Legal

Privacy Policy

Which personal data we process, for which purposes and to what extent.

As of: November 2026GDPR · BDSG

Introduction

With the following privacy policy, we would like to inform you which types of your personal data (hereinafter also referred to as “data”) we process, for which purposes and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the course of providing our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “online offering”).

The terms used are not gender-specific.

Controller

ycon solutions GmbH
Bluetenallee 16
64291 Darmstadt
Germany

E-mail address: info@ycon-solutions.com

Imprint: ycon-solutions.com/imprint

Overview of processing operations

The following overview summarizes the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of data processed

Master data (e.g. names, addresses).
Applicant data (e.g. personal details, postal and contact addresses, the documents belonging to the application and the information they contain, such as cover letter, CV, references and other information about the applicant’s person or qualifications provided with regard to a specific position or voluntarily).
Content data (e.g. entries in online forms).
Contact data (e.g. e-mail, telephone numbers).
Meta/communication data (e.g. device information, IP addresses).
Usage data (e.g. websites visited, interest in content, access times).
Contract data (e.g. subject matter of the contract, term, customer category).
Payment data (e.g. bank details, invoices, payment history).

Categories of data subjects

Employees (e.g. staff, applicants, former employees).
Applicants.
Business and contractual partners.
Prospective customers.
Communication partners.
Users (e.g. website visitors, users of online services).

Purposes of processing

Provision of our online offering and user-friendliness.
Application process (establishment and any subsequent performance as well as possible subsequent termination of the employment relationship).
Office and organizational procedures.
Content Delivery Network (CDN).
Contact requests and communication.
Profiles with user-related information (creation of user profiles).
Reach measurement (e.g. access statistics, recognition of returning visitors).
Provision of contractual services and customer service.
Management and answering of enquiries.

Relevant legal bases

Below you will find an overview of the legal bases of the GDPR on which we base the processing of personal data. Please note that, in addition to the provisions of the GDPR, national data protection provisions of your or our country of residence or domicile may apply. Should more specific legal bases be relevant in individual cases, we will inform you of these in this privacy policy.

Consent (Art. 6 (1) sentence 1 lit. a GDPR) – The data subject has given consent to the processing of personal data concerning him or her for one or more specific purposes.
Performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 lit. b GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Legal obligation (Art. 6 (1) sentence 1 lit. c GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
Legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
Application process as a pre-contractual or contractual relationship (Art. 9 (2) lit. b GDPR) – Where special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g. health data such as severe disability status or ethnic origin) are requested from applicants in the course of the application process so that the controller or the data subject can exercise the rights arising from employment law and social security and social protection law and fulfil his or her obligations in this respect, such data is processed in accordance with Art. 9 (2) lit. b GDPR; in the case of the protection of vital interests of the applicants or other persons in accordance with Art. 9 (2) lit. c GDPR; or for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, for medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services in accordance with Art. 9 (2) lit. h GDPR. Where special categories of data are disclosed on the basis of voluntary consent, they are processed on the basis of Art. 9 (2) lit. a GDPR.

National data protection regulations in Germany: In addition to the data protection provisions of the General Data Protection Regulation, national data protection regulations apply in Germany. These include in particular the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains in particular special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transfer, as well as automated decision-making in individual cases, including profiling. It also regulates data processing for the purposes of the employment relationship (Section 26 BDSG), in particular with regard to the establishment, performance or termination of employment relationships and the consent of employees. Furthermore, data protection laws of the individual federal states may apply.

Security measures

In accordance with the legal requirements and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input, disclosure, assurance of availability and separation of the data. Furthermore, we have established procedures to ensure the exercise of data subjects’ rights, the erasure of data and responses to threats to the data. We also take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in line with the principle of data protection by design and by default.

Truncation of IP addresses: Where IP addresses are processed by us or by the service providers and technologies we use and the processing of a complete IP address is not necessary, the IP address is truncated (also referred to as “IP masking”). The last two digits, or the last part of the IP address after a full stop, are removed or replaced by placeholders. Truncating the IP address is intended to prevent, or substantially hinder, the identification of a person on the basis of their IP address.

SSL encryption (https): To protect the data you transmit via our online offering, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.

Transfer of personal data

In the course of our processing of personal data, the data may be transferred to or disclosed to other bodies, companies, legally independent organizational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are embedded in a website. In such cases, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

Data transfer within the group of companies: We may transfer personal data to other companies within our group of companies or grant them access to this data. Where this disclosure is made for administrative purposes, it is based on our legitimate business and commercial interests, or takes place where it is necessary to fulfil our contract-related obligations or where the data subjects have given their consent or there is a legal permission.

