Privacy Policy

The following information provides you with a simple overview of what happens to your personal data when you visit the website of PRCC Personal- und Unternehmensberatung GmbH (hereinafter ‘PRCC’, ‘we’, ‘us’). In addition, we also provide an overview of further processing of personal data, e.g. in the context of our recruiting activities or our newsletter offer. Personal data is any information relating to an identified or identifiable natural person.

In the following sections, we inform you in accordance with Art. 13 of the EU General Data Protection Regulation (GDPR), or Art. 14 GDPR if there is no direct collection, which data we process for which purpose and what rights you have in this regard.

1. General information

1.1 Responsible body and data protection officer

The responsible body within the meaning of Art. 4 No. 7 GDPR is

PRCC Personal- und Unternehmensberatung GmbH
Poststr. 7
40213 Düsseldorf

Phone: +49 211 176070-66
Fax: +49 211 176070-69
E-mail: kontakt(at)prcc-personal.de

You can find further information on the responsible body in the legal notice of this website. If you have any questions about data protection, please contact our external data protection officer:

Tengelmann Audit GmbH
Datenschutzbeauftragter
An der Pönt 45
40885 Ratingen E-Mail: datenschutz(at)t-audit.de

1.2 Legal basis and principles of processing

We process personal data in compliance with the legal requirements. Processing may be carried out based on the following legal bases, among others:

  • Art. 6 para. 1 lit. a GDPR (consent of the data subject) or Art. 9 para. 2 lit. a GDPR (if consent to the processing of special categories of data pursuant to Art. 9 para. 1 GDPR is processed)
  • Art. 6 para. 1 lit. b GDPR (fulfilment of a contractual relationship with the data subject, pre-contractual measures at the request of the data subject)
  • Art. 6 para. 1 lit. c GDPR (fulfilment of a legal obligation)
  • Art. 6 para. 1 lit. f GDPR (protection of a legitimate interest of the responsible body or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data)
  • Art. 49 para. 1 lit. a GDPR (express consent to the transfer of personal data to third countries).

If consent serves as the legal basis for processing, you can withdraw your consent at any time without giving reasons. The revocation only applies to the future. This means that the withdrawal of consent does not render the previous processing unlawful until the withdrawal of consent is received.

Information on the relevant (or additional) legal bases in each individual case is provided in the following paragraphs of this privacy policy.

We generally store your personal data for as long as and to the extent necessary for the purposes for which it is processed. If and to the extent that your personal data is no longer required for processing, we will only store your personal data for as long as you can assert claims against us, or we can assert claims against you. In addition, we will retain your personal data for as long as and to the extent that we are legally obliged to do so. Corresponding proof and retention obligations may arise from the German Commercial Code or the German Fiscal Code, among others.

2. Data subject rights

If we process your personal data, you have the following rights in relation to the processing of your personal data, which you can assert against us:

Right to information, erasure and rectification
Within the framework of the applicable legal provisions, you have the right to free information (Art. 15 GDPR) about your processed personal data and to further information in accordance with Art. 15 para. 1 lit. a to h GDPR at any time. You may also have the right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR) of this data. The right to erasure may be restricted in cases pursuant to Art. 17 (3) GDPR (e.g. if the data is required for the establishment, exercise or defence of legal claims).

You have the right to request the restriction (or blocking) of the processing (Art. 18 GDPR) of your personal data. The right to restriction of processing exists in cases of Art. 18 para. 1 lit. a to d GDPR.

If the processing of your personal data has been restricted, this data – apart from its storage – may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

Right to data portability
You have the right to have the personal data concerning you, which we process automatically based on your consent or in fulfilment of a contract, handed over to you or to a third party in a common, machine-readable format (Art. 20 GDPR). If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Right to object to processing
If we process your personal data based on legitimate interests (Art. 6 para. 1 lit. f GDPR) (including any profiling), you have the right to object to the processing of your personal data at any time for reasons arising from your situation (Art. 21 GDPR). We will then no longer process your data for this/these purpose(s), unless our legitimate interests prevail, or the processing serves the establishment, exercise or defence of legal claims. Notwithstanding the above, you can object to the processing of your personal data for direct marketing purposes at any time without giving reasons. This also applies to any profiling associated with such direct advertising.

