offer and web hosting

In order to provide our online offer securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online offer can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services as well as security services and technical maintenance services.

The data processed in the course of providing the hosting service may include all information relating to the users of our online service that is generated in the course of use and communication. This regularly includes the IP address, which is necessary to be able to deliver the contents of online offers to browsers, and all entries made within our online offer or from websites.

E-mail dispatch and hosting: The web hosting services we use also include the dispatch, receipt and storage of e-mails. For these purposes, the addresses of the recipients and senders as well as further information regarding the e-mail dispatch (e.g. the providers involved) and the contents of the respective e-mails are processed. The aforementioned data may also be processed for the purpose of recognising SPAM. Please note that e-mails on the Internet are generally not sent in encrypted form. As a rule, e-mails are encrypted in transit, but (unless a so-called end-to-end encryption procedure is used) not on the servers from which they are sent and received. We can therefore not assume any responsibility for the transmission path of the e-mails between the sender and the reception on our server.

Collection of access data and log files: We ourselves (or our web hosting provider) collect data on every access to the server (so-called server log files). The server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.

The server log files may be used, on the one hand, for security purposes, e.g. to avoid overloading the servers (especially in the event of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure the utilisation of the servers and their stability.

Aggregated website and shortlink statistics: We use hosting access logs to count requests to known pages by day and to review 404 responses. We also count eligible shortlink requests as daily totals per link. The statistics store only aggregated counts; they do not retain IP addresses, visitor identifiers, complete user agents, individual browsing paths or query parameters. Unknown 404 paths are grouped together. The hosting access logs described above remain separate and may contain connection data. No additional analytics cookies, browser storage or tracking scripts are used for these statistics. Cached requests may not appear in the hosting logs.

  • Types of data processed: Content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).

  • Data subjects: Users (e.g. website visitors, users of online services).

  • Purposes of processing: Provision of our online offer and user-friendliness.

  • Legal grounds: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

Services used and service providers:

Contact form and newsletter interest

When you use our contact form, we process your name, email address, optional company and message to respond to your enquiry. Valid submissions from the form hosted by Gandi are sent via Microsoft Graph to our shared Microsoft 365 mailbox at team@einbliq.io, where they are processed as business correspondence. We do not maintain an additional database of contact messages on the website. We use your email address as the reply-to address and do not send automatic acknowledgement emails.

The legal basis is Art. 6(1)(b) GDPR for enquiries about a contract or pre-contractual steps and Art. 6(1)(f) GDPR for other enquiries, based on our interest in responding to communications. For retention of this correspondence, see Deletion of data.

Optional newsletter interest: Contact processing is independent of the optional newsletter checkbox. If selected, we record your interest, the displayed consent wording and its version, a server-recorded UTC timestamp and the form path with the enquiry in our mailbox. No additional IP address is included as newsletter evidence. This records interest pending confirmation; it is not a confirmed subscription or authorisation to send newsletters. No mailing list, newsletter provider or automatic confirmation email is activated by this checkbox. Any later newsletter subscription will require a separate confirmation process. You can withdraw your recorded interest by emailing team@einbliq.io without affecting our handling of your enquiry. The basis for this optional record is your consent under Art. 6(1)(a) GDPR.

Protection against abusive sending: We use a honeypot and server-side limits. The limiter stores only keyed pseudonyms of client IP addresses with attempt times used for a 15-minute rate-limit window, separately from unlinked global attempt times used for a 24-hour window. Expired records are removed on requests and by an hourly maintenance task, including during periods without submissions. This cleanup applies only to limiter records, not to correspondence. No message contents, email addresses, raw IP addresses, tokens or secrets are stored in the limiter or application logs. This security processing is based on Art. 6(1)(f) GDPR, our interest in preventing misuse and protecting the availability of the service. The hosting access logs described above remain separate.

Microsoft 365 processing and provider information are described under Cloud services. Form submissions are not sent to Microsoft until they pass the server-side sending controls.

Booking a meeting with Calendly

When you choose “Book a demo”, our /meet link redirects your browser to an external Calendly booking page. You leave our website; we do not embed a Calendly booking component here. When that page opens, Calendly receives connection data such as your IP address, browser and device information, and access time. Its use of cookies and similar technologies is explained in its Privacy Notice.