Data transfer within the organization: We may transfer personal data to other departments within our organization or grant them access to this data. Where this disclosure is made for administrative purposes, it is based on our legitimate business and commercial interests, or takes place where it is necessary to fulfil our contract-related obligations or where the data subjects have given their consent or there is a legal permission.

Data processing in third countries

Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where the processing takes place in the context of using third-party services or disclosing or transferring data to other persons, bodies or companies, this is done only in accordance with the legal requirements.

Subject to express consent or a transfer required by contract or law, we process data, or have it processed, only in third countries with a recognized level of data protection, on the basis of contractual obligations in the form of the so-called standard contractual clauses of the EU Commission, where certifications exist, or on the basis of binding corporate rules (Art. 44 to 49 GDPR; information page of the EU Commission: ec.europa.eu – International dimension of data protection).

Use of cookies

Cookies are text files that contain data from websites or domains visited and are stored by a browser on the user’s computer. A cookie is primarily used to store information about a user during or after their visit within an online offering. The information stored may include, for example, the language settings on a website, the login status, a shopping cart or the point at which a video was watched. We also count other technologies that perform the same functions as cookies as cookies (e.g. when user information is stored using pseudonymous online identifiers, also referred to as “user IDs”).

The following cookie types and functions are distinguished

Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offering and closed their browser.
Permanent cookies: Permanent cookies remain stored even after the browser is closed. For example, the login status can be saved or preferred content displayed directly when the user visits a website again. Users’ interests used for reach measurement or marketing purposes may also be stored in such a cookie.
First-party cookies: First-party cookies are set by us ourselves.
Third-party cookies: Third-party cookies are mainly used by advertisers (so-called third parties) to process user information.
Necessary (also: essential or strictly necessary) cookies: Cookies may be strictly necessary for the operation of a website (e.g. to store logins or other user input, or for security reasons).
Statistics, marketing and personalization cookies: Furthermore, cookies are generally also used for reach measurement and when a user’s interests or behaviour (e.g. viewing certain content, using functions, etc.) on individual websites are stored in a user profile. Such profiles are used, for example, to show users content that matches their potential interests. This procedure is also referred to as “tracking”, i.e. following the potential interests of users. Where we use cookies or “tracking” technologies, we inform you separately in our privacy policy or when obtaining consent.

Notes on legal bases: The legal basis on which we process your personal data using cookies depends on whether we ask you for consent. If this is the case and you consent to the use of cookies, the legal basis for processing your data is the consent you have given. Otherwise, the data processed with the help of cookies is processed on the basis of our legitimate interests (e.g. in the commercial operation of our online offering and its improvement) or, where the use of cookies is necessary, in order to fulfil our contractual obligations.

Storage period: Unless we provide you with explicit information on the storage period of permanent cookies (e.g. in the context of a so-called cookie opt-in), please assume that the storage period may be up to two years.

General information on withdrawal and objection (opt-out): Depending on whether the processing is based on consent or a legal permission, you can at any time withdraw any consent you have given or object to the processing of your data by cookie technologies (collectively referred to as “opt-out”). You can first declare your objection via your browser settings, e.g. by deactivating the use of cookies (although this may also restrict the functionality of our online offering). An objection to the use of cookies for online marketing purposes can also be declared for a large number of services, especially in the case of tracking, via the websites optout.aboutads.info and youronlinechoices.com. You can also find further information on objection in the details of the service providers and cookies used.

Processing of cookie data on the basis of consent: We use a cookie consent management procedure in which users’ consent to the use of cookies, or to the processing operations and providers named in the cookie consent management procedure, is obtained and can be managed and withdrawn by the users. The declaration of consent is stored so that it does not have to be requested again and so that consent can be proven in accordance with the legal obligation. Storage can take place on the server and/or in a cookie (so-called opt-in cookie, or using comparable technologies) in order to be able to assign the consent to a user or their device. Subject to individual information on the providers of cookie management services, the following applies: the consent may be stored for up to two years. A pseudonymous user identifier is created and stored together with the time of consent, information on the scope of the consent (e.g. which categories of cookies and/or service providers) and the browser, system and device used.

