Skip to main content
English

Thank you for your interest in our company. Protecting personal data is a high priority for the management of CAIGOS GmbH (hereinafter referred to as ‘CAIGOS’). The CAIGOS websites can generally be used without providing any personal data. However, where a data subject wishes to use specific services offered through our website, the processing of personal data may be required. Where such processing is necessary and no other lawful basis applies, we will obtain the data subject’s consent.

Introduction

This privacy notice explains the categories of personal data we process (also referred to below as ‘data’), the purposes for which we process it and the extent of that processing. It applies to all processing of personal data carried out by us, both in connection with the provision of our services and, in particular, through our websites, mobile applications and presence on external online platforms, such as our social media profiles (collectively referred to below as our ‘online services’).


The terms used are gender-neutral.


Date: 11.03.2026

Responsible for content

CAIGOS GmbH
Im Driescher 7-9
66459 Kirkel
Deutschland


Authorised representatives: Dirk Weidemann
Email: info@caigos.de
Phone: +49 6849 6004-0
Legal notice: https://www.caigos.de/imprint/

Data Protection Officer

Andreas Guldner
CAIGOS GmbH
Im Driescher 7-9
66459 Kirkel
Deutschland


Tel.: +49 6849 6004-0
E-Mail: datenschutzbeauftragter@caigos.de

Overview of processing activities

The following overview summarises the categories of personal data we process, the purposes for which we process it and the categories of data subjects concerned.

Categories of data processed

  • Master data
  • Payment data
  • Location data
  • Contact data
  • Content data
  • Contract data
  • Usage data
  • Metadata and communication data
  • Applicant data

Categories of data subjects

  • References
  • Employees
  • Prospective customers
  • Communication partners
  • Users
  • Applicants
  • Business and contractual partners
  • Participants
  • Individuals depicted

Purposes of processing

  • Provision of contractual services and customer service
  • Contact enquiries and communication
  • Security measures
  • Direct marketing
  • Audience measurement
  • Tracking
  • Office and organisational procedures
  • Conversion measurement
  • Managing and responding to enquiries
  • Recruitment processes
  • Feedback
  • Marketing
  • Profiles containing user-related information
  • Provision and usability of our online services
  • IT infrastructure

Legal bases for processing

The following provides an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the GDPR, national data protection laws may apply in the country in which you or we reside or are established. Where more specific legal bases apply in individual cases, these will be identified in this privacy notice.

  • Consent (Article 6(1)(a) GDPR) – The data subject has consented to the processing of their personal data for one or more specified purposes.
  • Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the data subject’s request before entering into a contract.
  • Legal obligation (Article 6(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Article 6(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject that require the protection of personal data.
  • Recruitment process as a pre-contractual or contractual relationship (Article 6(1)(b) GDPR) – Where special categories of personal data within the meaning of Article 9(1) GDPR, such as health data relating to a severe disability or information concerning ethnic origin, are requested from applicants during the recruitment process, their processing is based on Article 9(2)(b) GDPR where this is necessary to enable the controller or the data subject to exercise rights or comply with obligations arising from employment, social security or social protection law.
    Where processing is necessary to protect the vital interests of applicants or other individuals, it is based on Article 9(2)(c) GDPR. Where processing is required for preventive or occupational medicine, assessing an employee’s capacity for work, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services, it is based on Article 9(2)(h) GDPR. Where special categories of personal data are provided on the basis of voluntary consent, they are processed pursuant to Article 9(2)(a) GDPR.

In addition to the data protection provisions of the GDPR, national data protection legislation applies in Germany. This includes, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), which contains specific provisions governing the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, data transfers and automated individual decision-making, including profiling.
The BDSG also governs data processing for employment-related purposes under Section 26, particularly in connection with entering into, carrying out and terminating employment relationships and obtaining employees’ consent. Data protection laws enacted by the individual German federal states may also apply.

Security measures

In accordance with applicable legal requirements, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. In doing so, we take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the varying likelihood and severity of the risks to the rights and freedoms of natural persons.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to it, as well as the access, input, disclosure, availability and segregation of data. We have also established procedures to enable data subjects to exercise their rights, ensure the erasure of data and respond to threats to data security. Furthermore, we take the protection of personal data into account when developing or selecting hardware, software and procedures, in accordance with the principles of data protection by design and by default.

TLS encryption (HTTPS): We use TLS encryption to protect data transmitted through our online services. Encrypted connections can be identified by the https:// prefix in your browser’s address bar.

Disclosure of personal data

When processing personal data, we may transfer or disclose it to other organisations, companies, legally independent organisational units or individuals. Recipients may include service providers engaged to carry out IT-related tasks or providers of services and content integrated into a website. In such cases, we comply with the applicable legal requirements and, in particular, enter into appropriate contracts or agreements with the recipients to protect your data.

Data transfers within the corporate group: We may transfer personal data to other companies within our corporate group or grant them access to it. Where data is shared for administrative purposes, this is based on our legitimate corporate and commercial interests. Data may also be shared where necessary to fulfil our contractual obligations, where the data subject has given their consent or where the disclosure is otherwise permitted by law.

Processing of data in third countries

Where we process data in a third country, meaning a country outside the European Union (EU) or the European Economic Area (EEA), or where such processing takes place through the use of third-party services or the disclosure or transfer of data to other individuals, bodies or companies, we do so only in accordance with applicable legal requirements.

Unless the transfer is based on explicit consent or is necessary for contractual or legal reasons, we process data in third countries, or arrange for it to be processed there, only where the country has been recognised as providing an adequate level of data protection or where appropriate safeguards are in place. These safeguards may include the European Commission’s standard contractual clauses, approved certification mechanisms or binding corporate rules (Articles 44 to 49 GDPR; see the European Commission’s information on international data transfers).