Right to withdraw consent
If consent serves as the legal basis for processing, consent can be withdrawn at any time without giving reasons (Art. 7 (3) GDPR). Withdrawal only applies to the future. This means that the withdrawal of consent does not render the previous processing unlawful until the withdrawal of consent is received.

Right to complain to a supervisory authority

If you believe that there has been a breach of the GDPR, you have the right to lodge a complaint with a supervisory authority, in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

To assert your rights against us, please contact us, the contact details can be found under the information on the responsible body and the data protection officer.

When asserting data subject rights, personal data will also be processed in this context to respond to the enquiry. The processing of personal data is carried out to fulfil a legal obligation pursuant to Art. 6 para. 1 lit. c GDPR or based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in the implementation of data protection regulations on the rights of data subjects.

3. Data processing when visiting our website

When you visit our website, personal data is also processed. This section gives you an overview of what data is processed for what purpose and on what legal basis in this context.

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of your browser changes from ‘http://’ to ‘https://’ and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot generally be read by third parties. However, we would like to point out that despite all precautions taken, there may be security gaps in electronic data transmission (on the Internet or by e-mail). Complete protection of data against access by third parties is not possible.

When our website is accessed, information such as the IP address can be accessed on your end device, but information can also be stored on your end device (e.g. in the form of cookies). If this is necessary for the technically error-free and secure provision of the website and the associated services, this is generally done based on Section 25 (2) TDDDG. Otherwise, this is done based on your consent in accordance with Section 25 (1) TDDDG.

Insofar as the retrieval or storage of information is associated with the processing of personal data, the processing is generally carried out on a corresponding legal basis in accordance with Art. 6 para. 1 GDPR.

For example, we use various technologies (including cookies) that are necessary for the use of certain functions of our website. These technologies can be used to collect and process information such as IP address, time of visit, device and browser information as well as information about your use of our website. This serves to optimise the presentation and secure provision of our website and the respective content. These purposes also constitute our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR and thus the legal basis for the processing of the mentioned data.

You can obtain more information on the individual cookies, external services or other technologies used by clicking on the ‘Cookies’ field in the footer of our homepage. In addition, you will find further information on the cookies, external services or other technologies used on our website in the following sections:

3.1 Hosting

We host the content of our website with the following provider: All-Inkl

Every time our website is accessed, data is automatically transmitted to our web server at our hosting service provider and temporarily stored for technical reasons.

Server-Log

When you visit our website, information is automatically collected and stored in so-called server log files, which your browser automatically transmits to us. These are

  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Host name of the accessing computer
  • Time of the server enquiry
  • IP address

This data is not merged with other data sources, unless otherwise described below.

This data is collected based on Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in the technically error-free presentation and optimisation of our website – the server log files must be recorded for this purpose. The log files are deleted after 7 days at the latest.

3.2 Consent with Borlabs Cookie

Our website uses Borlabs Cookie consent technology to obtain your consent to the storage of certain cookies in your browser or to the use of certain technologies and to document these in compliance with data protection regulations. The provider of this technology is Borlabs GmbH from Hamburg (hereinafter referred to as Borlabs).

When you visit our website, Borlabs cookies are stored on your end device to be able to save the consents you have given or withdraw your consent.

Further information, including the duration of the storage of Borlabs cookies, can be found in our cookie settings in the footer of our homepage. Details on Borlabs Cookie data processing can be found at (external link) https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/.

Borlabs cookie consent technology is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 para. 1 lit. c GDPR or our legitimate interest (Art. 6 para. 1 lit. f GDPR) in implementing the legally prescribed measures.

3.3 Matomo

This website uses the open source web analysis service Matomo.

With the help of Matomo, we are able to collect and analyse data about the use of our website by visitors. This enables us to find out, among other things, when which pages were accessed and from which region. We also record various log files (e.g. IP address, referrer, browser and operating system used) and can measure whether our website visitors perform certain actions (e.g. clicks or newsletter registration).