Types of data processedUsage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
Data subjectsUsers (e.g. website visitors, users of online services).
Legal basesConsent (Art. 6 (1) sentence 1 lit. a GDPR), legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

Services and service providers used

CookiebotCookie consent management; service provider: Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark; website: cookiebot.com; privacy policy: cookiebot.com/en/privacy-policy; data stored (on the service provider’s server): the user’s IP number in anonymized form (the last three digits are set to 0), date and time of consent, browser details, the URL from which consent was sent, an anonymous, random and encrypted key value; the user’s consent status.

Business services

We process data of our contractual and business partners, e.g. customers and prospective customers (collectively referred to as “contractual partners”), in the context of contractual and comparable legal relationships and related measures, and in the context of communication with contractual partners (or pre-contractually), e.g. to answer enquiries.

We process this data to fulfil our contractual obligations, to safeguard our rights and for the purposes of the administrative tasks associated with this information and the organization of our business. Within the framework of applicable law, we only pass on the data of contractual partners to third parties insofar as this is necessary for the aforementioned purposes or to fulfil legal obligations, or with the consent of the data subjects (e.g. to participating telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Contractual partners are informed about further forms of processing, e.g. for marketing purposes, within the framework of this privacy policy.

We inform contractual partners which data is required for the aforementioned purposes before or during data collection, e.g. in online forms, by special marking (e.g. colours) or symbols (e.g. asterisks or similar), or in person.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e. generally after 4 years, unless the data is stored in a customer account, e.g. as long as it must be retained for legal archiving reasons (e.g. generally 10 years for tax purposes). Data disclosed to us by the contractual partner in the context of an order is deleted in accordance with the specifications of the order, generally after the end of the order.

Where we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.

Project and development services: We process the data of our customers and clients (hereinafter uniformly referred to as “customers”) to enable them to select, acquire or commission the selected services or works and related activities, as well as their payment and provision, execution or performance.

The required information is marked as such in the context of the order or comparable conclusion of contract and includes the information required for the provision of services and invoicing as well as contact information in order to be able to hold any consultations. Where we gain access to information of end customers, employees or other persons, we process it in accordance with the legal and contractual requirements.

Provision of software and platform services: We process the data of our users, registered users and any test users (hereinafter uniformly referred to as “users”) in order to provide our contractual services to them and, on the basis of legitimate interests, to ensure the security of our offering and to develop it further. The required information is marked as such in the context of the order or comparable conclusion of contract and includes the information required for the provision of services and invoicing as well as contact information in order to be able to hold any consultations.

Types of data processedMaster data (e.g. names, addresses), payment data (e.g. bank details, invoices, payment history), contact data (e.g. e-mail, telephone numbers), contract data (e.g. subject matter of the contract, term, customer category).
Data subjectsProspective customers, business and contractual partners.
Purposes of processingProvision of contractual services and customer service, contact requests and communication, office and organizational procedures, management and answering of enquiries.
Legal basesPerformance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 lit. b GDPR), legal obligation (Art. 6 (1) sentence 1 lit. c GDPR), legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

Provision of the online offering and web hosting

In order to provide our online offering securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online offering can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security services and technical maintenance services.

The data processed in the context of providing the hosting offering may include all information relating to the users of our online offering that arises in the course of use and communication. This regularly includes the IP address, which is necessary to deliver the content of online offerings to browsers, and all entries made within our online offering or on websites.

E-mail sending and hosting: The web hosting services we use also include the sending, receipt and storage of e-mails. For these purposes, the addresses of the recipients and senders as well as further information regarding the sending of e-mails (e.g. the providers involved) and the contents of the respective e-mails are processed. The aforementioned data may also be processed for the purpose of detecting spam. Please note that e-mails on the internet are generally not sent in encrypted form. As a rule, e-mails are encrypted in transit, but (unless a so-called end-to-end encryption procedure is used) not on the servers from which they are sent and received. We can therefore accept no responsibility for the transmission path of e-mails between the sender and their receipt on our server.

Collection of access data and log files: We ourselves (or our web hosting provider) collect data on every access to the server (so-called server log files). The server log files may include the address and name of the websites and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user’s operating system, the referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.

The server log files can be used for security purposes, e.g. to avoid overloading the servers (especially in the event of abusive attacks, so-called DDoS attacks), and to ensure the utilization and stability of the servers.

Content delivery network: We use a “content delivery network” (CDN). A CDN is a service that helps deliver the content of an online offering, in particular large media files such as graphics or program scripts, faster and more securely using regionally distributed servers connected via the internet.