Erasure of data

We erase the data we process in accordance with applicable legal requirements as soon as consent permitting its processing is withdrawn or another legal basis for processing ceases to apply, for example where the purpose of the processing no longer exists or the data is no longer required for that purpose.
Where data cannot be erased because it is required for other legally permitted purposes, its processing will be restricted to those purposes. This means that the data will be blocked and will not be processed for any other purpose. This applies, for example, to data that must be retained for reasons of commercial or tax law, or where retention is necessary for the establishment, exercise or defence of legal claims or to protect the rights of another natural or legal person.

Our privacy notices may provide users with additional information on the erasure and retention of data that applies specifically to the relevant processing activities.

Use of cookies

Cookies are small text files or other storage technologies that store information on users’ devices and retrieve information from those devices. They may be used, for example, to retain a user’s signed-in status, the contents of a shopping basket in an online shop, content viewed or functions used within an online service. Cookies may also be used for a range of purposes, including ensuring the functionality, security and ease of use of online services and analysing visitor traffic.

Information on consent: We use cookies in accordance with applicable legal requirements. We therefore obtain users’ prior consent unless consent is not required by law. In particular, consent is not required where storing or accessing information, including through cookies, is strictly necessary to provide a telemedia service within the meaning of German law that the user has expressly requested, namely our online services. Users are clearly informed that they may withdraw their consent and are provided with details of the relevant use of cookies.

Information on the lawful bases for processing: The lawful basis on which we process users’ personal data through cookies depends on whether we request their consent. Where users give their consent, this consent forms the lawful basis for processing their data. Otherwise, data collected through cookies is processed on the basis of our legitimate interests, such as operating our online services efficiently and improving their usability. Where cookies are used in connection with the performance of our contractual obligations, processing takes place on this basis where the cookies are necessary to fulfil those obligations. The purposes for which we use cookies are explained in this privacy notice or as part of our consent and processing procedures.

Storage period: The following types of cookies are distinguished according to how long they remain stored:

  • Temporary cookies (also known as session cookies): Temporary cookies are deleted no later than when a user leaves an online service and closes their browser or mobile application.
  • Persistent cookies: Persistent cookies remain stored after the browser or application has been closed. They may, for example, retain a user’s signed-in status or display preferred content when the user revisits a website. Data collected through cookies may also be used for audience measurement. Unless we provide users with specific information about the type and storage period of a cookie, for example when obtaining consent, users should assume that the cookie is persistent and may remain stored for up to two years.

General information on withdrawing consent and objecting (opt-out): Users may withdraw their consent at any time. They may also object to processing in accordance with the statutory requirements set out in Article 21 GDPR. Users may additionally indicate their objection through their browser settings, for example by disabling cookies. However, doing so may restrict the functionality of our online services.

Cookie settings

  • Verarbeitete Datenarten: Meta-/Kommunikationsdaten (z.B. Geräte-Informationen, IP-Adressen).
  • Categories of data subjects: Users (e.g. website visitors and users of online services).
  • Purposes of processing: Provision and usability of our online services.
  • Lawful basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • Processing cookie data on the basis of consent: We use a cookie consent management system through which users’ consent to the use of cookies and to the processing activities and providers specified within the system can be obtained, managed and withdrawn. A record of consent is stored so that users do not have to be asked for consent again and so that we can demonstrate that consent has been obtained in accordance with our legal obligations. This record may be stored on the server and/or in a cookie, known as an opt-in cookie, or using comparable technologies, so that the consent can be associated with the relevant user or device. Unless otherwise specified by the individual cookie management service provider, the record of consent may be stored for up to two years. A pseudonymous user identifier is created and stored together with the time at which consent was given, details of its scope, such as the relevant cookie categories and/or service providers, and information about the browser, operating system and device used.
  • Borlabs Cookie: Cookie consent management; provider: Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg, Germany; lawful basis: Legitimate interests (Article 6(1)(f) GDPR); website: https://de.borlabs.io/borlabs-cookie/; privacy notice: https://de.borlabs.io/datenschutz/.

Business services

We process the data of our contractual and business partners, such as customers and prospective customers (collectively referred to as ‘contractual partners’), in connection with contractual and similar legal relationships, related activities and our communications with them, including before a contract is concluded, for example when responding to enquiries.

We process this data in order to fulfil our contractual obligations. This includes, in particular, providing the agreed services, meeting any obligations to provide updates and remedying defects covered by warranties or other failures in service delivery. We also process the data to protect our rights and carry out the administrative and organisational activities associated with these obligations.
In addition, we process data on the basis of our legitimate interests in the proper and commercially sound management of our business and in implementing security measures to protect our contractual partners and business operations against misuse and risks to their data, confidential information, other information and rights. This may involve telecommunications providers, transport providers and other support services, subcontractors, banks, tax and legal advisers, payment service providers or tax authorities.
To the extent permitted by applicable law, we disclose contractual partners’ data to third parties only where this is necessary for the purposes described above or to comply with legal obligations. Contractual partners are informed of any other forms of processing, such as processing for marketing purposes, elsewhere in this privacy notice.

We inform contractual partners which data is required for these purposes before or when it is collected. In online forms, for example, mandatory information may be identified using colours, symbols such as asterisks or other appropriate markings. We may also provide this information directly.

