Processing of (personal) data by the entity in charge of the online application process
I. Introduction and Definitions
1. GENERAL
With the operation of our website at the URL https://pcg.io (hereinafter referred to as the "Website"), we process personal data. These data are treated confidentially by us and processed in accordance with applicable laws – in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications Digital Services Data Protection Act (TDDDG). With this Privacy Policy, we aim to inform you about the personal data we collect from you, the purposes and legal bases for which we use them, and, where applicable, to whom we disclose them. Furthermore, we will explain the rights you have to protect and enforce your data privacy.
2. DEFINITIONS
Our Privacy Policy contains technical terms found in the GDPR and the BDSG. For your better understanding, we would like to explain these terms in simple words beforehand:
2.1 Personal Data
"Personal data" means any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR). Information relating to an identified person may include, for example, their name or email address. However, data where identity is not immediately obvious, but can be determined by combining one's own or third-party information, are also personal data. A person becomes identifiable, for example, through information such as their address, bank details, date of birth, username, IP address, and/or location data. Relevant here is any information that in any way allows conclusions to be drawn about a person.
2.2 Processing
Under Art. 4 No. 2 GDPR, "processing" means any operation performed in connection with personal data. This particularly includes collecting, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of personal data.
II. Controller and Data Protection Officer
3. CONTROLLER
The controller responsible for data processing is:
Company: Public Cloud Group GmbH ("we")
Legal Representative: Thorsten Raquet (Managing Director)
Address: Lise-Meitner-Straße 3-1, 89081 Ulm, Germany
Phone: +49-731-7255-7400
Email: hello@pcg.io
4. DATA PROTECTION OFFICER
We have appointed an external Data Protection Officer for our company. You can reach them at:
Company: HABEWI GmbH & Co. KG
Legal Representative: General Partner HABEWI Beteiligungs GmbH, represented by Arne Platzbecker (Managing Director)
Address: Palmaille 96, 22767 Hamburg, Germany
Phone: +49 (0)40 46008966
Fax: +49 (0)40 46008977
Email: datenschutz@habewi.de
III. Scope of Processing
5. SCOPE OF PROCESSING: WEBSITE
Within the scope of the website, we process your personal data as detailed below in Section IV. We only process data from you that you actively provide on the website (e.g. by filling out forms) or that you automatically make available when using our services.
Your data will be processed exclusively by us and will generally not be sold, rented, or passed on to third parties. If we utilize the assistance of external service providers to process your personal data, this is done within the framework of so-called data processing on behalf of a controller (data processing agreement), where we as the controller retain authority to issue instructions to our service providers. To operate our website, we use external service providers for hosting. We host our website with the external provider Raidboxes GmbH, Hafenstraße 32, 48153 Münster, Germany, at the data center location in Frankfurt am Main. Further information on data protection at Raidboxes can be found at https://raidboxes.io/legal/privacy/. If additional external service providers are used for individual processing operations listed in Section IV, they will be specified there.
Data transfer to third countries generally does not take place and is not planned. We will inform you about any exceptions to this principle in the processing operations described below. Any data transfer to third countries will then take place on the basis of the EU-U.S. Data Privacy Framework (https://www.dataprivacyframework.gov/) or the EU Standard Contractual Clauses.
IV. Detailed Processing Operations
6. PROVISION OF THE WEBSITE AND SERVER LOG FILES
6.1 Description of Processing
Whenever you access the website, our hosting provider Raidboxes automatically collects information transmitted by your browser to our server. This includes the following data:
Hostname (IP address)
Browser software used
Operating system
The website from which visitors reached our site (referrer)
These are also stored in the log files of our system. The temporary storage of your IP address by the system is necessary to deliver our website to the user's terminal device. For this purpose, the user's IP address must remain stored for the duration of the session. However, your IP address is not stored in the log files.
6.2 Purpose
Processing takes place to enable access to the website and to ensure its stability and security. Furthermore, processing serves statistical evaluations and the improvement of our online presence.
6.3 Legal Basis
Processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in Section 6.2.
6.4 Storage Duration
The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the case of data collection for providing the website, this applies when the respective session has ended. Log files are deleted after 7 days.
7. COOKIES AND OTHER TRACKING TECHNOLOGIES
7.1 Description of Processing
Our website uses cookies. Cookies are small text files stored on the user's terminal device when visiting a website. Cookies contain information that enables recognition of a terminal device and, if applicable, certain functionalities of a website. We distinguish between our own cookies and external, so-called third-party cookies. On our site, "Session Cookies" and "Persistent Cookies" are used. "Session Cookies" are automatically deleted when you end your internet session and close the browser. Persistent cookies remain stored on your device for a longer period.
In addition to cookies, we also use other tracking technologies, such as pixels or fingerprinting. If cookies are technically necessary for the operation of our site, your consent is not required. All other cookies and tracking technologies that are not technically necessary are only set after you have actively consented to their use via our consent tool. To obtain and document consents, we use the "Cookiebot" service operated by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark. The consent tool stores your choice in a cookie on your terminal device, eliminating the need to decide on cookies again during subsequent visits.
You can check which cookies are used on our website for what purpose, how long they are stored on your device, and what consents you may have already declared in the settings of the Cookiebot consent tool located at the bottom left of the screen.