The use of this analysis tool is based on Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in analysing user behaviour to optimise both our website and our advertising. If a corresponding consent has been requested, the processing is carried out based on Art. 6 para. 1 lit. a GDPR. Consent can be revoked at any time.

We use IP anonymisation for the analysis with Matomo. This means that your IP address is shortened before it is analysed so that it can no longer be clearly assigned to you.

We have configured Matomo so that it does not store any cookies in your browser.

We host Matomo exclusively on our own servers so that all analysis data remains with us and is not passed on.

3.4 X (formerly Twitter)

Functions of the ‘X’ service (formerly Twitter) are integrated on this website. X is a social media platform that is operated by X Corp, 1355 Market Street, Suite 900, San Francisco, CA 94103 U.S.A.

Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland, is responsible for the data processing of persons living outside the United States.

When the social media element is active, a connection is established between your device and the X servers. X thereby receives information about your visit to this website. By using X and the respective functions, the websites you visit are linked to your device and (if available) X account. We would like to point out that we have no knowledge of the content of the transmitted data or its use by X. Further information on this can be found in X’s privacy policy at (external link): https://x.com/de/privacy.

The social media plugins from X (Consent) are activated based on your consent. The legal basis for this is Art. 6 para. 1 lit. a GDPR for the associated processing of personal data and § 25 para. 1 TDDDG for the storage and access of information on your end device. Consent can be revoked at any time with effect for the future.

As part of the integration and use of X described above, data is transmitted by X to the USA and stored/processed there. Under data protection law, the USA is generally categorised as a so-called third country, in which legal data protection regulations differ from those of the European Union and therefore the legally required level of data protection may be lower than that of the European Union. However, the European Commission has adopted an adequacy decision on the EU-U.S. Data Privacy Framework for the USA, provided that the respective companies are certified accordingly. The US parent company of X/Twitter, X Corp., is certified accordingly. In addition, X uses the EU standard contractual clauses, among others, to ensure an adequate level of data protection.

3.5 YouTube

We embed videos from YouTube on our website. YouTube is operated by Google Ireland Limited, Ireland (‘Google’). By using YouTube on our website, additional services from Google, Google Fonts and Google Photos, can also be used to create an appealing video preview. We use YouTube in extended data protection mode. According to YouTube, this means that no information about visitors to the website is stored before the video is started by clicking on it. The transfer of data to YouTube partners is not necessarily excluded by the extended data protection mode. YouTube establishes a connection to the Google DoubleClick network even without a video being viewed. As soon as you start a YouTube video on the site, a connection to the YouTube servers is established. Among other things, your IP address, which of our pages you have visited, your device configuration (e.g. browser, operating system, resolution, etc.) and how you watched the video are transmitted.

Furthermore, YouTube can store cookies on your end devices after starting a video. In this way, YouTube can obtain information about visitors to the website, which is used to record video statistics, improve user-friendliness and prevent attempts at fraud. If necessary, further data processing processes, over which we have no influence, may begin after YouTube is launched.

If you are logged in with a YouTube or Google account, it cannot be ruled out that Google or YouTube will link your interactions on our site with the respective profile.

In the context of the integration and use of YouTube described above, it cannot be ruled out that data will be transferred to the USA and stored there, as the parent company of Google Ireland, Google LLC, is based in California, USA. Under data protection law, the USA is generally categorised as a so-called third country, in which legal data protection regulations differ from those of the European Union, so that the legally required level of data protection may be lower than that of the European Union. However, the European Commission has adopted an adequacy decision on the EU-U.S. Data Privacy Framework for the USA, provided that the respective companies are certified accordingly. Google’s US parent company has been certified accordingly. If data is processed outside the EU/EEA and there is no level of data protection that corresponds to the European standard, Google also uses EU standard contractual clauses to establish an appropriate level of data protection.

The legal basis for the processing of your personal data by YouTube and other services such as Google Fonts and Google Photos via our website is the consent you have given in the cookie settings (Art. 6 para. 1 lit. a GDPR). You can revoke your consent at any time with effect for the future in the settings.