We erase the data once statutory warranty obligations and comparable obligations have expired, generally after four years, unless the data is stored in a customer account or must continue to be retained for statutory archiving purposes. The statutory retention period is ten years for documents relevant for tax purposes, commercial records, inventories, opening balance sheets, annual financial statements, the work instructions and other organisational documents required to understand them, and accounting records. Commercial and business correspondence received, and copies of commercial and business correspondence sent, must be retained for six years.
The retention period begins at the end of the calendar year in which the final entry was made in the commercial records; the inventory, opening balance sheet, annual financial statements or management report was prepared; the commercial or business correspondence was received or sent; the accounting record was created; the relevant information was recorded; or the other document was produced.

Where we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the relevant provider or platform apply to the relationship between users and that provider.

  • Categories of data processed: Master data, such as names and addresses; payment data, such as bank details, invoices and payment history; contact data, such as email addresses and telephone numbers; contractual data, such as the subject matter and duration of the contract and the customer category.
  • Categories of data subjects: Prospective customers; business and contractual partners.
  • Purposes of processing: Provision of contractual services and customer support; contact enquiries and communication; office and organisational procedures; managing and responding to enquiries.
  • Lawful bases: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR); compliance with a legal obligation (Article 6(1)(c) GDPR); legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • Sales and support: We process the data of our clients, customers, prospective customers and other contracting parties (collectively referred to as ‘clients’) in order to provide our services to them. The data processed and the nature, scope, purpose and necessity of the processing depend on the underlying contractual relationship with the client.
    Where necessary for the performance of a contract, the protection of vital interests or compliance with legal requirements, or where the client has given consent, we disclose or transfer client data to third parties or contractors in accordance with applicable professional obligations. These recipients may include public authorities, subcontractors, IT service providers, office service providers or providers of comparable services. Lawful basis: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR).
  • Provision of software and platform services: We process the data of our users, including registered users and any trial users (collectively referred to as ‘users’), in order to provide our contractual services. We also process this data on the basis of our legitimate interests in ensuring the security of our services and continuing to develop them.
    Information required for the provision and billing of our services is identified as mandatory during the order, purchase or comparable contracting process. This also includes the contact details required to communicate with users where necessary. Lawful basis: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR).
  • Technical services: We process the data of our customers and commissioning parties (collectively referred to as ‘customers’) to enable them to select, purchase or commission the chosen services, deliverables and related activities, arrange payment and receive the relevant services or deliverables.
    Information required for the provision and billing of our services is identified as mandatory during the order, purchase or comparable contracting process. This also includes the contact details required to communicate with customers where necessary. Where we obtain access to information relating to customers’ end customers, employees or other individuals, we process that information in accordance with applicable legal and contractual requirements. Lawful basis: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR).

Third-party providers and services used in our business operations

As part of our business operations, and in accordance with applicable legal requirements, we use additional third-party services, platforms, integrations and plug-ins (collectively referred to as ‘services’). We use these services on the basis of our legitimate interests in the proper, lawful and commercially efficient operation of our business and internal organisation.

  • Categories of data processed: Master data, such as names and addresses; payment data, such as bank details, invoices and payment history; contact data, such as email addresses and telephone numbers; content data, such as information entered in online forms; contractual data, such as the subject matter and duration of the contract and the customer category.
  • Categories of data subjects: Customers; prospective customers; users, such as website visitors and users of online services; business and contractual partners.
  • Purposes of processing: Provision of contractual services and customer service; office and organisational procedures.
  • Lawful basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • TeamViewer: Conferencing software; service provider: TeamViewer GmbH, Jahnstr. 30, 73037 Göppingen, Germany; lawful basis: Legitimate interests (Article 6(1)(f) GDPR); website: TeamViewer website; privacy notice: TeamViewer privacy information.

Provision of our online services and web hosting

We process users’ data in order to provide our online services. For this purpose, we process users’ IP addresses, as these are required to deliver the content and functionality of our online services to their browsers or devices.

  • Categories of data processed: Usage data (e.g. websites visited, interest in particular content and access times); metadata and communication data (e.g. device information and IP addresses).
  • Categories of data subjects: Users (e.g. website visitors and users of online services).
  • Purposes of processing: Provision and usability of our online services; IT infrastructure (operation and provision of information systems and technical equipment, such as computers and servers); security measures.
  • Lawful basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • Provision of our online services using rented hosting resources: To provide our online services, we use storage space, computing capacity and software that we either provide ourselves or rent or otherwise obtain from a server provider (also referred to as a ‘web hosting provider’). Lawful basis: Legitimate interests (Article 6(1)(f) GDPR).
  • Collection of access data and log files: Access to our online services is recorded in server log files. These may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, confirmation that the content was successfully retrieved, the browser type and version, the user’s operating system, the referrer URL (the page visited previously), and, as a rule, the IP address and internet service provider.
    Server log files may be used for security purposes, for example to prevent server overload, particularly in the event of malicious attacks known as distributed denial-of-service (DDoS) attacks. They may also be used to monitor server utilisation and ensure system stability. Lawful basis: Legitimate interests (Article 6(1)(f) GDPR). Erasure of data: Log file data is retained for no more than 30 days and is then erased or anonymised. Data that must be retained for evidential purposes is exempt from erasure until the incident concerned has been fully resolved.
  • IONOS: IT infrastructure and related services, such as storage space and/or computing capacity; service provider: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany; lawful basis: Legitimate interests (Article 6(1)(f) GDPR); website: https://www.ionos.de/; privacy notice: https://www.ionos.de/datenschutzerklaerung/; data processing agreement: Provided by the service provider.

Contact and enquiry management

When individuals contact us, for example via a contact form, email, telephone or social media, or communicate with us in connection with an existing user or business relationship, we process the information they provide to the extent necessary to respond to their enquiries and take any action they request.