7.2 Purpose
We use cookies/tracking technologies to make our website more user-friendly and to provide the functions described in Section 7.1.
7.3 Legal Basis
With regard to technically necessary cookies and the use of the consent tool, processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6(1)(f) GDPR in conjunction with Sec. 25(2) TDDDG). Our legitimate interest lies in the purpose specified in Section 7.2. For processing regarding all other non-technically necessary cookies/tracking technologies, the legal basis is consent (Art. 6(1)(a) GDPR in conjunction with Sec. 25(1) TDDDG). Giving such consent is voluntary.
7.4 Storage Duration, Withdrawal of Consent
Cookies are automatically deleted at the end of a session or upon expiry of the specified storage period. Since cookies are stored on your device, you as a user have full control over their use. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Already stored cookies can be deleted at any time, including automatically. If cookies/tracking technologies are disabled, deleted, or restricted for our website, individual functions of our website may not be usable or may only be used to a limited extent. You can withdraw any consent given for the use of cookies at any time with effect for the future in the settings of the Cookiebot consent tool at the bottom left of the screen.
7.5 Recipients
When using cookies/tracking technologies, data may be transmitted to the respective providers of these third-party services. Under certain circumstances, data may also be transferred to third countries outside the European Union or the European Economic Area. We provide information about recipients and third-country transfers in the settings of the consent tool or in the relevant paragraph on third-party services in this Privacy Policy. Where applicable, personal data may also be transmitted to the provider of the consent tool "Cookiebot" – Cybot A/S.
8. CONTACT FORM AND EMAIL CONTACT
8.1 Description of Processing
We have provided a contact form on our website. In this form, you are asked to enter your email address, first name, last name, and a message to us. When you click the "Submit" button, the data are transmitted to us using SSL encryption (see Section 27). The contact form can only be sent if you confirm that you have read this Privacy Policy by clicking the corresponding checkbox. A second checkbox gives you the option to subscribe to our newsletter (see Section 9). You can also contact us via the email addresses provided on the website. In this case, the personal data transmitted with the email will be processed by us.
8.2 Purpose
By providing a contact form on our website, we aim to offer you a convenient way to get in touch with us. The data transmitted with and in the contact form or your email will be used exclusively for processing and answering your request.
8.3 Legal Basis
Processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in Section 8.2. If the email contact aims at concluding or performing a contract, data processing is carried out for performance of a contract (Art. 6(1)(b) GDPR).
8.4 Storage Duration
The data will be erased by us as soon as they are no longer required to achieve the purpose for which they were collected. This is usually the case when communication with you has ended. Communication is deemed ended when it can be inferred from the circumstances that your request has been conclusively clarified. If statutory retention periods prevent deletion, erasure will take place immediately after expiry of the statutory retention period.
8.5 Recipients and Third-Country Transfers
To implement the contact form, we use the services of HubSpot (see Section 22). This is done as part of data processing on behalf of a controller. By using HubSpot, personal data are transmitted to HubSpot, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland. HubSpot also processes your personal data in the USA, where applicable through its parent company HubSpot Inc., 25 First Street, Cambridge, MA 02141, USA. Data transfer to the USA takes place on the basis of the EU-U.S. Data Privacy Framework (https://www.dataprivacyframework.gov/). Further information on data protection at HubSpot can be found at https://legal.hubspot.com/privacy-policy.
9. NEWSLETTER
9.1 Description of Processing
We send out a newsletter at irregular intervals to inform you about offers and promotions. You will only receive our newsletter if you actively sign up for our mailing list by completing and submitting a newsletter registration form on our website. Furthermore, our contact forms (see Section 8) offer an additional checkbox to subscribe to the newsletter.
Only your email address is required to register for the newsletter. Any additional information (such as your first and last name) is voluntary and serves solely to personalize the emails. To carry out and verify newsletter subscriptions, we use the double opt-in procedure. Registration takes place in several steps. First, you sign up for the newsletter on our website. You will then receive an email from us at the address provided, asking you to confirm that you actually signed up for the newsletter and wish to receive it. Confirmation is made by clicking a link contained in the email. Only after successful confirmation will we add you to our newsletter mailing list and send you emails in the future. As part of the double opt-in procedure, we store the date, time, and your IP address both during registration and confirmation.
If you purchase goods or services on our website and provide your email address, it may subsequently be used by us to send an existing customer newsletter. In such a case, the newsletter will exclusively carry direct advertising for our own similar goods or services.
9.2 Purpose
Processing takes place to offer the newsletter function and send newsletter emails to subscribers and existing customers. The collection and storage of date, time, and IP addresses during registration serve to document consent given and to protect against misuse of email addresses.
9.3 Legal Basis
Processing for our subscriber newsletter takes place on the basis of consent pursuant to Art. 6(1)(a) GDPR. You can retrieve the declaration of consent on our website at any time at https://hs.pcg.io/de/pcg-newsletter-registration. Giving consent is voluntary. The collection and storage of date, time, and IP addresses during newsletter registration are necessary to safeguard the overriding legitimate interests of the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in Section 9.2.