To book a meeting, you provide details such as your name, email address, selected appointment, time zone and any further information you enter in the booking form. We use these details and the related correspondence to arrange, prepare and conduct the requested meeting. The legal basis for our processing is Art. 6(1)(b) GDPR for pre-contractual enquiries and Art. 6(1)(f) GDPR for other requests, based on our legitimate interest in organising meetings and responding to enquiries. For retention of our booking correspondence, see Deletion of data.

The provider is Calendly LLC, USA. Data may be processed in the United States and other countries outside the EU/EEA. Calendly’s Data Processing Addendum (DPA) describes its processing on behalf of customers and the safeguards for international transfers. It provides for reliance on the applicable Data Privacy Framework and EU Standard Contractual Clauses as a fallback under the conditions stated there. Calendly’s Privacy Notice explains its own processing, including connection data and international transfers. See also Data processing in third countries.

Communication via messenger

We use messengers for communication purposes and therefore ask you to observe the following information on the functioning of the messengers, on encryption, on the use of the metadata of the communication and on your objection options.

You can also contact us in alternative ways, e.g. via telephone or e-mail. Please use the contact options provided to you or the contact options provided within our online offer.

In the case of end-to-end encryption of content (i.e., the content of your message and attachments), we point out that the communication content (i.e., the content of the message and attached images) is encrypted from end to end. This means that the content of the messages cannot be viewed, not even by the messenger providers themselves. You should always use a current version of the messenger with encryption enabled to ensure that the message content is encrypted.

However, we also point out to our communication partners that although the messenger providers cannot view the content, they can find out that and when communication partners communicate with us, as well as technical information on the device used by the communication partners and, depending on the settings of their device, also location information (so-called metadata) is processed.

Notes on legal basis: If we ask communication partners for permission before communicating with them via Messenger, the legal basis for our processing of their data is their consent. Otherwise, if we do not ask for consent and they contact us of their own accord, for example, we use Messenger in relation to our contractual partners and in the context of contract initiation as a contractual measure and, in the case of other interested parties and communication partners, on the basis of our legitimate interests in fast and efficient communication and meeting the needs of our communication partners in communication via Messenger. Furthermore, we would like to point out that we do not transmit the contact data provided to us to the messengers for the first time without your consent.

Revocation, objection and deletion: You can revoke your consent at any time and object to communication with us via Messenger at any time. For retention of this correspondence, see Deletion of data.

Reservation of reference to other communication channels: Finally, we would like to point out that, for reasons of your security, we reserve the right not to answer enquiries via Messenger. This is the case if, for example, contractual internals require special confidentiality or an answer via Messenger does not meet formal requirements. In such cases, we will refer you to more adequate communication channels.

  • Types of data processed: contact data (e.g. e-mail, telephone numbers), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses), content data (e.g. entries in online forms).

  • Data subjects: Communication partners.

  • Purposes of processing: contact requests and communication, direct marketing (e.g. by e-mail or mail).

  • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. GDPR), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

Services used and service providers:

Video conferencing, online meetings, webinars and screen sharing

We use platforms and applications from other providers (hereinafter referred to as “conferencing platforms”) for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as “conference”). When selecting the conferencing platforms and their services, we comply with the legal requirements.

Data processed by conference platforms: In the context of participation in a conference, the conference platforms process the personal data of the participants mentioned below. The scope of the processing depends on the one hand on which data is requested in the context of a specific conference (e.g. provision of access data or clear names) and on the other hand on which optional information is provided by the participants. In addition to processing for the purpose of conducting the conference, participants’ data may also be processed by the conference platforms for security purposes or service optimisation. The data processed includes personal data (first name, surname), contact information (e-mail address, telephone number), access data (access codes or passwords), profile pictures, information on professional position/function, the IP address of the Internet access, information on the participants’ end devices, their operating system, the browser and its technical and linguistic settings, information on the content of the communications, i.e. entries in chats and audio and video data, as well as the use of other available functions (e.g. surveys). The content of the communications is encrypted to the extent technically provided by the conference providers. If participants are registered as users with the conference platforms, then further data may be processed in accordance with the agreement with the respective conference provider.

Logging and recordings: If text entries, participation results (e.g. from surveys) as well as video or audio recordings are logged, this will be transparently communicated to the participants in advance and they will be asked for consent – if necessary.