  • Categories of data processed: Contact data (e.g. email addresses and telephone numbers); content data (e.g. information entered in online forms); usage data (e.g. websites visited, interest in particular content and access times); metadata and communication data (e.g. device information and IP addresses).
  • Categories of data subjects: Communication partners.
  • Purposes of processing: Contact enquiries and communication; managing and responding to enquiries; feedback, such as collecting feedback through an online form; provision and usability of our online services.
  • Lawful bases: Legitimate interests (Article 6(1)(f) GDPR); performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR).

Further information on processing activities, procedures and services:

  • Contact form: When users contact us via our contact form, by email or through other communication channels, we process the information they provide in order to deal with their enquiry. Lawful bases: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR); legitimate interests (Article 6(1)(f) GDPR).

Video conferencing, online meetings, webinars, CAIGOS Academy and screen sharing

We use platforms and applications provided by third parties (hereinafter referred to as ‘conferencing platforms’) to conduct video and audio conferences, webinars and other forms of online meeting (collectively referred to below as ‘conferences’). When selecting conferencing platforms and the services they provide, we comply with applicable legal requirements.

Data processed by conferencing platforms: When participants join a conference, the conferencing platforms process the personal data described below. The extent of the processing depends on the information required for the particular conference, such as access details or participants’ full names, as well as any optional information provided by participants.
In addition to processing data for the purpose of conducting the conference, conferencing platforms may process participants’ data for security purposes or to improve their services. The data processed may include personal details, such as first name and surname; contact details, such as email address and telephone number; access details, such as access codes or passwords; profile images; information about a participant’s professional position or role; the IP address of their internet connection; information about their device, operating system and browser, including technical and language settings; communications content, such as chat messages and audio and video data; and information about the use of other available functions, such as polls.
Communications content is encrypted to the extent technically supported by the relevant conferencing provider. Where participants are registered users of a conferencing platform, additional data may be processed in accordance with their agreement with the relevant provider.

Logging and recordings: Where text entries, participant responses, such as responses to polls, or video or audio recordings are recorded, participants will be clearly informed in advance and, where required, their consent will be obtained.

Data protection measures for participants: Please refer to the relevant conferencing platform’s privacy notice for details of how it processes your data and select the security and privacy settings that best meet your needs. During video conferences, please also take appropriate steps to protect the privacy and personal rights of anyone who may appear or be heard in the background. This may include informing other members of your household, securing doors and, where technically possible, using the background blur function. Links to conference rooms and access credentials must not be shared with unauthorised third parties.

Information on the lawful bases for processing: Where we process users’ data in addition to the conferencing platforms and ask users to consent to the use of those platforms or specific functions, such as the recording of conferences, the processing is based on that consent. Processing may also be necessary to fulfil our contractual obligations, for example in connection with participant lists or the documentation and follow-up of meeting outcomes. In all other cases, users’ data is processed on the basis of our legitimate interests in communicating efficiently and securely with our communication partners.

  • Categories of data processed: Master data (e.g. names and addresses); contact data (e.g. email addresses and telephone numbers); content data (e.g. information entered in online forms); usage data (e.g. websites visited, interest in particular content and access times); metadata and communication data (e.g. device information and IP addresses).
  • Categories of data subjects: Communication partners; users (e.g. website visitors and users of online services); individuals depicted.
  • Purposes of processing: Provision of contractual services and customer service; contact enquiries and communication; office and organisational procedures.
  • Lawful basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • TeamViewer: Conferencing software; service provider: TeamViewer Germany GmbH, Bahnhofsplatz 2, 73033 Göppingen, Germany; lawful basis: Legitimate interests (Article 6(1)(f) GDPR); website: https://www.teamviewer.com/en/; privacy notice: https://www.teamviewer.com/en/legal/privacy-and-cookies/.
  • edudip: Webinar software; service provider: edudip GmbH, Jülicher Straße 306, 52070 Aachen, Germany; lawful basis: Legitimate interests (Article 6(1)(f) GDPR); website: https://edudip.com/; privacy notice: https://edudip.com/privacy-policy/.

Recruitment processes

The recruitment process requires applicants to provide the information necessary for us to assess their application and make a selection decision. The information required is specified in the relevant job description or, where online forms are used, in the form itself.

As a rule, applicants are required to provide personal information, including their name, address and contact details, together with evidence of the qualifications required for the position. We will provide further details of the information required on request.

Where available, applicants may submit their applications using an online form. The data is transmitted to us using encryption in line with current technical standards. Applicants may also send their applications by email. However, please note that emails are not generally transmitted over the internet using end-to-end encryption. Although emails are usually encrypted in transit, they may not be encrypted on the servers from which they are sent or on which they are received. We therefore cannot accept responsibility for the transmission of an application between the sender and its receipt on our server.

For the purposes of candidate sourcing, receiving applications and selecting applicants, we may, in accordance with applicable legal requirements, use applicant management and recruitment software, as well as platforms and services provided by third parties.

Applicants are welcome to contact us regarding how to submit their application or to send their application to us by post.

Processing of special categories of personal data: Where applicants are asked to provide special categories of personal data within the meaning of Article 9(1) GDPR during the recruitment process, such as health data, including information concerning a recognised severe disability, or data revealing ethnic origin, this data is processed in accordance with Article 9(2)(b) GDPR where necessary to enable the controller or the data subject to carry out their obligations and exercise specific rights under employment, social security and social protection law.
Where processing is necessary to protect the vital interests of applicants or other individuals, it is carried out in accordance with Article 9(2)(c) GDPR. Where it is necessary for preventive or occupational medicine, assessing an employee’s capacity for work, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services, it is carried out in accordance with Article 9(2)(h) GDPR. Where applicants voluntarily provide special categories of personal data on the basis of consent, the processing is based on Article 9(2)(a) GDPR.