Processing for our existing customer newsletter takes place on the basis of Art. 6(1)(f) GDPR to safeguard the overriding interests of the controller. Our legitimate interest lies in direct marketing to existing customers, which is permissible within the framework observed by us under Sec. 7(3) UWG (German Unfair Competition Act).
9.4 Storage Duration and Withdrawal of Consent
If you do not confirm your registration for our newsletter within 24 hours of receiving the registration email, your data will be deleted automatically. Otherwise, we process your personal data for the duration of your newsletter subscription. You can cancel your newsletter subscription at any time by withdrawing your consent. You can also object to the use of your email address for sending our existing customer newsletter at any time. A simple statement suffices (by email to hello@pcg.io or by post to Public Cloud Group GmbH, Lise-Meitner-Straße 3-1, 89081 Ulm, Germany). Unsubscribing from the newsletter is also possible by clicking the unsubscribe link present in every newsletter email. Upon withdrawal of consent, no further newsletters will be sent to you, and your personal data will be removed from our active mailing list.
9.5 Recipients and Third-Country Transfers
To manage our newsletter mailing list and send emails, we use the services of the newsletter provider HubSpot (see Section 22). This is done as part of data processing on behalf of a controller. By using HubSpot, personal data are transmitted to HubSpot, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland. HubSpot also processes your personal data in the USA, where applicable through its parent company HubSpot Inc., 25 First Street, Cambridge, MA 02141, USA. Data transfer to the USA takes place on the basis of the EU-U.S. Data Privacy Framework (https://www.dataprivacyframework.gov/). Further information on data protection at HubSpot can be found at https://legal.hubspot.com/privacy-policy.
10. SOCIAL NETWORKS
10.1 Description of Processing
Our website does not use social media plugins. The logos of Facebook, Instagram, and LinkedIn displayed on our website are merely linked to our company's respective profiles on those social networks. No data transmission to social networks takes place simply by integrating these logos. If you click one of the logos, you will merely be redirected to the external website of the respective social network.
However, our profiles within social networks do constitute data processing. If you are logged into your user account on the respective social network when visiting such a profile, this information will be assigned to your account. If you interact with our profile, e.g. comment on, "share", "like", or "retweet" a post, this information will also be stored in your user account. Your interactions with our profile are generally visible to us.
On the social networks Facebook and Instagram, we have the ability to receive statistical data regarding the use of our Facebook page or Instagram profile via the so-called "Insights" function. These statistics are provided by Facebook and Instagram. The "Insights" function is mandatory; we cannot decide to turn this function on or off. It is available to all Facebook fan page operators and Instagram business account operators, regardless of whether they use the Insights function or not.
Facebook Insights provides us with anonymous data over selectable time periods regarding fans, subscribers, reached individuals, and interacting individuals: total page views, "likes" including origin, page activity, post interactions, reach, post reach (divided into organic, viral, and paid interactions), comments, shared content, replies, and demographic evaluations (country of origin, gender, age). With Insights statistics, it is impossible for us to identify individual subscribers or fans of our page or view their profiles.
Furthermore, Instagram Insights provides us with anonymous data on the development and reach of our Instagram profile and the posts, stories, and videos published there. We also receive statistical information on the origin, gender, and age of our Instagram profile subscribers.
The social networks with which you communicate store your data using pseudonyms as usage profiles and use them for advertising and market research purposes. For example, advertisements matching your presumed interests may be displayed within the social network and on third-party websites. For this purpose, cookies are typically placed on your terminal device by the social network. You have a right to object to the creation of these user profiles; to exercise this right, you must contact the social networks directly.
10.2 Purpose
We maintain profiles on the aforementioned social networks for public relations and corporate communication with customers and interested parties. We use the "Insights" function of Facebook and Instagram to evaluate the reach of our posts on the social network and to design them more attractively for visitors in the future.
10.3 Legal Basis
The legal basis for data processing within the scope of our profiles on social networks is the safeguarding of our overriding legitimate interests (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in Section 10.2. If you are asked for consent by the respective operator of a social network, the legal basis is Art. 6(1)(a) GDPR. Data processing regarding our presence on Facebook, Instagram, and LinkedIn is otherwise based on joint controller responsibility pursuant to Art. 26 GDPR.
10.4 Recipients and Third-Country Transfers
The respective social networks are operated by the companies listed below. Further information on data protection regarding our profile on social networks can be found in the linked privacy policies:
Facebook: Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA or Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Privacy policies: www.facebook.com/policy.php; www.facebook.com/help/186325668085084, www.facebook.com/about/privacy/your-info-on-other#applications as well as www.facebook.com/about/privacy/your-info#everyoneinfo.
Instagram: Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA or Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland; Privacy policy: help.instagram.com/155833707900388/.
LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Privacy policy: www.linkedin.com/legal/privacy-policy. The data processing agreement with LinkedIn can be found at www.linkedin.com/legal/l/dpa. The agreement on joint responsibility can be viewed at legal.linkedin.com/pages-joint-controller-addendum.
The social networks also process your personal data in the USA.