Data protection measures of the participants: Please note the details of the processing of your data by the conference platforms in their data protection notices and select the optimal security and data protection settings for you within the framework of the settings of the conference platforms. Furthermore, please ensure data and privacy protection in the background of your recording for the duration of a videoconference (e.g. by notifying fellow participants, locking doors and using the function to make the background unrecognisable, if technically possible). Links to the conference rooms and access data may not be passed on to unauthorised third parties.

Notes on legal bases: If, in addition to the conference platforms, we also process users’ data and ask users for their consent to use the conference platforms or certain functions (e.g. consent to a recording of conferences), the legal basis of the processing is this consent. Furthermore, our processing may be necessary for the fulfilment of our contractual obligations (e.g. in participant lists, in the case of processing of conference results, etc.). Otherwise, user data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.

  • Types of data processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).

  • Data subjects: Communication partners, users (e.g. website visitors, users of online services).

  • Purposes of processing: provision of contractual services and customer service, contact requests and communication, office and organisational procedures.

  • Legal bases: Consent (Art. 6 para. 1 p. 1 lit. a. GDPR), Contractual performance and pre-contractual enquiries (Art. 6 para. 1 p. 1 lit. b. GDPR), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

Services used and service providers:

Cloud services

We use software services accessible via the internet and running on their providers’ servers (so-called “cloud services”, also referred to as “software as a service”) for the following purposes: document storage and management, calendar management, emailing, spreadsheets and presentations, exchanging documents, content and information with specific recipients or publishing web pages, forms or other content and information, as well as chats and participation in audio and video conferences.

This includes the Microsoft 365 mailbox used for enquiries described under Contact form and newsletter interest.

In this context, personal data may be processed and stored on the servers of the providers to the extent that these are part of communication processes with us or are otherwise processed by us as set out in the context of this privacy policy. This data may include, in particular, master data and contact data of users, data on transactions, contracts, other processes and their contents. The cloud service providers also process usage data and metadata used by them for security purposes and service optimisation.

If we use the cloud services to provide forms or other documents and content to other users or publicly accessible websites, the providers may store cookies on the users’ devices for the purpose of web analysis or to remember the users’ settings (e.g. in the case of media control).

Notes on legal bases: Where we ask for consent to use cloud services, the legal basis for processing is consent. Furthermore, their use may be a component of our (pre)contractual services, provided that the use of the cloud services has been agreed within this framework. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient and secure management and collaboration processes).

  • Types of data processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).

  • Data subjects: Customers, employees (e.g. employees, applicants, former employees), prospective customers, communication partners.

  • Purposes of processing: Office and organisational procedures, provision of our SaaS offering einbliq.io.

  • Legal grounds: Consent (Art. 6 para. 1 p. 1 lit. a. GDPR), Contract performance and pre-contractual enquiries (Art. 6 para. 1 p. 1 lit. b. GDPR), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

Services used and service providers:

Presence in social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with users active there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This may result in risks for the users because, for example, it could make it more difficult to enforce the rights of the users.

Furthermore, user data within social networks is usually processed for market research and advertising purposes. For example, usage profiles can be created based on the usage behaviour and resulting interests of the users. The usage profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users’ computers, in which the usage behaviour and the interests of the users are stored. Furthermore, data independent of the devices used by the users may also be stored in the usage profiles (especially if the users are members of the respective platforms and are logged in to them).

For a detailed presentation of the respective forms of processing and the options to object (opt-out), we refer to the data protection declarations and information provided by the operators of the respective networks.

In the case of requests for information and the assertion of data subject rights, we would also like to point out that these can be asserted most effectively with the providers. Only the providers have access to the users’ data and can take appropriate measures and provide information directly. If you still need help, you can contact us.

  • Types of data processed: contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).

  • Data subjects: Users (e.g. website visitors, users of online services).

  • Purposes of processing: contact requests and communication, feedback (e.g. collecting feedback via online form), marketing.

  • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

Services used and service providers:

Management, organisation and auxiliary tools

We use services, platforms and software from other providers (hereinafter referred to as “third-party providers”) for the purposes of organising, managing, planning and providing our services. When selecting the third-party providers and their services, we observe the legal requirements.