Erasure of data: Where an application is successful, we may continue to process the data provided by the applicant for the purposes of the employment relationship. Where an application is unsuccessful, the applicant’s data will be erased. The data will also be erased if the application is withdrawn, which applicants may do at any time.
Subject to any valid withdrawal by the applicant, the data will be erased no later than six months after the recruitment process has concluded. This retention period enables us to respond to any subsequent enquiries concerning the application and to meet our evidential obligations under the applicable equal treatment legislation. Invoices relating to any reimbursement of travel expenses will be retained in accordance with applicable tax requirements.

Inclusion in an applicant pool: Where an applicant pool is offered, applicants will only be included on the basis of their consent. Applicants will be informed that consent to inclusion in the talent pool is voluntary, has no bearing on the current recruitment process and may be withdrawn at any time with effect for the future.

Data retention period for the applicant pool: three months

  • Categories of data processed: Master data (e.g. names and addresses); contact data (e.g. email addresses and telephone numbers); content data (e.g. information entered in online forms); applicant data (e.g. personal details, postal addresses and contact details, application documents and the information they contain, such as cover letters, CVs and certificates, as well as any further information about applicants or their qualifications provided in relation to a specific position or voluntarily by the applicant).
  • Categories of data subjects: Applicants.
  • Purposes of processing: Recruitment process, including entering into and, where applicable, administering and terminating an employment relationship.
  • Lawful basis: Recruitment process as a pre-contractual or contractual relationship (Article 6(1)(b) GDPR).

Further information on processing activities, procedures and services:

  • Personio: Applicant data (e.g. personal details, postal and contact addresses, application documents and the information they contain, such as cover letters, CVs, references and certificates, as well as any further information about the applicant or their qualifications provided in relation to a specific position or voluntarily by the applicant); service provider: Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany; website: https://www.personio.com/; privacy notice: https://www.personio.com/privacy-policy/.

Cloud services

We use self-hosted cloud storage systems accessible via the internet to store and manage content, for example to store and manage documents, share documents, content and information with specified recipients, or publish content and information.

In this context, personal data may be processed and stored on servers where it forms part of communications with us. This may include, in particular, the IP address used to access the service, as well as other usage data and metadata used for security purposes and service optimisation.

  • Categories of data processed: Usage data (e.g. access times); metadata and communication data (e.g. device information and IP addresses).
  • Categories of data subjects: Customers; employees (e.g. members of staff, applicants and former employees); prospective customers; communication partners.
  • Purposes of processing: Office and organisational procedures; IT infrastructure (operation and provision of information systems and technical equipment, such as computers and servers).
  • Lawful basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • Nextcloud: Cloud storage; service provider: CAIGOS.

Newsletters and electronic notifications

We send newsletters, emails and other electronic communications (hereinafter referred to as ‘newsletters’) only with the recipients’ consent or where otherwise permitted by law. Where the content of a newsletter is specifically described during the subscription process, that description determines the scope of the user’s consent. Otherwise, our newsletters contain information about our company and the services we provide.

As a rule, all you need to subscribe to our newsletters is your email address. We may, however, ask you to provide your name so that we can address you personally in the newsletter, or request further information where this is required for the purposes of the newsletter.

Double opt-in procedure: We generally use a double opt-in procedure for newsletter subscriptions. After subscribing, you will receive an email asking you to confirm your subscription. This confirmation is required to prevent anyone from subscribing using another person’s email address. The subscription process is logged so that we can demonstrate compliance with the applicable legal requirements. This includes recording the date and time of both the initial subscription and its confirmation, together with the IP address. Any changes to your data stored by the email service provider are also logged.

Erasure and restriction of processing: We may retain unsubscribed email addresses for up to three years on the basis of our legitimate interests before erasing them, so that we can demonstrate that consent was previously given. The processing of this data is restricted to the defence of potential legal claims. An individual request for erasure may be submitted at any time, provided that the previous existence of consent is confirmed at the same time. Where we are required to ensure that objections continue to be respected, we reserve the right to retain the email address solely for this purpose on a suppression list.

The subscription process is logged on the basis of our legitimate interests in demonstrating that it has been carried out correctly. Where we engage a service provider to send emails, we do so on the basis of our legitimate interests in operating an efficient and secure email distribution system.

Content:

Information about our company, our services, campaigns and offers.

  • Categories of data processed: Master data (e.g. names and addresses); contact data (e.g. email addresses and telephone numbers); metadata and communication data (e.g. device information and IP addresses); usage data (e.g. websites visited, interest in particular content and access times).
  • Categories of data subjects: Communication partners.
  • Purposes of processing: Direct marketing (e.g. by email or post); audience measurement (e.g. access statistics and identification of returning visitors).
  • Lawful basis: Consent (Article 6(1)(a) GDPR).
  • Right to unsubscribe (opt-out): You may unsubscribe from our newsletter at any time by withdrawing your consent or objecting to further receipt. An unsubscribe link is provided at the end of each newsletter. Alternatively, you may use any of the contact details provided above, preferably by email.

Further information on processing activities, procedures and services:

  • Measurement of open and click rates: Our newsletters contain a web beacon, i.e. a one-pixel file that is retrieved from our server when the newsletter is opened or, where we use an email service provider, from that provider’s server. When the file is retrieved, technical information is collected, including information about your browser and system, your IP address and the time of access.
    This information is used to improve our newsletters from a technical perspective and to analyse our target audiences and their reading behaviour based on approximate access locations, which can be determined using the IP address, and access times. The analysis also determines whether and when newsletters are opened and which links are clicked.
    This information is associated with individual newsletter recipients and stored in their profiles until those profiles are deleted. The analysis helps us understand users’ reading habits, tailor our content accordingly and send different content based on users’ interests.
    Open and click rates are measured, the results are stored in users’ profiles and the data is processed further on the basis of users’ consent. It is not possible to withdraw consent separately for performance measurement. To stop this processing, users must unsubscribe from or object to receiving the newsletter in its entirety. In this case, the stored profile information will be deleted. Lawful basis: Consent (Article 6(1)(a) GDPR).
  • Rapidmail: Email marketing platform; service provider: Positive Group Deutschland GmbH, Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau, Germany; lawful basis: Consent (Article 6(1)(a) GDPR); website: https://www.rapidmail.de/; privacy notice: https://www.rapidmail.de/datenschutz/.