11. GOOGLE ANALYTICS
11.1 Description of Processing
Our website uses "Google Analytics 4", a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as "Google"). Google Analytics 4 uses cookies (see Section 7) that enable an analysis of your use of our offer. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. Google Analytics 4 uses IP anonymization by default, which means your IP address is truncated by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. The IP address transmitted by your browser as part of Google Analytics 4 will not be merged with other Google data. Google Analytics 4 records information about your interactions with our website, including pages visited, length of stay, devices used, operating system, browser, approximate geographic origin, and how you arrived at our website. Google Analytics 4 creates event-based analytics and can capture user journey data. Google Analytics Terms of Service can be found at www.google.com/analytics/terms/us.html. An overview of data privacy at Google Analytics is available at support.google.com/analytics/topic/2919631. Google's privacy policy can be viewed at policies.google.com/privacy.
11.2 Purpose
Processing takes place to evaluate the use of our website. The information obtained serves to improve and tailor our online presence to user needs.
11.3 Legal Basis
Processing takes place on the basis of consent pursuant to Art. 6(1)(a) GDPR. This is obtained by us via the consent tool (see Section 7.1). Giving such consent is voluntary.
11.4 Storage Duration, Right to Object, and Withdrawal of Consent
Storage duration, as well as your control and setting options for cookies, are explained in Section 7.4. You can withdraw your consent regarding Google Analytics at any time with effect for the future in the settings of the consent tool. Alternatively, you can object to data processing by Google Analytics at any time by downloading and installing the browser add-on offered by Google at tools.google.com/dlpage/gaoptout. Analytics data processed and stored with Google Analytics will be automatically deleted by us after 14 months.
11.5 Recipients and Third-Country Transfers
According to German data protection supervisory authorities (Datenschutzkonferenz), Google Analytics acts under joint controller responsibility with us for data processing. In light of this, we have concluded the "Google Measurement Controller-Controller Data Protection Terms" with Google. Google also processes your personal data in the USA.
12. FONT REPLACEMENT
When displaying our website, default fonts on your device are replaced with specific typefaces to present the text on our website in a more readable and aesthetically pleasing manner. For font replacement, we have chosen a privacy-friendly solution: we do not integrate external services, such as Google Fonts or Adobe Fonts. Instead, we store the replacement fonts locally on our server. This offers the advantage that accessing our site generates no request from your browser to external font services, ensuring no data – particularly your IP address in connection with our website address – is transmitted to third parties.
13. YOUTUBE
13.1 Description of Processing
Our website uses services from "YouTube", a video platform operated by YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA (hereinafter referred to as "YouTube"). YouTube is represented by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We use YouTube by embedding individual videos from the platform on our website as an iFrame, allowing them to be played directly on our site. Videos are embedded using YouTube's "enhanced privacy mode", meaning no personal data are transferred from you to Google as long as you do not play the videos. Only when you play a video is data transferred to Google, over which we have no influence. When you play an embedded video on a subpage of our website, information about which subpage you visited and which video you watched is transmitted to Google. Your IP address may also be transmitted to Google. If you are logged into YouTube or Google as a user, Google assigns this information to your account. Google stores your data as usage profiles and uses them for advertising, market research, and/or demand-oriented design of Google websites. You have a right to object to the creation of these user profiles; to exercise this right, you must contact Google directly. Further information on data protection at Google can be found at www.google.com/intl/en/policies/privacy/.
13.2 Purpose
Processing takes place to display videos on our website.
13.3 Legal Basis
Processing takes place on the basis of consent pursuant to Art. 6(1)(a) GDPR. This is obtained by us via the "Cookiebot" consent tool (see Section 7.1) or via a content blocker where a YouTube video is to be displayed. Giving such consent is voluntary.
13.4 Withdrawal of Consent
You can withdraw your consent to display YouTube videos on our website at any time with effect for the future in the Cookiebot consent tool settings at the bottom left of the screen.
13.5 Recipients and Third-Country Transfers
By embedding YouTube, personal data may be transmitted to YouTube LLC or Google. Google also processes your personal data in the USA.
14. VIMEO
14.1 Description of Processing
Our website uses services from "Vimeo", a video platform operated by Vimeo LLC, 555 West 18th Street, New York, New York 10011, USA (hereinafter referred to as "Vimeo"). We use Vimeo by embedding individual videos from the platform on our website as an iFrame so they can be played directly on our site. When you visit a subpage of our website with an embedded video, a connection to Vimeo's servers is established, displaying the video within the website. This transmits information about which website you visited to Vimeo. Your IP address may also be transmitted to Vimeo. When you play an embedded video, this information is also passed to Vimeo. If you are logged in as a Vimeo user, Vimeo assigns these data to your user account. Further information on data privacy at Vimeo can be found at vimeo.com/privacy.
14.2 Purpose
Processing takes place to display videos on our website.
14.3 Legal Basis
Processing takes place on the basis of consent pursuant to Art. 6(1)(a) GDPR. This is obtained by us via the "Cookiebot" consent tool (see Section 7.1) or via a content blocker where a Vimeo video is to be displayed. Giving such consent is voluntary.
14.4 Withdrawal of Consent
You can withdraw your consent to display Vimeo videos on our website at any time with effect for the future in the Cookiebot consent tool settings at the bottom left of the screen.
14.5 Recipients and Third-Country Transfers
By embedding Vimeo videos, personal data may be transmitted to Vimeo LLC. Vimeo also processes data in the USA.