We have no influence on the scope of the data processed by YouTube, the type of processing and use or the disclosure of this data to third parties. We also have no effective control options in this regard. Further information on data protection at YouTube can be found in their privacy policy at (external link): https://policies.google.com/privacy?hl=de

3.6 iThemes Security

We have integrated iThemes Security on this website. The provider is iThemes Media LLC, 1720 South Kelly Avenue Edmond, OK 73013, USA (hereinafter ‘iThemes Security’).

iThemes Security serves to protect our website from unwanted access or malicious cyberattacks. For this purpose, iThemes Security records, among other things, your IP address, the time and source of login attempts and log data (e.g. the browser used). iThemes Security is installed locally on our servers.

The use of iThemes Security is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in protecting its website as effectively as possible against cyberattacks. If a corresponding consent has been requested, the processing is carried out exclusively based on Art. 6 para. 1 lit. a GDPR. Consent can be revoked at any time.

4. Newsletter

If you would like to receive the newsletter offered on the website, we require an e-mail address from you as well as further information, which must be entered in the corresponding mandatory fields, which allow us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter.

The registration for our newsletter takes place in a so-called double opt-in procedure. This means that after registering, you will receive an e-mail asking you to confirm your registration. This confirmation is necessary to ensure that no-one can register using other people’s e-mail addresses. If this confirmation is not received, your data will be completely deleted. When registering for the newsletter, the user’s IP address and the date and time of registration are stored. This serves to prevent misuse of the services, or the e-mail address of the person concerned. The data will not be passed on to third parties (except to the necessary IT service providers). An exception is made if there is a legal obligation to pass on the data. The data is used exclusively for sending the newsletter. You can cancel your subscription to the newsletter at any time. Consent to the storage of personal data can also be revoked at any time with effect for the future. There is a corresponding link in every newsletter for this purpose. The legal basis for the processing of the data after registration for the newsletter if the user has given consent is Art. 6 para. 1 lit. a GDPR.

We use rapidmail to send newsletters. The provider is rapidmail GmbH from Freiburg in Germany. Among other things, rapidmail is used to organise and analyse the sending of newsletters. This is done on the legal basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR. The data you enter will be stored on rapidmail’s servers in Germany. If you do not want rapidmail to analyse your data, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message. For the purpose of analysis, the emails sent with rapidmail contain a so-called tracking pixel, which connects to the rapidmail servers when the email is opened. In this way, it can be determined whether a newsletter message has been opened. We can also use rapidmail to determine whether and which links in the newsletter message are clicked on. All links in the email are so-called tracking links that can be used to count your clicks. For more information, please refer to rapidmail’s data security information at: https://www.rapidmail.de/datensicherheit (external link). For more information on the analysis functions of rapidmail, please refer to the following external link: https://www.rapidmail.de/wissen-und-hilfe.

The data stored by us as part of your consent for the purpose of the newsletter will be stored by us until you unsubscribe from the newsletter and deleted from both our servers and the servers of rapidmail after you unsubscribe from the newsletter. Data stored by us for other purposes (e.g. e-mail addresses for our login area) remain unaffected by this.

You have the option to revoke your consent to data processing at any time with effect for the future. The legality of the data processing operations that have already taken place remains unaffected by the cancellation.

5. Communication with us

We have provided information on how to contact us in various ways (e.g. on this website, on business cards or in e-mail signatures). In most cases, the purpose of providing contact details is to enable (potential) business partners to better address their concerns to us. If you are contacting us regarding a vacant position with us or one of our customers, please also note the relevant passages below.

When you contact us, e.g. by e-mail, telephone or fax, the personal data you voluntarily provide (e.g. your e-mail address, your name or your telephone number) will be processed by us to process/answer your enquiry. If the selected means of communication offers further options (e.g. video telephony), you are always free to activate or deactivate them.

Only those individuals who need the personal data for the respective lawful purpose of processing have access to the personal data received during communication. External third parties will only receive personal data that we have received during communication with you if this is either technically necessary (e.g. telecommunications provider or IT service provider), necessary for the adequate processing of the transaction (e.g. cloud, postal or parcel service provider) or if you have given us your consent to do so. We select and utilise external service providers in accordance with internal data protection minimum standards and the corresponding legal requirements (e.g. the conclusion of corresponding contracts in accordance with Art. 28 GDPR for processors, if this is necessary)

The processing of personal data from communication with us is based on Art. 6 para. 1 lit. b GDPR, provided that your enquiry is related to the fulfilment of a contract with you or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is generally based on our legitimate interest in the effective processing of the enquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR), provided that this has been requested; consent can be revoked at any time with effect for the future.