Types of data processedContent data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
Data subjectsUsers (e.g. website visitors, users of online services).
Purposes of processingProvision of our online offering and user-friendliness, content delivery network (CDN).
Legal basesLegitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

Services and service providers used

DigitalOceanServices in the field of providing information technology infrastructure and related services (e.g. storage space and/or computing capacity); service provider: DigitalOcean, data center Frankfurt, Germany; website: digitalocean.com – European region Frankfurt.

Special notes on applications (apps)

We process the data of the users of our application insofar as this is necessary to provide the application and its functionalities to the users, to monitor its security and to develop it further. We may also contact users in compliance with the legal requirements if communication is necessary for the purposes of administration or use of the application. Otherwise, with regard to the processing of user data, we refer to the data protection information in this privacy policy.

Legal bases: The processing of data that is necessary to provide the functionalities of the application serves to fulfil contractual obligations. This also applies if the provision of the functions requires an authorization by the users (e.g. release of device functions). Where the processing of data is not necessary to provide the functionalities of the application but serves the security of the application or our commercial interests (e.g. collection of data for the purpose of optimizing the application or for security purposes), it is based on our legitimate interests. Where users are expressly asked for their consent to the processing of their data, the data covered by the consent is processed on the basis of that consent.

Device permissions for access to functions and data: The use of our application or its functionalities may require users’ permissions to access certain functions of the devices used or the data stored on the devices or accessible with the help of the devices. By default, these permissions must be granted by the users and can be revoked at any time in the settings of the respective devices. The exact procedure for controlling app permissions may depend on the user’s device and software. Users can contact us if they need further explanation. Please note that refusing or revoking the respective permissions may affect the functionality of our application.

Types of data processedMaster data (e.g. names, addresses), meta/communication data (e.g. device information, IP addresses).
Purposes of processingProvision of contractual services and customer service.
Legal basesConsent (Art. 6 (1) sentence 1 lit. a GDPR), performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 lit. b GDPR), legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

Contacting us

When you contact us (e.g. via contact form, e-mail, telephone or social media), the details of the enquiring persons are processed insofar as this is necessary to answer the contact enquiries and any requested measures.

Contact enquiries in the context of contractual or pre-contractual relationships are answered in order to fulfil our contractual obligations or to respond to (pre-)contractual enquiries, and otherwise on the basis of our legitimate interest in answering the enquiries.

Types of data processedMaster data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms).
Data subjectsCommunication partners.
Purposes of processingContact requests and communication.
Legal basesPerformance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 lit. b GDPR), legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

Video conferences, online meetings, webinars and screen sharing

We use platforms and applications of other providers (hereinafter referred to as “conference platforms”) for the purpose of holding video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as “conference”). When selecting the conference platforms and their services, we observe the legal requirements.

Data processed by conference platforms: When participating in a conference, the conference platforms process the participants’ personal data listed below. The scope of the processing depends on which data is requested in the context of a specific conference (e.g. access data or real names) and which optional information is provided by the participants. In addition to processing for the purpose of holding the conference, participants’ data may also be processed by the conference platforms for security purposes or service optimization. The data processed includes personal details (first name, last name), contact information (e-mail address, telephone number), access data (access codes or passwords), profile pictures, information on professional position/function, the IP address of the internet connection, information on the participants’ end devices, their operating system, the browser and its technical and language settings, information on the content of communication processes, i.e. entries in chats as well as audio and video data, and the use of other available functions (e.g. surveys). The content of communications is encrypted to the extent technically provided by the conference providers. If participants are registered as users with the conference platforms, further data may be processed in accordance with the agreement with the respective conference provider.

Logging and recordings: If text entries, participation results (e.g. from surveys) or video or audio recordings are logged, participants will be informed of this transparently in advance and – where necessary – asked for their consent.

Participants’ data protection measures: For details of the processing of your data by the conference platforms, please refer to their privacy notices and choose the security and data protection settings that are best for you in the settings of the conference platforms. Please also ensure data and privacy protection in the background of your recording for the duration of a video conference (e.g. by informing housemates, locking doors and, where technically possible, using the function to blur the background). Links to the conference rooms and access data must not be passed on to unauthorized third parties.

Notes on legal bases: Where, in addition to the conference platforms, we also process users’ data and ask users for their consent to the use of the conference platforms or certain functions (e.g. consent to the recording of conferences), the legal basis for the processing is this consent. Furthermore, our processing may be necessary to fulfil our contractual obligations (e.g. in participant lists, when processing the results of discussions, etc.). Otherwise, users’ data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.