15. GOOGLE MAPS
15.1 Description of Processing
Our website uses "Google Maps", a mapping service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as "Google"). We use Google Maps by embedding a map showing our business or event locations on our website. The map is loaded directly from a Google server. For this to happen, your browser sends a request to a Google server. As a result, your IP address in connection with our website address may be transmitted to Google. However, Google Maps does not store cookies on your device. If you are logged into Google when visiting our site, Google Maps assigns this information to your Google user account. Google stores your data as usage profiles and uses them for advertising, market research, and/or demand-oriented design of Google websites. You have a right to object to the creation of these user profiles; to exercise this right, you must contact Google directly. Further information on data protection at Google can be found at policies.google.com/privacy.
15.2 Purpose
Processing takes place to display an interactive map on our website.
15.3 Legal Basis
Processing takes place on the basis of consent pursuant to Art. 6(1)(a) GDPR. This is obtained by us via the "Cookiebot" consent tool (see Section 7.1) or via a content blocker where an interactive map is to be displayed. Giving such consent is voluntary.
15.4 Withdrawal of Consent
You can withdraw your consent to display Google Maps on our website at any time with effect for the future in the Cookiebot consent tool settings at the bottom left of the screen.
15.5 Recipients and Third-Country Transfers
Google also processes your personal data in the USA.
16. META PIXEL
16.1 Description of Processing
Our website uses the remarketing service "Meta Pixel" (formerly "Facebook Pixel"), operated by Meta Platforms, Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA or Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta"). Via "Meta Pixel", we can place target-oriented advertisements on the Facebook and Instagram social networks aimed specifically at Facebook/Instagram users who have shown interest in our offer – e.g. through a previous visit to our website. With the help of "Meta Pixel", we can also track and evaluate the effectiveness and reach of our Facebook/Instagram advertising by recording whether users interact with our ads and are redirected to our website by clicking on them. When you visit our website, a connection to Meta's servers is established and "Meta Pixel" is embedded into our website. Additionally, Meta may store a cookie (see Section 7 above) on your device. If you are logged into Facebook or Instagram, or log in later, your visit to our website will be assigned to your user account. Data collected about you via "Meta Pixel" are anonymous to us and provide no insights into your identity. However, Meta may connect the data to your user profile. Data processing by Meta takes place in accordance with Meta's Data Policy, which can be accessed for Facebook at www.facebook.com/policy.php and for Instagram at privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect.
16.2 Purpose
Processing takes place to carry out targeted online advertising for our own offers on Facebook and Instagram and to evaluate its effectiveness and reach.
16.3 Legal Basis
Processing takes place on the basis of consent pursuant to Art. 6(1)(a) GDPR. This is obtained by us via the "Cookiebot" consent tool (see Section 7.1). Giving such consent is voluntary.
16.4 Storage Duration, Right to Object, and Withdrawal of Consent
Storage duration, as well as your control and setting options for cookies/tracking pixels, are explained in Section 7. You can withdraw your consent regarding data collection by "Meta Pixel" and the use of your data to display Facebook ads at any time with effect for the future in the consent tool settings. You can also object directly to Meta regarding data collection by "Meta Pixel" and the use of your data for displaying Facebook/Instagram ads. Within your Facebook account settings at www.facebook.com/settings?tab=ads, you can decide which types of ads are displayed to you on Facebook. This setting is applied across devices.
16.5 Recipients and Third-Country Transfers
By embedding Meta Pixel, personal data may be transmitted to Meta. Meta also processes your personal data in the USA.
17. TIKTOK PIXEL
17.1 Description of Processing
Our website uses the remarketing service "TikTok Pixel", operated by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, WeWork, 125 Kingsway, London, WC2B 6NH, United Kingdom (together "TikTok"). Via TikTok Pixel, we can place targeted advertisements on the social network aimed at TikTok users who have shown interest in our offer – e.g. through a previous visit to our website. With the help of TikTok Pixel, we can also evaluate the effectiveness and reach of our ads on TikTok by capturing whether users interact with our ads and are redirected to our website. When you visit our website, a connection to TikTok's servers is established and TikTok Pixel is embedded. Additionally, TikTok may store cookies (see Section 7) on your device. If you are logged into TikTok, your visit to our website will be assigned to your user account. Data collected via TikTok Pixel are anonymous to us and offer no conclusions regarding your person. However, TikTok may connect the data to your user profile. Data processing by TikTok occurs in accordance with TikTok's Privacy Policy at https://www.tiktok.com/legal/privacy-policy.
17.2 Purpose
Processing takes place to carry out targeted online advertising for our own offers on TikTok and to evaluate its effectiveness and reach.
17.3 Legal Basis
Processing takes place on the basis of consent pursuant to Art. 6(1)(a) GDPR. This is obtained via the consent tool (see Section 7.1). Giving consent is voluntary. Data processing is otherwise based on joint controller responsibility pursuant to Art. 26 GDPR. The relevant agreement can be viewed at https://ads.tiktok.com/i18n/official/article?aid=300871706948451871.
17.4 Storage Duration, Right to Object, and Withdrawal of Consent
Storage duration, as well as control and setting options for cookies/tracking pixels, are explained in Section 7.4. You can withdraw your consent regarding data collection by TikTok Pixel at any time in the consent tool settings with effect for the future.
