Privacy Statement

1. Privacy at a glance

General information

The following information gives a basic overview of what happens to your personal data when you visit this website. Personal data are all data with which you are personally identifiable. For detailed information on the subject of privacy, see our privacy policy, which can be found below this text.

Data collection on this website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website provider. You can find their contact details in the “Note on the controller” section of this privacy policy.

How do we collect your data?

Firstly, your data are collected when you disclose them to us. This can include, for example, data that you enter in a contact form.

Other data are automatically or with your consent collected by our IT systems when you visit the website. These are primarily technical data (e.g. web browser, operating system or time of the page visit). These data are collected automatically as soon as you access this website.

What do we use your data for?

Some data are collected in order to ensure the faultless provision of the website. Other data can be used to analyze your user behavior. Insofar as contracts can be concluded or initiated via the website, the data provided will also be processed for contract offers, orders, or other order inquiries.

What rights do you have regarding your data?

You have the right to receive information about the origin, recipients and purpose of your stored personal data free of charge at any time. You also have the right to request the rectification or deletion of these data. If you have given your consent for your data to be processed, you may withdraw your consent at any time with effect for the future. You also have the right to request the restriction of the processing of your personal data in specific cases. Furthermore, you have a right lodge a complaint with the competent supervisory authority.

To do so, and in case of any other questions on the topic of privacy, you can contact us at any time.

Analysis tools and tools from third-party providers 

Your browsing behavior may be statistically evaluated when you visit this website. This is mainly realized with so-called analyzing software.

You can find detailed information on these analyzing software in the following privacy policy.

2. Hosting

This website is hosted externally. The personal data that is collected on this website is stored on the host’s servers. This may primarily include IP addresses, contact inquiries, meta and communication data, contract data, contact details, names, website access instances and other data generated via a website.

The external hosting is for the purpose of fulfilling a contract with our potential and existing customers (Art. 6 (1) (b) GDPR) and in the interests of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6 (1) (f) GDPR). If a respective declaration of consent has been obtained, the data shall be processed exclusively on the basis of Art. 6 (1) (a) GDPR and Section 25 para 1 of the German Telecommunications Digital Services Data Protection Act (TDDDG) insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. This declaration of consent may be revoked at any time.

Our host(s) will only process your data to the extent necessary to fulfill its performance obligations and follow our instructions with respect to such data.

We use the following host(s):

pehle / reineck UG (haftungsbeschränkt) & Co. KG

Milser Straße 37

33729 Bielefeld, Germany

Data processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

3. General information and mandatory information

Data privacy

The operators of these web pages take your privacy very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

Various personal data are collected when you use this website.

Personal data are all data with which you are personally identifiable. The present privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

Please note that any data transmission over the Internet (for example, when communicating via e-mail) may have security vulnerabilities. Complete protection of the data from access by third parties is not possible.

Note on the data processing controller

The data processing controller on this website is:

Werner & Pfleiderer Industrielle Backtechnik GmbH

Frankfurter Straße 17

71732 Tamm, Germany

Phone: +49 7141 202-0

E-mail: info@wpib.de

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data (e.g. names, e-mail addresses, etc.).

Storage duration

Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for which it was collected no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g. tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.

General information on the legal basis for data processing on this website

If you have given your consent to data processing, we process your personal data on the basis of Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, insofar as special data categories are processed in accordance with Art. 9 para. 1 GDPR. In the event of express consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49 para. 1 lit. a GDPR. If you have given your consent to the storage of cookies or access to information in your terminal device (e.g. via device fingerprinting), data processing is also carried out on the basis of Section 25 para 1 of the German Telecommunications Digital Services Data Protection Act (TDDDG). This declaration of consent may be revoked at any time. If your data is required for the purpose of fulfilling a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6 para. 1 lit. b GDPR. Furthermore, we process your data if necessary to fulfill a legal obligation on the basis of Art. 6 para. 1 lit. c GDPR. Data processing may also be conducted on the basis of our legitimate interest in accordance with Art. 6 (1) (f) GDPR. Information on the relevant legal bases in each individual case is provided in the following paragraphs of this privacy policy.

Data Protection Officer

We have appointed a data protection officer.