Types of data processedMaster data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
Data subjectsCommunication partners, users (e.g. website visitors, users of online services).
Purposes of processingProvision of contractual services and customer service, contact requests and communication, office and organizational procedures.
Legal basesConsent (Art. 6 (1) sentence 1 lit. a GDPR), performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 lit. b GDPR), legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

Services and service providers used

Cisco WebExConferencing software; service provider: Webex Communications Deutschland GmbH, Hansaallee 249, c/o Cisco Systems GmbH, 40549 Düsseldorf, Germany; parent company: Cisco Systems, Inc., 170 West Tasman Dr., San Jose, CA 95134, USA; website: webex.com; privacy policy: cisco.com/c/en/us/about/legal/privacy-full.html.
Microsoft TeamsMessenger and conferencing software; service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; website: products.office.com; privacy policy: privacy.microsoft.com/en-us/privacystatement; security information: microsoft.com/en-us/trust-center.

Application process

The application process requires applicants to provide us with the data necessary for their assessment and selection. Which information is required results from the job description or, in the case of online forms, from the information given there.

In principle, the required information includes personal details such as name, address, a means of contact and proof of the qualifications required for a position. On request, we will also be happy to tell you which information is required.

Where provided, applicants can submit their applications to us via an online form. The data is transmitted to us in encrypted form in accordance with the state of the art. Applicants can also send us their applications by e-mail. Please note, however, that e-mails on the internet are generally not sent in encrypted form. As a rule, e-mails are encrypted in transit, but not on the servers from which they are sent and received. We can therefore accept no responsibility for the transmission path of the application between the sender and its receipt on our server.

For the purposes of searching for applicants, submitting applications and selecting applicants, we may use applicant management or recruitment software as well as platforms and services of third-party providers in compliance with the legal requirements.

Applicants are welcome to contact us about how to submit their application or to send us their application by post.

Processing of special categories of data: Where special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g. health data such as severe disability status or ethnic origin) are requested from applicants in the course of the application process so that the controller or the data subject can exercise the rights arising from employment law and social security and social protection law and fulfil his or her obligations in this respect, such data is processed in accordance with Art. 9 (2) lit. b GDPR; in the case of the protection of vital interests of the applicants or other persons in accordance with Art. 9 (2) lit. c GDPR; or for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, for medical diagnosis, for the provision of health or social care or treatment, or for the management of health or social care systems and services in accordance with Art. 9 (2) lit. h GDPR. Where special categories of data are disclosed on the basis of voluntary consent, they are processed on the basis of Art. 9 (2) lit. a GDPR.

Erasure of data: In the case of a successful application, the data provided by applicants may be further processed by us for the purposes of the employment relationship. Otherwise, if the application for a job offer is unsuccessful, the applicants’ data will be deleted. Applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Subject to a justified withdrawal by the applicants, deletion takes place at the latest after a period of six months, so that we can answer any follow-up questions about the application and comply with our obligations to provide evidence under the regulations on the equal treatment of applicants. Invoices for any reimbursement of travel expenses are archived in accordance with tax law requirements.

Inclusion in an applicant pool: Inclusion in an applicant pool, if offered, is based on consent. Applicants are informed that their consent to inclusion in the talent pool is voluntary, has no influence on the current application process and that they can withdraw their consent at any time with effect for the future.

Types of data processedApplicant data (e.g. personal details, postal and contact addresses, the documents belonging to the application and the information they contain, such as cover letter, CV, references and other information about the applicant’s person or qualifications provided with regard to a specific position or voluntarily), master data (e.g. names, addresses), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
Data subjectsApplicants, employees (e.g. staff, applicants, former employees).
Purposes of processingApplication process (establishment and any subsequent performance as well as possible subsequent termination of the employment relationship).
Legal basesApplication process as a pre-contractual or contractual relationship (Art. 9 (2) lit. b GDPR), performance of a contract and pre-contractual enquiries (Art. 6 (1) sentence 1 lit. b GDPR), legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

Services and service providers used

LinkedIn RecruiterRecruiting platform and services; service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; website: linkedin.com; privacy policy: linkedin.com/legal/privacy-policy.

Web analytics, monitoring and optimization

Web analytics (also referred to as “reach measurement”) is used to evaluate the flow of visitors to our online offering and may include behaviour, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, recognize at what time our online offering or its functions or content are used most frequently or invite repeat use. We can also understand which areas need optimization.