17.5 Recipients and Third-Country Transfers
By embedding TikTok Pixel, personal data may be transmitted to TikTok. TikTok also processes your personal data in third countries.
18. LINKEDIN ADS
18.1 Description of Processing
Our website uses the advertising and remarketing service "LinkedIn Ads", operated by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA or LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn"). Via "LinkedIn Ads", we can place targeted ads on the LinkedIn social network aimed at users interested in our offers – e.g. through a previous visit to our website. For this purpose, we add the "LinkedIn Insight Tag" to our website, which is a small JavaScript code snippet. With the "LinkedIn Insight Tag", we can track the effectiveness and reach of our advertising on LinkedIn. When you visit our website, a connection to LinkedIn's servers is established and the "LinkedIn Insight Tag" is embedded. LinkedIn may also store a cookie (see Section 7.1) on your device. If you are logged into LinkedIn, your visit will be assigned to your user account. Data collected via the "LinkedIn Insight Tag" are anonymous to us. However, LinkedIn may connect data to your user profile. Processing by LinkedIn takes place according to its privacy policy at www.linkedin.com/legal/privacy-policy.
18.2 Purpose
Processing takes place to carry out targeted online advertising on LinkedIn for our own offers and evaluate its effectiveness and reach.
18.3 Legal Basis
Processing takes place on the basis of consent pursuant to Art. 6(1)(a) GDPR, obtained via the consent tool (see Section 7.1). Giving consent is voluntary.
18.4 Storage Duration, Right to Object, and Withdrawal of Consent
Storage duration and setting options for cookies and tracking methods are explained in Section 7.4. Consent given regarding the "LinkedIn Insight Tag" can be withdrawn at any time in the consent tool settings with effect for the future. You can also adjust ad preferences in your LinkedIn account settings at https://www.linkedin.com/mypreferences/d/categories/ads.
18.5 Recipients and Third-Country Transfers
By embedding the "LinkedIn Insight Tag", personal data may be transmitted to LinkedIn. LinkedIn processes personal data in the USA. Third-country transfer takes place on the basis of EU Standard Contractual Clauses. Further information: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.
19. GOOGLE ADS CONVERSION AND GOOGLE REMARKETING
19.1 Description of Processing
Our website uses the advertising service "Google Ads Conversion", operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Ads Conversion enables us to place ads on external websites to draw attention to our offers and measure campaign success. Ads are delivered via "Ad Servers". Google uses "Ad Server" cookies to measure success parameters such as ad impressions or clicks. If you reach our website via a Google ad, a cookie is stored on your device (see Section 7). According to Google, these cookies are not intended to identify you personally. Analysis values typically stored include Unique Cookie ID, Ad Impressions per placement (Frequency), last impression (relevant for post-view conversions), and opt-out information. These cookies enable Google to recognize your internet browser. If you visit certain pages of a Google Ads customer and the cookie has not expired, Google and the customer can recognize that you clicked the ad and were redirected. Each Google Ads customer is assigned a different cookie; cookies cannot be tracked across websites of different Google Ads customers. We ourselves process no personal data with Google Ads measures, receiving only statistical evaluations from Google.
Our website also uses "Google Remarketing", enabling us to address you again on other websites within the Google advertising network after visiting our website. Google uses cookies stored in your browser to record and evaluate usage behavior across websites. Pseudonymization is used according to Google. Further information on data protection at Google: policies.google.com/privacy.
19.2 Purpose
Processing takes place to conduct targeted online advertising for our own offers and evaluate its effectiveness and reach.
19.3 Legal Basis
Processing takes place on the basis of consent pursuant to Art. 6(1)(a) GDPR, obtained via the "Cookiebot" consent tool (see Section 7.1). Consent is voluntary.
19.4 Storage Duration, Right to Object, and Withdrawal of Consent
Storage duration and setting options for cookies are explained in Section 7. You can object to data processing by Google Ads Conversion and Google Remarketing at any time via www.google.com/ads/preferences. Consent granted can be withdrawn at any time in the consent tool settings with effect for the future.
19.5 Recipients and Third-Country Transfers
Personal data may be transmitted to Google. Google processes personal data in the USA.
20. CONTENT DELIVERY NETWORK (CDN) / GOOGLE CLOUD CDN
20.1 Description of Processing
Our website uses Content Delivery Networks (CDNs) to reduce loading times for our website and common JavaScript libraries by transmitting files from fast, nearby, or low-load servers of external service providers. External libraries are regularly checked for security and kept updated. We integrate JavaScript libraries from Google. Visiting our website establishes a connection to the external servers, loading the JavaScript libraries and informing the service provider which website you visited.
20.2 Purpose
Processing takes place to shorten loading times and quickly and securely integrate JavaScript libraries.
20.3 Legal Basis
Processing is necessary to safeguard the overriding legitimate interests of the controller (Art. 6(1)(f) GDPR). Our legitimate interest lies in the purpose specified in Section 20.2.
20.4 Recipients and Third-Country Transfers
Data are transmitted to Google Cloud CDN, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information: https://cloud.google.com/cdn.
