Personal data means any information relating to an identified or identifiable person. In particular, this includes information that enables us to draw conclusions about your identity, such as your name, your telephone number, your address or email address. Statistical data collected by us – for example, when you visit our website – which cannot be linked to you personally is not covered by the term ‘personal data’.
The point of contact and so-called controller for the processing of your personal data when visiting this website within the meaning of the EU General Data Protection Regulation (GDPR) is
ISiCO Datenschutz GmbH,
Am Hamburger Bahnhof 4,
T: +49 (0)30-213002850
F: +49 (0)30-213002899
If you have any questions about data protection in connection with our products and services or the use of our website, you can also contact our data protection officer at any time. The data protection officer can be contacted at the above postal address or by sending an email to the address provided (please mark all correspondence with: “F.A.O. data protection officer”).
2. Data processing on our website
2.1. Visiting our website, access data
Every time you use our website, we collect the access data automatically transmitted by your browser in order to make visiting the website possible. This access data includes in particular:
- IP address of the requesting device;
- date and time of the request;
- addresses of the website visited and the requesting website;
- information about the browser used and the operating system;
- online identifiers (e.g. device IDs, session IDs).
It is necessary to process this access data to make it possible to visit the website and to guarantee the long-term functionality and security of our systems. The legal basis for this is Art. 6(1) Sentence 1(b) GDPR. For data protection reasons, we do not permanently store or analyse log files.
2.2. Making contact
There are a number of ways for you to contact us via the contact forms on this website. In this context we process data exclusively for the purpose of communicating with you. The legal basis for this is Art. 6(1)(b) GDPR. The data we collect when you use the contact form will be automatically erased once we have finished processing your enquiry, unless we still require your enquiry to fulfill contractual or legal obligations (see ‘Storage period’).
We use our newsletter primarily to keep you informed about current developments in the world of data protection and news concerning legislation and case law as well as economic and political aspects from our specialist fields. We use CleverReach, a service provided by CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede, Germany (“CleverReach”), for sending our newsletter.
For newsletter subscriptions we use the so-called double opt-in procedure, which means that we will only send you newsletters by email if you click on a link in our notification email to confirm that you are the owner of the email address provided. If you confirm your email address, we will store your email address, the time of registration and the IP address you used when registering until you unsubscribe from the newsletter. The sole purpose of storing this data is to be able to send you the newsletter and prove that you registered. You can unsubscribe from the newsletter at any time. A corresponding unsubscribe link can be found in every newsletter. It is of course also sufficient if you notify us using the contact details provided above or in the newsletter (e.g. by email or letter). The legal basis of this processing is your consent pursuant to Art. 6(1)(a) GDPR.
2.4. Google Maps
Our website uses the map service Google Maps, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). In order for the Google map information we use to be integrated and displayed in your web browser, when you visit our contact page your web browser must connect to a Google server, which may also be located in the USA. In the event that personal data is transferred to the USA, Google has subjected itself to the EU-US Privacy Shield. Google thus receives the information that the contact page of our website has been accessed from the IP address of your device. The legal basis is Art. 6(1) Sentence 1(f) GDPR, based on our legitimate interest in integrating a map service to help you contacting us.
If you retrieve a map service from Google on our website and are simultaneously logged in to your Google profile, Google can link this event to your Google profile. If you do not want this information to be associated with your Google profile, you must log out of Google before visiting our contact page. Google stores your data and uses it for purposes of advertising, market research and the personalised display of Google Maps. You may object to this data collection by Google.
2.5. Google Tag-Manager
2.6. Integration of Vimeo videos
We have embedded videos on our website that are stored on the Vimeo video platform and can be played directly on our website. Vimeo is a multimedia service provided by Vimeo, Inc., 555 West 18th Street, New York 10011, USA (“Vimeo”). The legal basis of this integration is Art. 6(1) Sentence 1(f) GDPR, based on our legitimate interest in integrating video and image content.
When you visit our website, Vimeo receives the information that you have retrieved the corresponding subpage. This may happen regardless of whether you are logged in to Vimeo or not. Vimeo may use this data for purposes of advertising, market research and the demand-oriented design of its websites. If you view videos on our website and are simultaneously logged in to your Vimeo profile, Vimeo can also link this event to your Vimeo profile. If you do not want this information to be associated with your Vimeo profile, you must log out of Vimeo before visiting our website.
You can apply to us for advertised vacancies by email. The purpose of data collection here is the selection of applicants for potential employment. In order to process your application, we collect the data provided by you (usually your first and last name, email address, application such as curriculum vitae and cover letter, earliest possible date you could start work and salary expectations). We would like to point out that we cannot guarantee confidentiality if applications are sent unencrypted by email. As a rule, you can also apply for our positions by post or in person. The legal basis for the processing of your application documents is Art. 6(1) Sentence 1(b) and Art. 88(1) GDPR in conjunction with Section 26(1) Sentence 1 of the German Federal Data Protection Act (BDSG).
2.8. Use of our own cookies
Google will process the information generated by the cookies for the purpose of evaluating your use of the website, compiling reports on website activity for the website operators, and providing other services relating to website usage and internet usage.
The legal basis for the data processing described in the following section is Art. 6(1) Sentence 1(f) GDPR, based on our legitimate interest in the personalised advertising of our products and services.
In the following section, we would like to explain these technologies and the providers used for them in more detail.
The data collected may include in particular
- the IP address of the device,
- the date and time of access,
- the ID number of a cookie,
- the device ID of mobile devices,
- technical information about the browser and operating system.
However, the data collected is stored exclusively in pseudonymous form, meaning that no direct conclusions can be drawn about individual persons.