In addition to web analytics, we may also use testing procedures, e.g. to test and optimize different versions of our online offering or its components.

For these purposes, so-called user profiles may be created and stored in a file (a so-called “cookie”), or similar procedures with the same purpose may be used. This information may include, for example, content viewed, websites visited and elements used there, and technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data, this may also be processed, depending on the provider.

Users’ IP addresses are also stored. However, we use an IP masking procedure (i.e. pseudonymization by truncating the IP address) to protect users. In general, no clear data of users (such as e-mail addresses or names) is stored in the context of web analytics, A/B testing and optimization, but pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for processing data is consent. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

Types of data processedUsage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
Data subjectsUsers (e.g. website visitors, users of online services).
Purposes of processingReach measurement (e.g. access statistics, recognition of returning visitors), profiles with user-related information (creation of user profiles).
Security measuresIP masking (pseudonymization of the IP address).
Legal basesConsent (Art. 6 (1) sentence 1 lit. a GDPR), legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR).

Services and service providers used

MatomoOur website uses Matomo, open-source software that collects and stores data. This information is used for marketing and optimization purposes. For this purpose, Matomo creates usage profiles under a pseudonym from the data. To do so, the software stores cookies (text files) on your computer, which can be used to analyse your use of the website. Your IP address is anonymized immediately after processing and before storage. The data is stored on the provider’s servers in Germany. If you do not want Matomo to store cookies, you can prevent the installation of cookies via your browser settings (you will find information on this in your browser’s help function). In this case, you may not be able to use all functions of the offering. Information on Matomo’s privacy provisions can be found at matomo.org/privacy.

Erasure of data

The data processed by us will be deleted in accordance with the legal requirements as soon as the consents permitting its processing are withdrawn or other permissions cease to apply (e.g. if the purpose of processing this data no longer applies or it is not required for the purpose).

If the data is not deleted because it is required for other, legally permissible purposes, its processing will be restricted to these purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

As part of our privacy notices, we may provide users with further information on the deletion and retention of data that applies specifically to the respective processing operations.

Changes and updates to this privacy policy

We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time and please check the information before contacting them.

Rights of data subjects

As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 (1) lit. e or f GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.

Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
Right of access: You have the right to request confirmation as to whether data concerning you is being processed and to access this data as well as further information and a copy of the data in accordance with the legal requirements.
Right to rectification: In accordance with the legal requirements, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to request that data concerning you be erased without delay or, alternatively, in accordance with the legal requirements, to request restriction of the processing of the data.
Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the legal requirements, or to request its transmission to another controller.
Complaint to a supervisory authority: In accordance with the legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

Definitions

This section provides an overview of the terms used in this privacy policy. Many of the terms are taken from the law and are defined above all in Art. 4 GDPR. The legal definitions are binding. The following explanations, on the other hand, are primarily intended to aid understanding. The terms are sorted alphabetically.

Content Delivery Network (CDN): A “content delivery network” (CDN) is a service that helps deliver the content of an online offering, in particular large media files such as graphics or program scripts, faster and more securely using regionally distributed servers connected via the internet.
Controller: The “controller” is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
IP masking: “IP masking” refers to a method in which the last octet, i.e. the last two numbers of an IP address, is deleted so that the IP address can no longer be used to uniquely identify a person. IP masking is therefore a means of pseudonymizing processing procedures, especially in online marketing.
Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically every handling of data, be it collection, evaluation, storage, transmission or deletion.
Profiles with user-related information: The processing of “profiles with user-related information”, or “profiles” for short, includes any kind of automated processing of personal data that consists of using this personal data to analyse, evaluate or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include different information concerning demographics, behaviour and interests, such as interaction with websites and their content, etc.) (e.g. interests in certain content or products, click behaviour on a website or location). Cookies and web beacons are often used for profiling purposes.
Reach measurement: Reach measurement (also referred to as web analytics) is used to evaluate the flow of visitors to an online offering and may include the behaviour or interests of visitors in certain information, such as website content. With the help of reach analysis, website owners can, for example, recognize at what time visitors visit their website and what content they are interested in. This enables them, for example, to better adapt the content of the website to the needs of their visitors. Pseudonymous cookies and web beacons are often used for reach analysis in order to recognize returning visitors and thus obtain more precise analyses of the use of an online offering.

This is a translation for convenience. In case of doubt, the German version is legally binding.