If you are not a contractual partner yourself, but e.g. an employee of a (potential/current/former) business partner, personal data will be processed – if necessary – to initiate, fulfil or terminate a business relationship based on the legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. Efficient communication for the economic fulfilment of our business purpose and for the mutual fulfilment of (pre-)contractual obligations arising from (potential) business relationships represent both our legitimate interest and – at least in part – the legitimate interest of our business partners.

The data you send to us during contact will be stored until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed), unless there are legitimate reasons for this, such as legal retention periods. B. statutory retention periods (Art. 6 para. 1 lit. c GDPR) or a legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR (e.g. processing of any queries or examination, assertion, exercise or defence of legal claims).

5.1 Contact form

If you contact us via the contact form, there are various mandatory fields (these are labelled as such) without which processing is unfortunately not possible.

5.2 Contact via Microsoft Teams

We use the Microsoft Teams tool to hold video conferences, seminars or, in some cases, telephone calls and to exchange documents and other content. The following categories of personal data may be processed when using Microsoft Teams:

  • User details (e.g. name/display name, email address)
  • Communication metadata (e.g. date, time, meeting ID, IP address, telephone number)
  • Content data from text, audio and video data and other transmitted files.

To the extent that Microsoft processes traffic data, content data and other personal data in the provision of products and services that are considered telecommunications services under applicable law, Microsoft is subject to and responsible for telecommunications secrecy.

PRCC is responsible for any further processing resulting from communication via Microsoft Teams (e.g. via the invitation function, video recordings or document exchange). Accordingly, Microsoft acts as a processor for us in this regard. We therefore draw your attention to the following functions and options:

You can decide at any time during a team meeting whether you want to switch your camera and/or microphone on or off. You can also decide at any time whether you want to share content or not.

If you use the chat function, your personal data contained in the chat texts will be processed and the other participants will also be aware of this content.

It is technically possible for participants to make a recording of the session during an online meeting. In such a case, you will be notified immediately about the recording and can object to the recording with the meeting participants. After the online meeting, the recording is saved in Microsoft Teams. The recording can then be shared with other participants.

Processing of personal data in the context of the use of Teams in third countries (countries outside the European Union and the European Economic Area) is generally not intended, as we have obliged Microsoft Corporation to limit the storage location to data centres in the European Union. However, we cannot rule out the possibility that data may be routed via Internet servers located outside the EU. This may be the case in particular if participants in a meeting are located in a third country.

Microsoft’s parent company, Microsoft Corporation, is based in the USA. Under data protection law, the USA is generally categorised as a so-called third country in which legal data protection provisions differ from those of the European Union, meaning that the level of data protection required by law may be lower than that of the European Union. For the USA, however, there is an adequacy decision by the European Commission on the EU-U.S. Data Privacy Framework, provided that the respective companies are certified accordingly. Microsoft Corporation has been certified accordingly. If data is processed outside the EU/EEA and there is no level of data protection corresponding to the European standard, Microsoft also uses EU standard contractual clauses to establish an appropriate level of data protection. Further information on this can also be found in Microsoft’s privacy policy.

If you do not wish to use Microsoft Teams, please let us know by e-mail so that we can jointly agree on other communication channels.

Further information on Microsoft’s privacy policy can be found on the Microsoft Corporation website (external link): https://privacy.microsoft.com/de-de/privacystatement

6. Processing candidate and applicant data

6.1. Recruiting for our clients

In order to fill vacancies, we necessarily process personal data of (potential) candidates. Information on data protection in this regard can be found here.

6.2 Placement of interim managers

In order to fill vacancies, we necessarily process personal data of (potential) interim managers. Information on data protection in this regard can be found here.