Biehn & Professionals GmbH

IT- Sicherheit und Risikomanagement

Wiesenstraße 32

33397 Rietberg-Mastholte, Germany

Phone: +49 2944 97971 0

E-mail: datenschutz@biehn-und-professionals.de

Recipients of personal data

Within the scope of our business activities, we cooperate with several external parties. This sometimes requires the transfer of personal data to these external parties. We only pass on personal data to external parties if this is required for the purpose of fulfilling a contract, if we are legally obliged to do so (e.g. passing on data to tax authorities), if we have a legitimate interest in passing on the data in accordance with Art. 6 (1) (f) GDPR or if another legal basis allows the data to be passed on. Where processors are used, we only pass on our customers' personal data on the basis of a valid contract for order processing. In the case of joint processing, a joint processing agreement is concluded.

Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke your previously given consent at any time. The legality of data processing carried out up to the time of the revocation shall remain unaffected by the revocation.

Right to object to data collection in special cases; right to object to direct advertising (Art. 21 GDPR)

IN THE EVENT THAT DATA ARE PROCESSED ON THE BASIS OF ART. 6 (1) (E) OR (F) GDPR, YOU HAVE THE RIGHT TO AT ANY TIME OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA BASED ON GROUNDS ARISING FROM YOUR UNIQUE SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. TO DETERMINE THE LEGAL BASIS, ON WHICH ANY PROCESSING OF DATA IS BASED, PLEASE CONSULT THIS PRIVACY POLICY. IF YOU LOG AN OBJECTION, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA, UNLESS WE ARE IN A POSITION TO PRESENT COMPELLING PROTECTION WORTHY GROUNDS FOR THE PROCESSING OF YOUR DATA, THAT OUTWEIGH YOUR INTERESTS, RIGHTS AND FREEDOMS OR IF THE PURPOSE OF THE PROCESSING IS THE CLAIMING, EXERCISING OR DEFENSE OF LEGAL ENTITLEMENTS (OBJECTION PURSUANT TO ART. 21 (1) GDPR). 

IF YOUR PERSONAL DATA IS BEING PROCESSED IN ORDER TO ENGAGE IN DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR AFFECTED PERSONAL DATA FOR THE PURPOSES OF SUCH ADVERTISING AT ANY TIME. THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS AFFILIATED WITH SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT ADVERTISING PURPOSES (OBJECTION PURSUANT TO ART. 21 (2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, data subjects are entitled to log a complaint with a supervisory authority, in particular in the member state where they usually maintain their domicile, place of work or at the place where the alleged violation occurred. The right to log a complaint is in effect regardless of any other administrative or court proceedings available as legal recourses.

Right to data portability

You have the right to demand that any data we automatically process on the basis of your consent or in order to fulfill a contract be handed over to you or a third party in a commonly used, machine readable format. If you should demand the direct transfer of the data to another controller, this will be done only if it is technically feasible.

Information, rectification and deletion

Within the framework of the applicable legal provisions, you have, at all times, the right to receive information about your stored personal data, their origin and recipients, and the purpose of data processing free of charge and, if necessary, the right to the rectification or deletion of these data. To do so, and in case of any other questions on the topic of personal data, you can contact us at any time.

Right to restriction of processing

You have the right to demand the imposition of restrictions as far as the processing of your personal data is concerned. To do so, you may contact us at any time. The right to demand restriction of processing applies in the following cases:

• In the event that you should dispute the correctness of your data stored by us, we will usually need some time to verify this claim. During the time that this investigation is ongoing, you have the right to demand that we restrict the processing of your personal data.
• If the processing of your personal data was/is conducted in an unlawful manner, you have the option to demand the restriction of the processing of your data in lieu of demanding the deletion of this data.
• If we do not need your personal data any longer and you need it to exercise, defend or claim legal entitlements, you have the right to demand the restriction of the processing of your personal data instead of its deletion.
• If you have raised an objection pursuant to Art. 21 (1) GDPR, your rights and our rights will have to be weighed against each other. As long as it has not been determined whose interests prevail, you have the right to demand a restriction of the processing of your personal data.

If you have restricted the processing of your personal data, these data – with the exception of their storage – may be processed only subject to your consent or to claim, exercise or defend legal entitlements or to protect the rights of other natural persons or legal entities or for important public interest reasons cited by the European Union or a member state of the EU.

SSL or TLS encryption

For security reasons and to protect the transfer of confidential content such as orders or inquiries that you send to us as the website operator, this site uses SSL or TLS encryption. An encrypted connection is indicated by the address line of the browser changing from “http: //” to “https: //” and by the lock symbol in your browser line.

If SSL encryption is enabled, the data you submit to us cannot be read by third parties.

Objection to unsolicited advertising e-mails

We herewith object to the use of contact information published in compliance with the legal notice obligation for the purpose of sending advertising and information material that has not been expressly requested. The operators of this website and its pages reserve the express right to take legal action in the event of the unsolicited sending of advertising information, for instance via SPAM messages.