Web analytics, monitoring and optimisation

Web analytics, also referred to as audience measurement, is used to analyse visitor traffic across our online services. This may include pseudonymised information about visitors’ behaviour, interests and demographic characteristics, such as age or gender. Audience analysis enables us, for example, to identify when our online services, features or content are used most frequently or encourage repeat use. It also helps us determine which areas require optimisation.

In addition to web analytics, we may use testing methods to test and optimise different versions of our online services or individual elements of them.

Unless otherwise stated below, profiles may be created for these purposes by combining data relating to a particular use of our online services. Information may also be stored in and retrieved from a browser or device. The data collected includes, in particular, websites visited and elements used on those websites, as well as technical information such as the browser and computer system used and details of usage times. Where users have consented to the collection of their location data by us or by the providers of the services we use, location data may also be processed.

Users’ IP addresses are also stored. However, to protect users, we apply IP address masking, which pseudonymises the data by truncating the IP address. As a general rule, web analytics, A/B testing and optimisation do not involve storing directly identifying user data, such as email addresses or names. Instead, pseudonymous identifiers are used. This means that neither we nor the providers of the software we use know the users’ actual identities; they have access only to the information stored in the relevant profiles for the purposes of these activities.

  • Categories of data processed: Usage data (e.g. websites visited, interest in particular content and access times); metadata and communication data (e.g. device information and IP addresses).
  • Categories of data subjects: Users (e.g. website visitors and users of online services).
  • Purposes of processing: Audience measurement (e.g. access statistics and identification of returning visitors); profiles containing user-related information (creation of user profiles).
  • Security measures: IP masking (pseudonymisation of the IP address).
  • Lawful basis: Consent (Article 6(1)(a) GDPR).

Further information on processing activities, procedures and services:

  • Microsoft Clarity: We use Microsoft Clarity to understand how you use and interact with our website. Behavioural metrics, heatmaps and session replays help us improve and market our products and services. Website usage data is collected using first-party and third-party cookies and other tracking technologies to assess the popularity of our products and services and users’ online activity. We also use this information to optimise our website, prevent fraud, maintain security and support advertising activities. Further information about how Microsoft collects and uses your data is available in the Microsoft Privacy Statement.
    Service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; lawful basis: Consent (Article 6(1)(a) GDPR); website: https://clarity.microsoft.com/privacy; privacy statement: https://www.microsoft.com/en-us/privacy/privacystatement; standard contractual clauses (safeguarding data protection when data is processed in third countries): https://clarity.microsoft.com/terms
  • Bing Webmaster Tools: We use Microsoft Bing Webmaster Tools to optimise our website. No personal data is transferred to Microsoft through the use of this service. Further information about the service is available in Microsoft Corporation’s privacy statement.

Bing Webmaster Tools stores cookies on your computer, which Microsoft uses both to provide Bing services and to deliver more relevant search results. You can prevent the use of these cookies by disabling cookies in your browser settings.

Microsoft also uses web beacons to set cookies and generate analytics. These beacons enable Microsoft to provide more relevant results through Bing services and improve the quality, security and integrity of those services. The information is used to maintain and improve the relevance of search results. It can also help identify security vulnerabilities and protect you against threats such as botnet attacks, click fraud and other security risks. (Source: Microsoft)

You can opt out of this data collection by setting an opt-out cookie that prevents your data from being collected on our website. The opt-out cookie can be set via the following website: https://ssl.bing.com/profile/history?oma=toggle_off

Service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; lawful basis: Consent (Article 6(1)(a) GDPR); website: https://www.bing.com/webmasters/about?cc=gb; privacy statement: https://www.microsoft.com/en-gb/privacy/privacystatement/; standard contractual clauses (safeguarding data protection when data is processed in third countries): https://www.microsoft.com/en-gb/servicesagreement/

  • Google Tag Manager: Google Tag Manager enables us to integrate tracking and analytics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies or carry out any independent analysis. It is used solely to manage and deploy the tools integrated through it. However, Google Tag Manager records your IP address, which may also be transferred to Google’s parent company in the United States.

Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; lawful basis: Consent (Article 6(1)(a) GDPR); website: https://marketingplatform.google.com/intl/en_uk/about/analytics/; privacy policy: https://policies.google.com/privacy; data processing terms: https://business.safety.google/adsprocessorterms/; standard contractual clauses (safeguarding data protection when data is processed in third countries): https://business.safety.google/adsprocessorterms/