21. GOOGLE TAG MANAGER
Our website uses "Google Tag Manager", a service by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Tag Manager collects no personal data and sets no cookies. It merely enables the integration and management of tags on our website. Tags are code elements helping to measure traffic, user behavior, ad impacts, remarketing, and audience targeting. As a precaution, integration takes place on the basis of consent pursuant to Art. 6(1)(a) GDPR, obtained via "Cookiebot" (see Section 7.1), where it can also be withdrawn. Further information: policies.google.com/privacy.
22. HUBSPOT
22.1 Description of Processing
On our website, we use HubSpot for online marketing activities, operated by HubSpot, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland. Further information: https://legal.hubspot.com/privacy-policy. HubSpot is an integrated software solution covering aspects such as email marketing (newsletters and automated mailings), social media publishing & reporting, traffic reporting, contact management (CRM, segmentation), landing pages, pop-ups, and contact forms.
22.2 Purpose
Our subscription service allows visitors to learn more about our company, download content, and provide contact information. Information is stored on HubSpot servers and used to contact visitors and determine service interests to optimize our marketing activities.
22.3 Legal Basis
Legal basis depends on the HubSpot function used: email dispatch and web analytics rely on consent (Art. 6(1)(a) GDPR). For pre-contractual/contractual measures, the legal basis is Art. 6(1)(b) GDPR. Otherwise, processing is based on legitimate interest (Art. 6(1)(f) GDPR) to optimize marketing and service quality.
22.4 Storage Duration
Data are deleted once no longer required for processing purposes. Storage duration and revocation details are provided under individual processing sections.
22.5 Recipients and Third-Country Transfers
HubSpot acts as a data processor. Personal data are transmitted to HubSpot Ireland and processed in the USA by HubSpot Inc., 25 First Street, Cambridge, MA 02141, USA, based on the EU-U.S. Data Privacy Framework (https://www.dataprivacyframework.gov/).
23. SALESVIEWER
23.1 Description of Processing
Our website uses "SalesViewer", a cookieless service for identifying anonymous B2B website visitors, operated by SalesViewer GmbH, Universitätsstraße 60, 44789 Bochum, Germany. SalesViewer is activated only after prior consent via our consent tool. It identifies company-level website traffic (e.g. accessing company name, subpages visited, duration, referrer URL) via JavaScript. Data are immediately encrypted and pseudonymized via a non-reversible one-way hash function. No natural persons are identified.
23.2 Purpose
Processing takes place for marketing, market research, and optimization purposes to identify potential B2B customers and align sales and marketing activities.
23.3 Legal Basis
Processing is based on consent pursuant to Art. 6(1)(a) GDPR, obtained via the consent tool (see Section 7.1). Consent is voluntary.
23.4 Storage Duration and Withdrawal of Consent
Data are deleted when no longer required for their intended purpose and subject to no statutory retention obligations. Consent can be withdrawn at any time via consent tool settings or via https://www.salesviewer.com/opt-out.
23.5 Recipients
Data processing is conducted by SalesViewer GmbH under a data processing agreement. No data are passed to other third parties.
24. RECRUITING
24.1 Description of Processing
We process application data to assess suitability for open positions and conduct the recruitment process. Data processed include general personal information (name, address, contact details), professional qualifications, education, training, skills, cover letters, CVs, certificates, correspondence, and interview details. We manage applicant data using "Ashby", an applicant management system operated by Ashby Inc., 548 Market Street, PMB 61734, San Francisco, CA 94104-5401, USA. All data submitted via our job portal are stored and processed in this system. We ask applicants to refrain from disclosing "special categories of personal data" under Art. 9 GDPR (e.g. photos showing ethnic origin, disability status). If successful, data are transferred to your personnel file. If unsuccessful, data are stored briefly to defend against potential legal claims (e.g. under equal treatment legislation) or transferred to our applicant pool with your consent.
24.2 Purpose
Processing takes place to conduct the application process, decide on establishing an employment relationship, and document compliance with legal requirements.
24.3 Legal Basis
Data processing for recruitment is based on Sec. 26(1) Sentence 1 BDSG and Art. 6(1)(b) GDPR. If successful, processing continues under Art. 6(1)(b) GDPR in conjunction with Art. 88(1) GDPR and Sec. 26(1) BDSG. Applicant pool storage or processing special data categories relies on consent pursuant to Art. 6(1)(a) / Art. 9(2)(a) GDPR. Processing post-rejection is based on legitimate interest (Art. 6(1)(f) GDPR) to defend against legal claims.
24.4 Storage Duration and Withdrawal of Consent
Successful application data transfer to personnel files and are subject to personnel file rules. Unsuccessful candidate data are stored for up to six months post-rejection. Applicant pool data are deleted after two years or upon employment. Consent can be withdrawn at any time with future effect.
24.5 Recipients and Third-Country Transfers
Application data are reviewed by HR and hiring managers. Ashby operates as a data processor. Data transfers to Ashby in the USA are based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), with Ashby certified under DPF principles. For sub-processors not DPF-certified, EU Standard Contractual Clauses apply. Technical/organizational measures include TLS 1.2+ encryption in transit, AES-256 at rest, role-based access, MFA, SOC 2 Type II audits, penetration testing, and incident monitoring. Further privacy information: https://www.ashbyhq.com/resources/privacy and https://trust.ashbyhq.com.