4. Data collection on this website

Cookies

Our web pages use so-called “cookies“. Cookies are small data packages and do not harm your computer. They are either stored temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your terminal device. Session cookies are deleted automatically after your visit. Permanent cookies remain stored on your terminal device until you delete them or they are automatically deleted by your web browser.

Cookies may originate from us (first-party cookies) or from third-party companies (third-party cookies). Third-party cookies enable the integration of certain services from third-party companies within websites (e.g. cookies for processing payment services).

Cookies serve various functions. Many cookies are technically necessary, as certain website functions would not function without them (e.g. the shopping cart function or the display of videos). Other cookies can be used to evaluate user behavior or for advertising purposes.

Cookies that are required to execute electronic communication, to provide certain functions that you have requested (e.g. for the shopping cart function) or to optimize the website (e.g. cookies to measure the web audience) (necessary cookies) are stored on the basis of Art. 6 (1) (f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in the storage of necessary cookies to ensure the technically flawless and optimized provision of his services. If a declaration of consent to the storage of cookies and comparable recognition technologies has been obtained, the data shall be processed exclusively on the basis of that declaration of consent (Art. 6 (1) (a) GDPR and Section 25 para 1 of the German Telecommunications Digital Services Data Protection Act (TDDDG)). This declaration of consent may be revoked at any time.

You can set your browser so that you are informed about the setting of cookies and can allow cookies only in individual cases, accept cookies for certain cases or generally exclude them and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted. Any other cookies and services used on this website can be found in this privacy policy.

Server log files

The provider of the web pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version 
• Operating system in use
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

A merge of this data with other data sources does not take place.

This data is collected on the basis of Art. 6 (1) (f) GDPR. The operator of the website has a legitimate interest in the technically flawless depiction and the optimization of the operator’s website. In order to achieve this, server log files must be recorded.

Contact form

If you send us inquiries using the contact form, your details from the inquiry form, including the contact details you provided, will be stored so we can process the request, and for any possible follow-up questions. We will not share this information without your consent.

The processing of this data is based on Art. 6 (1) (b) GDPR, if your request is related to the execution of a contract or if it is necessary to carry out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the requests addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR) if this has been requested. This declaration of consent may be revoked at any time.

The data entered by you in the contact form shall remain with us until you request the deletion of the data, revoke your consent to the storage of the data, or the purpose of the data storage is no longer applicable (e.g. once the processing of your inquiry is completed). Mandatory legal provisions – particularly retention periods – shall remain unaffected.

Request by e-mail, telephone or fax

If you contact us by e-mail, telephone or fax, your request, including all resulting personal data (name, request) will be stored and processed by us for the purpose of processing your request. We will not share this information without your consent.

The processing of this data is based on Art. 6 (1) (b) GDPR, if your request is related to the execution of a contract or if it is necessary to carry out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the requests addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR) if this has been requested. This declaration of consent may be revoked at any time.

The data entered by you in the contact form shall remain with us until you request the deletion of the data, revoke your consent to the storage of the data, or the purpose of the data storage is no longer applicable (e.g. once the processing of your inquiry is completed). Mandatory legal provisions – particularly statutory retention periods – shall remain unaffected.

5. Analysis tools and advertising

Matomo

This website uses the open-source web analysis service Matomo.

Through Matomo, we are able to collect and analyses data on the use of our website by visitors to it. This enables us to find out, for instance, when which page views occurred and from which region they came. In addition, we collect various log files (e.g. IP address, referrer, browser and operating system used) and can measure whether our website visitors perform certain actions (e.g. clicks, purchases, etc.).

This analytical tool is used on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the analysis of user patterns in order to optimize the operator’s web offerings and advertising. If a respective declaration of consent has been obtained, the data shall be processed exclusively on the basis of Art. 6 (1) (a) GDPR and Section 25 para 1 of the German Telecommunications Digital Services Data Protection Act (TDDDG) insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. This declaration of consent may be revoked at any time.

IP anonymization

We use IP anonymization when analyzing data with Matomo. In this case, your IP address is truncated before analysis so that it can no longer be clearly assigned to you.

Cookieless analysis

We have configured Matomo in such a way that Matomo does not store any cookies in your browser.

Hosting

We host Matomo exclusively on our own servers so that all analysis data remains on our servers and is not passed on.