6.3 Applications for vacancies at PRCC

If we have vacancies to fill, we offer you the opportunity to apply with us. In the following, we will inform you about the scope, purpose and use of your personal data collected as part of the application process. We assure you that your data will be collected, processed and used in accordance with applicable data protection law and all other statutory provisions and that your data will be treated in strict confidence.

For what purposes do we process your data and on what legal basis?

If you send us an application, we process your associated personal data (e.g. contact and communication data, application documents, notes taken during job interviews, etc.) insofar as this is necessary to decide on the establishment of an employment relationship. The legal basis for this is Art. 6 para. 1 lit. b GDPR (implementation of pre-contractual measures) in conjunction with § 26 para. 1 Federal Data Protection Act (BDSG) (initiation of an employment relationship). In the case of consent, the legal basis is Art. 6 para. 1 lit. a GDPR (and, if applicable, Art. 9 para. 2 lit. a GDPR) in conjunction with Section 26 para. 2 BDSG. If we base data processing on your consent, you have the right to withdraw your consent at any time with effect for the future. The lawfulness of the processing of your data up to the time of revocation remains unaffected.

If the application is successful, the data submitted by you will be stored and processed by us based on Art. 6 para. 1 lit. b GDPR in conjunction with § 26 BDSG for the purpose of contract fulfilment or implementation of the employment relationship.

In certain cases, we may process your data to protect a legitimate interest of ours or of third parties (Art. 6 para. 1 lit. f GDPR). A legitimate interest exists, for example, if your data is required for the assertion, exercise or defence of legal claims in the context of the application process (e.g. claims under the General Equal Treatment Act). In the event of a legal dispute, we have a legitimate interest in processing the data for evidence purposes.

Who will your data be passed on to?

Your personal data will only be passed on within our company to individuals who are involved in processing your application. However, external parties – such as IT service providers – may also be involved in the processing. We select and utilise external service providers in accordance with internal data protection minimum standards and the corresponding legal requirements (e.g. the conclusion of corresponding contracts in accordance with Art. 28 GDPR for processors, if necessary).

How long will the data be stored?

We store your personal data for as long as is necessary to decide on your application. If an employment relationship between you and us does not materialise, we may continue to store data if this is necessary for the defence against possible legal claims. As a rule, your data will be deleted within 6 months of the end of the application process. If it is evident that the data will be required after the 6-month period has expired (e.g. due to an impending or pending legal dispute), it will only be deleted when the purpose for further storage no longer applies.

Longer storage may also take place if you have given your consent (Art. 6 para. 1 lit. a GDPR) or if statutory retention obligations prevent deletion.

Inclusion in the applicant pool

If we are initially unable to make you a job offer, you may be able to join our applicant pool. If you are accepted, all documents and details from your application will be transferred to the applicant pool so that we can contact you if we have suitable vacancies.

Inclusion in the applicant pool is based exclusively on your express consent (Art. 6 para. 1 lit. a GDPR). Giving consent is voluntary and is not related to an ongoing application process with us. The data subject can withdraw their consent at any time. In this case, the data will be irrevocably deleted from the applicant pool, provided there are no legal grounds for retention.

The data from the applicant pool will be irrevocably deleted no later than two years after consent has been given.

7. Social media profiles

We are active and present in various social networks and platforms with company profiles to communicate with users and interested parties of our company and, for example, to inform them about our job vacancies or services.

Please note that we are not responsible for the processing of personal data carried out independently by the respective platform operators. The respective data protection declarations of the operators apply. In addition, we would like to point out that personal data processed when visiting the platforms may also be transferred to so-called third countries (countries outside the European Union and the European Economic Area) in which other statutory data protection regulations apply and therefore the level of data protection required by law may be lower than that of the European Union. Information on this can also be found in the respective data protection declarations of the platform operators.

If you visit one of our company profiles, you are not obliged to actively provide us with personal data. However, we may process personal data that you have made public (e.g. clear name in the user profile) and that is directly related to activities on our company profile (e.g. contributions, posts, likes, tags, etc.) or that you have provided in the context of communication with us.