25. CUSTOMER CHATBOT (AZURE OPENAI SERVICE)
25.1 Description of Processing
Our website uses a customer chatbot based on Azure OpenAI Service and OpenAI models for interactive request processing. Processed data include chat text entries and technical data (IP address, access times, browser details). Inputs/responses are stored in the chatbot application provided by rrooaarr interactive solutions GmbH, Hämpfergasse 15, 89073 Ulm, Germany (under a data processing agreement), stored exclusively on servers in Germany. Chat inputs are transmitted to Microsoft Azure OpenAI Service strictly as a processor to fulfill requested chatbot features, without Microsoft using data for its own purposes.
25.2 Purpose
Processing takes place to provide interactive customer service, address requests efficiently, and continuously optimize user experience and service quality.
25.3 Legal Basis
Processing is based on Art. 6(1)(b) GDPR (fulfilling requests) and consent pursuant to Art. 6(1)(a) GDPR, obtained via "Cookiebot" (see Section 7.1). Consent is voluntary.
25.4 Storage Duration and Withdrawal of Consent
Data are retained only as long as necessary to process requests and for customer relationship durations, automatically deleted after a maximum of six months unless statutory retention rules apply.
25.5 Recipients and Third-Country Transfers
Functionality is provided by rrooaarr interactive solutions GmbH as a processor. Privacy policy: https://www.rrooaarr.com/datenschutz/.
26. AI-POWERED CUSTOMER SERVICE (PINECONE)
26.1 Description of Processing
To support our AI customer service (Section 25), rrooaarr interactive solutions GmbH uses vector database technology from Pinecone Inc., 230 Park Avenue, New York, NY 10169, USA ("Pinecone"). Chat requests are processed against vectorized knowledge data in Pinecone. No personal data or concrete chat inputs are transmitted or stored in Pinecone; only non-identifiable vectorized knowledge base data are kept in Pinecone infrastructure.
26.2 Purpose
Processing takes place to provide faster, more accurate responses and optimize AI customer service performance.
26.3 Legal Basis
Processing relies on Art. 6(1)(b) GDPR (service fulfillment) and legitimate interest under Art. 6(1)(f) GDPR (improving service quality and performance).
26.4 Storage Duration
No personal data or specific user inputs are stored in Pinecone vector databases; hence, no individual user data deletion in Pinecone is necessary. Request processing occurs strictly for the active session duration.
26.5 Recipients and Third-Country Transfers
Pinecone Inc. acts as a sub-processor to rrooaarr interactive solutions GmbH. Processing takes place in data centers within the European Union. To ensure an adequate level of data protection, EU Standard Contractual Clauses (SCCs) have been executed with Pinecone Inc. Privacy policy: https://www.pinecone.io/privacy/.
V. Security Measures
27. SECURITY MEASURES
To protect personal data against unauthorized access, our website uses SSL and TLS encryption (Transport Layer Security). You can identify active SSL/TLS encryption by the padlock icon displayed on the left side of your browser's address bar.
VI. Your Rights
28. DATA SUBJECT RIGHTS
With regard to the data processing described above, you enjoy the following data subject rights under the GDPR:
28.1 Right of Access (Art. 15 GDPR)
You have the right to request confirmation from us as to whether personal data concerning you are being processed. If so, under the conditions of Art. 15 GDPR, you have a right of access to those personal data and to the detailed information listed in Art. 15 GDPR.
28.2 Right to Rectification (Art. 16 GDPR)
You have the right to demand that we rectify inaccurate personal data concerning you without undue delay and, where applicable, complete any incomplete personal data.
28.3 Right to Erasure / Right to Be Forgotten (Art. 17 GDPR)
You have the right to request that personal data concerning you be erased without undue delay if one of the specific reasons in Art. 17 GDPR applies, e.g. if the data are no longer needed for the intended purposes.
28.4 Right to Restriction of Processing (Art. 18 GDPR)
You have the right to request restriction of processing if one of the conditions in Art. 18 GDPR is met, e.g. if you contest the accuracy of personal data, for a period enabling us to verify data accuracy.
28.5 Right to Data Portability (Art. 20 GDPR)
Under the conditions of Art. 20 GDPR, you have the right to receive personal data concerning you in a structured, commonly used, and machine-readable format.
28.6 Right to Withdraw Consent (Art. 7(3) GDPR)
Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal takes effect from the moment it is asserted (with future effect). Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
28.7 Right to Lodge a Complaint (Art. 77 GDPR)
If you consider that the processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
28.8 Prohibition of Automated Individual Decision-Making / Profiling (Art. 22 GDPR)
Decisions producing legal effects concerning you or similarly significantly affecting you must not be based solely on automated processing of personal data – including profiling. We inform you that we do not utilize automated decision-making or profiling with respect to your personal data.
28.9 Right to Object (Art. 21 GDPR)
Where personal data are processed on the basis of Art. 6(1)(f) GDPR (to safeguard overriding legitimate interests), you have the right to object to such processing under the conditions of Art. 21 GDPR, provided there are grounds arising from your particular situation. Upon objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims. You retain an absolute right to object at any time to the processing of your personal data for direct marketing purposes, independent of any particular situation.
As of: December 2025