6. Plug-ins and tools

YouTube with enhanced privacy

This website embeds videos from YouTube. YouTube is operated by Google Ireland Limited (”Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of our web pages with YouTube embedded, you will be connected to the servers of YouTube. The YouTube server will be informed which of our web pages you visited. If you are logged into your YouTube account, you allow YouTube to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account.

We use YouTube in Privacy Enhanced Mode. According to YouTube, videos that are displayed in Privacy Enhanced Mode are not used to personalize browsing on YouTube. Ads that are displayed in Privacy Enhanced Mode are also not personalized. No cookies are set in Privacy Enhanced Mode. However, so-called local storage elements are stored in the user's browser instead, which contain personal data similar to cookies and can be used to recognize the user. Details on the Privacy Enhanced Mode can be found here: https://support.google.com/youtube/answer/171780.

After activating a YouTube video, further data processing operations may be triggered that are beyond our control.

YouTube is used in the interest of an appealing presentation of our online offer. This represents a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. If a respective declaration of consent has been obtained, the data shall be processed exclusively on the basis of Art. 6 (1) (a) GDPR and Section 25 para 1 of the German Telecommunications Digital Services Data Protection Act (TDDDG) insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. This declaration of consent may be revoked at any time. Further information on data protection can be found in YouTube’s privacy policy at: https://policies.google.com/privacy?hl=de.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States that is intended to ensure compliance with European data protection standards for data processing in the United States. Every DPF-certified company undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

Vimeo

This website uses plug-ins from the Vimeo video portal. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.

When you visit one of our Vimeo video enabled web pages, you will be connected to the servers of Vimeo. The Vimeo server will be informed which of our web pages you visited. In addition, Vimeo obtains your IP address. This also applies if you are not logged in to Vimeo or do not have a Vimeo account. The information collected by Vimeo is transmitted to the Vimeo server in the USA.

If you are logged into your Vimeo account, you allow Vimeo to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your Vimeo account.

Vimeo uses cookies or comparable recognition technologies (e.g. device fingerprinting) to recognize website visitors. 

Vimeo is used in the interest of an appealing presentation of our online offer. This represents a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. If a respective declaration of consent has been obtained, the data shall be processed exclusively on the basis of Art. 6 (1) (a) GDPR and Section 25 para 1 of the German Telecommunications Digital Services Data Protection Act (TDDDG) insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. This declaration of consent may be revoked at any time.

Data transfer to the USA is based on the Standard Contractual Clauses (SCC) of the European Commission and, according to Vimeo, on “legitimate business interests”. Details can be found here: https://vimeo.com/privacy.

For more information on how to handle user data, please refer to the Vimeo privacy policy at: https://vimeo.com/privacy.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States that is intended to ensure compliance with European data protection standards for data processing in the United States. Every DPF-certified company undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/5711.

Google Maps

This website uses the map service Google Maps. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. This service allows us to integrate maps on our website.

To use the functions of Google Maps, it is necessary to store your IP address. This information is usually transmitted to a Google server in the USA, where they are stored. The provider of this site has no influence on this data transfer. If Google Maps is activated, Google may use Google Fonts for the purpose of uniform display of fonts. When Google Maps is called up, your browser loads the required Web Fonts in your browser cache in order to display texts and fonts correctly.

Google Maps is used in the interest of an appealing presentation of our online offer and to make the locations indicated by us on the website easier to find. This represents a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. If a respective declaration of consent has been obtained, the data shall be processed exclusively on the basis of Art. 6 (1) (a) GDPR and Section 25 para 1 of the German Telecommunications Digital Services Data Protection Act (TDDDG) insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. This declaration of consent may be revoked at any time.

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

You can find more information on the handling of user data in the Google privacy policy: https://policies.google.com/privacy?hl=de.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States that is intended to ensure compliance with European data protection standards for data processing in the United States. Every DPF-certified company undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

7. Audio and video conferencing

Data processing

We use online conferencing tools, among other things, to communicate with our customers. The specific tools we use are listed below. When you communicate with us via video or audio conferencing over the Internet, your personal data is collected and processed by us and the provider of the respective conferencing tool.

The conferencing tools collect all the data you provide or use to access the tools (e-mail address and/or phone number). The conferencing tools also process the duration of the conference, the start and end times of participation in the conference, the number of participants, and other “contextual information” related to the communicative process (metadata).

Furthermore, the tool provider processes all technical data necessary for handling online communication. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker, and the type of connection.

Any content that is shared, uploaded, or otherwise made available within the tool is also stored on the tool provider’s servers. Such content includes, in particular, cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards, and other information shared while using the service.