In this context, personal data may be processed and stored on the servers of the third-party providers. This may involve various data which we process in accordance with this data protection declaration. This data may include, in particular, master data and contact data of users, data on transactions, contracts, other processes and their contents.

If users are referred to the third-party providers or their software or platforms in the course of communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, service optimisation or marketing purposes. We therefore ask you to observe the data protection notices of the respective third-party providers.

Notes on legal basis: If we ask users for their consent to use the third-party providers, the legal basis for processing data is consent. Furthermore, their use may be a component of our (pre-)contractual services, provided that the use of the third-party providers was agreed within this framework. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

  • Types of data processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).

  • Data subjects: Communication partners, users (e.g. website visitors, users of online services).

  • Purposes of processing: Office and organisational procedures.

  • Legal grounds: Consent (Art. 6 para. 1 p. 1 lit. a. GDPR), Contract performance and pre-contractual enquiries (Art. 6 para. 1 p. 1 lit. b. GDPR), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. GDPR).

For appointment scheduling, see Booking a meeting with Calendly.

Job Applications and Recruitment

We use services, platforms, and software from external providers to facilitate and manage job applications (hereinafter referred to as “third-party providers”). In doing so, we observe the applicable legal requirements.

In this context, personal data may be processed and stored on the servers of the third-party providers. This data may include, in particular, personal details provided by applicants, contact information, and application-related documents.

If applicants are redirected to third-party providers during the application process, these providers may process usage data and metadata for security purposes, service optimization, or marketing. We encourage you to review the data protection policies of these third-party providers.

Notes on legal basis: The legal basis for processing personal data in connection with job applications is Art. 88 GDPR in conjunction with Section 26 BDSG and Art. 6 (1) (b) GDPR for the initiation of contractual relationships. If an employment relationship is established, we will continue processing personal data for employment purposes. If applicants provide explicit consent for extended storage in our applicant tool, this extends the processing period accordingly. Any consent given can be revoked at any time, with effect for the future, by notifying us.

Types of data processed: Inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. application documents, resumes, cover letters), meta/communication data (e.g. device information, IP addresses).

Data subjects: Applicants.

Purposes of processing: Processing job applications, managing recruitment processes, and evaluating candidates.

Legal grounds: Art. 88 GDPR in conjunction with Section 26 BDSG, Contract performance and pre-contractual enquiries (Art. 6 para. 1 p. 1 lit. b. GDPR), Consent (Art. 6 para. 1 p. 1 lit. a. GDPR).

Data retention: Application data is retained for as long as needed for the recruitment process and any applicable legal obligations or specific legal claims. Further retention for future opportunities depends on the applicant’s consent.

Services used and service providers:

Changing and updating the privacy policy

We encourage you to periodically review the content of our Privacy Policy. We adapt the data protection declaration as soon as the changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

If we provide addresses and contact information of companies and organisations in this data protection declaration, please note that the addresses may change over time and please check the information before contacting us.

Rights of the data subjects

As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

  • Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing.

  • Right to withdraw consent: You have the right to revoke any consent given at any time.

  • Right to information: You have the right to request confirmation as to whether data in question is being processed and to information about this data as well as further information and a copy of the data in accordance with the legal requirements.

  • Right to rectification: You have the right, in accordance with the law, to request that data concerning you be completed or that inaccurate data concerning you be rectified.

  • Right to erasure and restriction of processing: You have the right, in accordance with the law, to request that data concerning you be erased without delay or, alternatively, to request restriction of the processing of the data in accordance with the law.

  • Right to data portability: You have the right to receive data relating to you that you have provided to us in a structured, common and machine-readable format, or to request that it be transferred to another controller, in accordance with the law.

  • Complaint to supervisory authority: In accordance with the law and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State where you usually reside, the supervisory authority of your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Definitions

This section provides you with an overview of the terms used in this privacy notice. Many of the terms are taken from the law and defined primarily in Article 4 of the GDPR. The legal definitions are binding. The following explanations, on the other hand, are primarily intended to help you understand them. The terms are sorted alphabetically.

  • Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

  • Responsible contact: “Responsible contact” means the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data.

  • Processing: “Processing” means any operation or set of operations which is performed upon personal data, whether or not by automatic means. The term is broad and encompasses virtually any handling of data, be it collection, analysis, storage, transmission or erasure.