Depending on the individual case, the purposes for which we process personal data may be either market research and advertising purposes or effective communication with users or business partners and the processing of the respective user enquiries. These purposes also constitute our legitimate interest and thus the legal basis pursuant to Art. 6 para. 1 lit. f GDPR for the processing of the associated personal data. Insofar as communication with you via the platforms takes place for the fulfilment of a contract with you or for the implementation of pre-contractual measures, this also constitutes the corresponding legal basis pursuant to Art. 6 para. 1 lit. b GDPR for the processing of your personal data from communication with you.

The operators of the platforms also use so-called cookies and similar technologies, to identify you as a registered user and, as a rule, at least to analyse your usage behaviour. We have no direct access to the information obtained through such cookies and similar technologies. However, such information may form the basis for compiling statistics/analysis data that the platform operators may provide to us. Further information on this can also be found in the data protection notices of the respective operators.

Please note that communication with us via the respective platforms is handled via the infrastructure of the platform operators, over whose security we have only limited influence. If you would therefore like to send us more detailed or confidential information, please contact us directly via our own communication channels.

The operators may also provide us with statistically processed data with or without personal reference, which we use to evaluate user behaviour in relation to our company profile and/or our activities. This data may, for example, provide us with information about the number of followers, the number of views or likes as well as demographic data (such as the user’s country) or job-related information (industries, areas of responsibility). We have no or only limited influence on the collection and provision of this data. The preparation and provision of the data is carried out by the respective operators. The evaluation of the data provided by us regarding user or interaction behaviour serves to measure success and thus the targeted control of our activities on platforms, which at the same time represents our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR.

Depending on the individual case, both we and the respective platform operator may be jointly responsible for certain processing operations of personal data in the context of our company profiles on the respective platforms. This may be the case if the platform operators provide us with individual statistics and analyses of our company profiles. Further information on the respective platform operators can be found below:

7.1 LinkedIn

When using LinkedIn, the operator of the social network is responsible for data processing on our fan pages/company profiles under data protection law in addition to us:

LinkedIn Ireland Unlimited Company
Wilton Place
Dublin 2, Irland

You can submit data protection complaints on the following page (external link) Contact LinkedIn Help.

Further information on the scope and processing of your personal data and the duration of processing can be found in LinkedIn’s privacy policy and LinkedIn’s terms of use (external links).

Regarding the processing of personal data in the context of our company profile on LinkedIn, both we and LinkedIn Ireland Unlimited Company are jointly responsible. You can find more information on joint responsibility here (external link).

7.2 X (formerly Twitter)

When using our company profile on X, X Corp, San Francisco, CA, U.S.A., is also responsible for the processing of personal data in addition to us.

In addition, the following subsidiary of X Corp. is responsible for the data processing of persons living outside the United States:

Twitter International Company
One Cumberland Place, Fenian Street
Dublin 2, D02 AX07, Irland

Data protection enquiries can be directed to X at the following external link: X’s Privacy Policy.

Further information on data protection and the processing of personal data on X can be found in X’s privacy policy or in the cookie information (external links).

7.3 YouTube

When using the Google service YouTube, the operator of the platform is also responsible for data processing on our YouTube channel under data protection law in addition to us:

Google Ireland Ltd.
Gordon House, Barrow Street
Dublin 4, Irland

You can submit data protection complaints on the following page Privacy Policy – YouTube Help (google.com).

Further information on the scope and processing of your personal data and the duration of processing can be found in Google’s privacy policy and YouTube’s terms of use.

8. Other information

8.1 Obligation to provide personal data

An obligation to provide personal data may arise from contracts concluded or to be concluded, insofar as this is necessary for the conclusion or execution of the contract. Legal obligations may also result in personal data being collected/processed. In principle, however, the provision of personal data is voluntary, but please note that, depending on the individual case, we may not be able to fulfil/provide certain measures/services without the provision of corresponding data

8.2 Automated decision-making

Automated decision-making or profiling in accordance with Art. 22 GDPR does not take place.

8.3 Reservation of right to change

We reserve the right to change security and data protection measures if this becomes necessary, for example due to technical developments. In such cases, we will also adapt our data protection information accordingly. Adjustments to our services or legal developments may also lead to adjustments to the privacy policy.