Please note that we do not have full control over the data processing operations of the tools we use. Our options depend largely on the corporate policies of the respective provider. For further information on data processing by the conferencing tools, please refer to the privacy policies of the respective tool providers, which can be found below this text.

Purpose and legal bases

The conferencing tools are used to communicate with prospective or existing contracting partners or to provide certain services to our customers (Art. 6 (1) (b) GDPR). Furthermore, the use of these tools serves to generally simplify and expedite communication with us or our company (legitimate interest within the meaning of Article 6 (1) (f) GDPR). If a declaration of consent has been obtained, the use of the relevant tools shall be based on that declaration of consent. This declaration of consent may be revoked with future effect at any time.

Storage duration

The data we collect directly through the video and conference tools will be deleted from our systems immediately once you request deletion of the data, revoke your declaration of consent to its storage, or the purpose of the data storage is no longer applicable. Stored cookies remain on your terminal device until you delete them. Mandatory legal retention periods shall remain unaffected.

We have no control over the storage duration of your data stored by the operators of the conferencing tools for their own purposes. For more details, please contact the providers of the conferencing tools directly.

Conferencing tools used

Microsoft Teams

We use Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. For details on data processing, please refer to the Microsoft Teams privacy statement: https://privacy.microsoft.com/de-de/privacystatement.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States that is intended to ensure compliance with European data protection standards for data processing in the United States. Every DPF-certified company undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/6474.

Data processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

8. Our own services

Handling of applicant data

We invite you to apply with us (e.g., by e-mail, post, or through our online application form). In the following, we provide information about the scope, purpose, and use of your personal data collected during the application process. We assure you that the collection, processing, and use of your data shall be carried out in accordance with applicable data protection laws and all other legal requirements, and that your data will be treated as strictly confidential.

Scope and purpose of data collection 

For the online application process, we and the companies belonging to HORSTMANNGROUP use the Softgarde applicant tracking system provided by softgarden e-Recruiting GmbH, Tauentzienstr. 14, 10789 Berlin, Germany. We have concluded a contract for data processing with the service provider in accordance with Art. 28 GDPR, which ensures compliance with data protection regulations.

Further information on data privacy during the application process can be found here: https://www.wp-l.de/datenschutzhinweise-fuer-bewerbende.html 

When you submit an application to us, we process the associated personal data (e.g., contact and communication details, application documents, notes taken during interviews, etc.) to the extent necessary for deciding whether to establish an employment relationship. The legal basis for this is Article 26 German Federal Data Protection Act (BDSG) (initiation of an employment relationship), Article 6 (1) (b) GDPR (general contract initiation), and – provided you have declared your consent – Article 6 (1) (a) GDPR. This declaration of consent may be revoked at any time. Your personal data will be shared within our company only with those individuals involved in processing your application.

Provided that your application is successful, the data you have submitted shall be stored in our data processing systems in accordance with Section 26 BDSG and Article 6 (1) (b) GDPR for the purpose of administering the employment relationship.

As part of the application process, we may also conduct an online search for information about you. This primarily involves Google Search, LinkedIn, and Xing. The legal basis for this type of data processing is our legitimate interest in forming an overall impression of you based on publicly available information, in accordance with Article 6 (1) (f) GDPR.

Data retention period

In the event that we are unable to offer you a position, you decline a position offer, or you withdraw your application, we shall reserve the right to retain the data you have provided for up to 6 months from the conclusion of the application process (rejection or withdrawal of the application) based on our legitimate interests (Art. 6 (1) (f) GDPR).

The data will then be deleted and the physical application documents destroyed. Data retention serves primarily for evidentiary purposes in the event of a legal dispute. Where it is apparent that the data will be required after the expiry of the 6-month period (e.g., due to an impending or pending legal dispute), the data shall only be deleted once the purpose for its continued retention no longer applies. Data may also be retained for a longer period if you have declared your consent (Art. 6 (1) (a) GDPR) or if statutory retention requirements prevent its deletion. 

Addition to the candidate pool

Provided we do not offer you a position, we may add you to our candidate pool. Should you be added, all documents and information from your application will be transferred to the applicant pool so that we can contact you if suitable openings should arise.

Addition to the candidate pool is based solely on your consent (Art. 6 (1) (a) GDPR). Declaration of consent is voluntary and has no bearing on the ongoing application process. The data subject can revoke this consent at any time. In such cases, the data will be permanently deleted from the candidate pool, unless there are legal grounds for retaining it.

Data from the candidate pool will be permanently deleted no later than two years after declaring consent.