In each of the following descriptions of the technologies we use, you will also find information about how you can object to our analysis and advertising measures by means of what are known as opt-out cookies. Alternatively, you can exercise your right to object using the settings on the websites Truste or Your Online Choices, which allow you to opt out of the services provided by a range of advertisers. Both sites let users place opt-out cookies to deactivate all ads from the providers listed at once, or alternatively to adjust their settings for each individual provider. Please note that if you later delete all cookies in your browser or use a different browser and/or profile, you will need to store a new opt-out cookie.
2.10.1. Bing Ads
You can prevent the storage of cookies by adjusting your browser settings accordingly (as described above); however, we would like to point out that if you do this you may not be able to use the full functionality of the website. Furthermore, you can prevent the recording of data generated by cookies about your use of the website and its processing by Microsoft by disabling personalised ads on the opt-out page provided by Microsoft. If you do this, please note that if you later delete all cookies in your browser or use a different browser and/or profile, you will need to opt out again.
Please refer to Microsoft’s privacy statement for further details.
2.10.2. Google AdWords Remarketing
If you use a Google Account, depending on the settings in your Google Account, Google can link your web and app browsing history to your Google Account and use information from your Google Account to show you personalised ads. If you do not want this information to be associated with your Google Account, you must log out of Google before visiting our website.
You can configure your browser to reject cookies as described above. You can also disable the “Ads Personalisation” button in your Google Ads Settings. In this case, Google will then only display general advertising which has not been selected based on information collected about you.
3. Facebook Fanpage
We jointly operate a fan page on the social network of Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Irland (“Facebook”), where we communicate with interested parties and followers and inform them about our products and services.
We may receive statistics from Facebook about how Facebook/Fanpage users use our Fanpage, such as information about interactions, likes, dislikes, comments, or aggregated information and statistics (such as the age or origin of our followers) that help us learn about interactions with our site. For more information about the nature and extent of these statistics, please see the Facebook info on using pages insights. Further information on the respective legal responsibilities can be found in the Facebook Page Insights Controller Addendum. The legal basis for this data processing is Art. 6 (1b) of the GDPR and 6 (1f) of the GDPR based on our aforementioned legitimate interest.
If we receive your personal data while operating the fanpage, you are entitled to the rights stated in this data protection declaration. If you also wish to assert your rights against Facebook, the easiest way to do this is to contact Facebook directly. Facebook knows the details of the technical operation of the platform and the associated data processing as well as the concrete purposes of data processing and can implement appropriate measures on request if you make use of your rights. We are happy to support you in asserting your rights to the extent possible and forward your requests to Facebook.
4. Disclosure of data
In principle, we will only pass on the data we collect if:
- you have given your explicit consent pursuant to Art. 6(1) Sentence 1(a) GDPR;
- disclosure is necessary pursuant to Art. 6(1) Sentence 1(f) GDPR in order to establish, exercise or defend legal claims and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed;
- we are legally obliged to do so under Art. 6(1) Sentence 1(c) GDPR; or
- this is permitted by law and is required under Art. 6(1) Sentence 1(b) GDPR for the processing of contractual relationships with you or for taking steps at your request prior to entering into a contract.
In addition, data may be disclosed in connection with official requests, court orders and legal proceedings if this is necessary to pursue or enforce rights.
5. Storage period
In principle, we only store personal data for as long as necessary to fulfill contractual or legal obligations for which we have collected the data. We then delete the data without delay, unless we still require the data until the end of the statutory limitation period for evidence purposes for claims under civil law or due to statutory retention obligations.
For evidence purposes, we must keep contract data for another three years after the end of the year in which the business relationship with you ends. After the standard statutory period of limitation, any claims become statute-barred at this point in time at the earliest.
Even after that, we are still required to store some of your data for accounting reasons. We are obliged to do so due to statutory documentation obligations, which may arise on the basis of the German Commercial Code, the Fiscal Code, the Banking Act and the Money Laundering Act. The periods specified there for retaining documents range from two to ten years.
6. Your rights
You have the right to information about how we process your personal data at any time. When providing this information, we will explain the data processing to you and provide you with an overview of the data stored about you. If data stored by us is incorrect or no longer up to date, you have the right to have this data corrected. You may also demand that your data be erased. Should the erasure not be possible in exceptional cases due to other legal regulations, the data will be blocked so that it is only available for that legal purpose. You are also entitled to have the processing of your data restricted, e.g. if you believe that the data we have stored is incorrect. You also have the right to data portability, which means that on request we will send you a digital copy of the personal data you have provided.
In order to assert your rights described here, you can contact us at any time using the contact details provided. This also applies if you wish to receive copies of safeguards in order to prove an adequate level of data protection.
Finally, you have the right to lodge a complaint with our competent data protection supervisory authority. You can assert this right by contacting a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement. In Berlin, where ISiCO Datenschutz GmbH is headquartered, the competent supervisory authority is: Berlin Commissioner for Data Protection and Freedom of Information, Friedrichstr. 219, 10969 Berlin.
7. Right of withdrawal and objection.
You have the right to withdraw the consent you gave us at any time. As a result of this, we will cease the data processing based on this consent with future effect. This withdrawal of your consent will not affect the lawfulness of the processing carried out on the basis of the consent prior to the withdrawal.
Insofar as we process your data on the basis of legitimate interests, you have the right to object to the processing of your data at any time for reasons arising from your particular situation. If your objection is to data processing for direct marketing purposes, you have a general right of objection, which we will implement without requiring you to give reasons.
If you would like to make use of your right of withdrawal or objection, it is sufficient to simply notify us using the contact details provided above.
Last amended: 14.09.2018