  • Google Analytics: We use Google Analytics to analyse user behaviour on the basis of a pseudonymous user ID. This ID does not contain any directly identifying information, such as names or email addresses. It is used to associate analytics data with a device so that we can determine which content users have accessed during one or more sessions, which search terms they have used, whether they have returned to previously viewed content and how they have interacted with our online services. We also record the time and duration of use, the referral sources through which users reach our online services, and technical information about their devices and browsers. Pseudonymous user profiles are created using information from activity across different devices, and cookies may be used for this purpose. Google Analytics provides broader geographical location data by deriving the following metadata through IP-based lookup: city, including the city’s derived latitude and longitude, continent, country, region and subcontinent, together with the corresponding ID-based values. To protect user data in the EU, Google receives and processes all user data through domains and servers located within the EU. Users’ IP addresses are not logged and are truncated by default by removing the final two digits. For users in the EU, IP address truncation takes place on servers within the EU. In addition, any sensitive data collected from users in the EU is deleted before it is recorded through EU domains and servers; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; lawful basis: Consent (Article 6(1)(a) GDPR); website: https://marketingplatform.google.com/intl/en_uk/about/analytics/; privacy policy: https://policies.google.com/privacy; data processing terms: https://business.safety.google/adsprocessorterms/; standard contractual clauses (safeguarding data protection when data is processed in third countries): https://business.safety.google/adsprocessorterms; opt-out options: browser opt-out add-on: https://tools.google.com/dlpage/gaoptout?hl=en-GB, advertising settings: https://adssettings.google.com/authenticated; further information: https://privacy.google.com/businesses/adsservices (types of processing and categories of data processed).

Presence on social media platforms

We maintain a presence on social media platforms and, in this context, process users’ data in order to communicate with users active on those platforms or provide information about us.

Please note that users’ data may be processed outside the European Union. This may pose risks to users, as it could, for example, make it more difficult for them to enforce their rights.

Users’ data is also generally processed within social networks for market research and advertising purposes. User profiles may be created based, for example, on users’ behaviour and the interests inferred from it. These profiles may then be used to display advertisements within and outside the networks that are likely to reflect users’ interests. For these purposes, cookies containing information about users’ behaviour and interests are generally stored on their devices. User profiles may also contain data collected across different devices, particularly where users are registered with and logged in to the relevant platforms.

For detailed information about the relevant types of processing and the available opt-out options, please refer to the privacy policies and information provided by the operators of the respective networks.

With regard to requests for access and the exercise of data subject rights, please note that these can be handled most effectively by the relevant providers. Only the providers have access to users’ data and can take appropriate action and provide information directly. Should you nevertheless require assistance, you may contact us.



  • Categories of data processed: Contact data (e.g. email addresses and telephone numbers); content data (e.g. information entered in online forms); usage data (e.g. websites visited, interest in particular content and access times); metadata and communication data (e.g. device information and IP addresses).
  • Categories of data subjects: Users (e.g. website visitors and users of online services).
  • Purposes of processing: Contact enquiries and communication; feedback (e.g. collecting feedback via an online form); marketing.
  • Lawful basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • Instagram: Social network; service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; lawful basis: Legitimate interests (Article 6(1)(f) GDPR); website: https://www.instagram.com; privacy policy: https://instagram.com/about/legal/privacy.
  • Facebook Pages: Profiles on the Facebook social network – We and Meta Platforms Ireland Limited are joint controllers for the collection of data from visitors to our Facebook Page, also known as a fan page, but not for any subsequent processing of that data. This data includes information about the types of content users view or interact with and the actions they take (see “Things you and others do and provide” in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices they use, such as IP addresses, operating system, browser type, language settings and cookie data (see “Device information” in the Facebook Data Policy: https://www.facebook.com/policy). As explained under “How do we use this information?” in the Facebook Data Policy, Facebook also collects and uses information to provide Page Insights analytics services to Page administrators. These services enable administrators to understand how people interact with their Pages and associated content. We have entered into a specific agreement with Facebook, the Page Insights Controller Addendum (https://www.facebook.com/legal/terms/page_controller_addendum), which specifies, in particular, the security measures Facebook must implement and under which Facebook has agreed to facilitate the exercise of data subject rights. Users may therefore submit requests for access or erasure directly to Facebook. The agreement with Facebook does not restrict users’ rights, particularly their rights of access, erasure and objection and their right to lodge a complaint with the competent supervisory authority. Further information is available in the Information about Page Insights Data (https://www.facebook.com/legal/terms/information_about_page_insights_data); service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; lawful basis: Legitimate interests (Article 6(1)(f) GDPR); website: https://www.facebook.com; privacy policy: https://www.facebook.com/about/privacy; standard contractual clauses (safeguarding data protection when data is processed in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; further information: joint controller arrangement: https://www.facebook.com/legal/terms/information_about_page_insights_data. Joint controllership is limited to the collection and transfer of data to Meta Platforms Ireland Limited, a company established in the EU. Meta Platforms Ireland Limited is solely responsible for any subsequent processing, including, in particular, the transfer of data to its parent company, Meta Platforms, Inc., in the United States, on the basis of the standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.
  • LinkedIn: Social network; service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; lawful basis: Legitimate interests (Article 6(1)(f) GDPR); website: https://www.linkedin.com; privacy policy: https://www.linkedin.com/legal/privacy-policy; data processing agreement: https://legal.linkedin.com/dpa; standard contractual clauses (safeguarding data protection when data is processed in third countries): https://legal.linkedin.com/dpa; opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
  • YouTube: Social network and video platform; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; lawful basis: Legitimate interests (Article 6(1)(f) GDPR); privacy policy: https://policies.google.com/privacy; opt-out option: https://adssettings.google.com/authenticated.

Plugins, embedded functions and content

Our online services incorporate features and content retrieved from servers operated by the respective providers (referred to below as “third-party providers”). These may include, for example, graphics, videos or city maps (collectively referred to below as “content”).

Embedding this content always requires the relevant third-party providers to process users’ IP addresses, as they would otherwise be unable to deliver the content to users’ browsers. The IP address is therefore necessary to display the content or features. We endeavour to use only content from providers that use the IP address solely to deliver that content. Third-party providers may also use pixel tags, which are invisible graphics also known as web beacons, for statistical or marketing purposes. Pixel tags can be used to analyse information such as traffic to pages on this website. Pseudonymous information may also be stored in cookies on users’ devices. This may include technical information about the browser and operating system, referring websites, the time of the visit and other details concerning the use of our online services. This information may also be combined with corresponding information from other sources.

  • Categories of data processed: Usage data (e.g. websites visited, interest in particular content and access times); metadata and communication data (e.g. device information and IP addresses); master data (e.g. names and addresses); contact data (e.g. email addresses and telephone numbers); content data (e.g. information entered in online forms); location data (information about the geographical location of a device or person).
  • Categories of data subjects: Users (e.g. website visitors and users of online services).
  • Purposes of processing: Provision and usability of our online services.
  • Lawful basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

Management, organisation and support tools

We use services, platforms and software provided by other providers (referred to below as “third-party providers”) for organisational, administrative and planning purposes and to provide our services. We select third-party providers and their services in accordance with applicable legal requirements.

In this context, personal data may be processed and stored on the servers of third-party providers. This may involve various categories of data that we process in accordance with this privacy notice. These may include, in particular, users’ master data and contact data, as well as data relating to transactions, contracts, other processes and their content.

Where users are referred to third-party providers or their software or platforms in connection with communications, business relationships or other interactions with us, those providers may process usage data and metadata for security, service optimisation or marketing purposes. Users should therefore consult the privacy notices of the relevant third-party providers.

  • Categories of data processed: Content data (e.g. information entered in online forms); usage data (e.g. websites visited, interest in particular content and access times); metadata and communication data (e.g. device information and IP addresses).
  • Categories of data subjects: Communication partners; users (e.g. website visitors and users of online services).
  • Purposes of processing: Provision of contractual services and customer service; office and organisational procedures.

Amendments and updates to this privacy notice

Please review this privacy notice regularly to keep up to date with its content. We will amend the privacy notice whenever changes to our data processing activities make this necessary. We will inform you where any amendment requires action on your part, such as providing consent, or any other individual notification.

Where this privacy notice provides addresses and contact details for companies and organisations, please note that these may change over time. Please check the details before contacting them.

Data subject rights

As a data subject, you have various rights under the GDPR, in particular under Articles 15 to 21 GDPR:

  • Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR; this also applies to profiling based on those provisions. Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of such data for such marketing; this includes profiling to the extent that it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw your consent at any time.
  • Right of access: You have the right to obtain confirmation as to whether personal data concerning you are being processed and, where this is the case, to access those data and receive further information and a copy of the data in accordance with the applicable legal requirements.
  • Right to rectification: In accordance with the applicable legal requirements, you have the right to request the completion of incomplete personal data concerning you or the rectification of inaccurate personal data concerning you.
  • Right to erasure and restriction of processing: In accordance with the applicable legal requirements, you have the right to request the erasure of personal data concerning you without undue delay or, alternatively, to request restriction of the processing of such data.
  • Right to data portability: You have the right to receive personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request that those data be transmitted to another controller, in accordance with the applicable legal requirements.
  • Right to lodge a complaint with a supervisory authority: In accordance with the applicable legal requirements and without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Supervisory authority responsible for us:

Unabhängiges Datenschutzzentrum Saarland
Fritz-Dobisch-Str. 12
66111 Saarbrücken
Tel. 0681 94781-0
Fax 0681 94781-29
poststelle@datenschutz.saarland.de

Definitions of terms

This section provides an overview of the terms used in this privacy notice. Many of these terms are defined by law, particularly in Article 4 GDPR. The statutory definitions are binding, while the explanations below are intended primarily to aid understanding. The terms are listed in alphabetical order.

  • Conversion tracking: Conversion tracking, also referred to as conversion analysis, is a method used to assess the effectiveness of marketing activities. This generally involves storing a cookie on users’ devices when they visit websites on which the marketing activities take place and subsequently reading that cookie again on the destination website. This enables us, for example, to determine whether advertisements placed by us on other websites have been effective.
  • Personal data: “Personal data” means any information relating to an identified or identifiable living natural person (referred to below as the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Profiles containing user-related information: The processing of “profiles containing user-related information”, or “profiles” for short, includes any form of automated processing of personal data that uses such data to analyse, evaluate or predict certain personal aspects relating to a natural person. Depending on the type of profiling, this may involve information about demographic characteristics, behaviour and interests, such as interactions with websites and their content. Predictions may relate, for example, to an individual’s interest in particular content or products, their clicking behaviour on a website or their location. Cookies and web beacons are frequently used for profiling purposes.
  • Audience measurement: Audience measurement, also known as web analytics, is used to analyse visitor traffic across an online service and may include visitors’ behaviour or interest in specific information, such as website content. Audience analysis enables website operators, for example, to identify when visitors access their website and which content interests them. This allows them to tailor the website’s content more closely to visitors’ needs. Pseudonymous cookies and web beacons are frequently used for audience analysis to recognise returning visitors and provide more accurate insights into how an online service is used.
  • Location data: Location data is generated when a mobile device, or another device with location-detection capabilities, connects to a mobile network cell, Wi-Fi network or similar location-based technologies and services. Location data indicates the geographically identifiable position of the relevant device. It may be used, for example, to provide map features or other location-dependent information.
  • Tracking: “Tracking” refers to the monitoring of users’ behaviour across multiple online services. Information about users’ behaviour and interests in relation to the online services they use is generally stored in cookies or on the servers of tracking technology providers, a process known as profiling. This information may then be used, for example, to display advertisements to users that are likely to reflect their interests.
  • Controller: A “controller” is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.
  • Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, including its collection, analysis, storage, transmission or erasure.
Support