Data Protection

How We Handle Your Personal Data 

DATAGROUP takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with data protection laws and this privacy statement.

As a general rule, you can use our website without having to provide any personal data. To the extent that personal data (such as name, address, or email addresses) is collected on our pages, this is always done on a voluntary basis whenever possible. This data will not be disclosed to third parties without your express consent.

Please note that data transmission over the Internet (e.g., when communicating via email) may involve security risks. It is not possible to fully protect data against access by third parties.

1. Data Controller within the meaning of Article 4(7) of the GDPR

The controller within the meaning of Article 4(7) of the GDPR is:

DATAGROUP SE
Wilhelm-Schickard-Straße 7
72124 Pliezhausen

Phone: +49 711 49005 00
E-mail:kontakt@datagroup.de

The following companies are currently part of the DATAGROUP group:

DATAGROUP SE
Wilhelm-Schickard-Straße 7
72124 Pliezhausen

DATAGROUP IT Solutions GmbH
7 Wilhelm-Schickard-Straße
72124 Pliezhausen

DATAGROUP Stuttgart GmbH
7 Wilhelm-Schickard-Straße
72124 Pliezhausen

DATAGROUP Cologne GmbH
Wickelei Building 2.12
Schanzenstraße 6-20
51063 Cologne

DATAGROUP Bremen GmbH
Mary-Somerville-Straße 8
28359 Bremen

DATAGROUP Hamburg GmbH
Brandshofer Deich 68
20539 Hamburg

DATAGROUP Digital Solutions GmbH 
Genfer Allee 2
55129 Mainz

DATAGROUP Business Solutions GmbH
Auf den Tongruben 3
53721 Siegburg

DATAGROUP Operations GmbH
Hanauer Landstraße 310
60314 Frankfurt am Main

DATAGROUP Enterprise Services GmbH
Auf den Tongruben 3
53721 Siegburg

DATAGROUP BIT GmbH
Wendenstraße 21B
20097 Hamburg

Almato AG
Theodor-Heuss-Straße 9
70174 Stuttgart

Almato AI GmbH
Theodor-Heuss-Straße 9
70174 Stuttgart

DATAGROUP Service Hub GmbH
Lange Street 1a
18055 Rostock

DATAGROUP Frankfurt GmbH
Siemensstraße 10a
63263 Neu-Isenburg

DATAGROUP Ulm GmbH
Magirus-Deutz-Straße 17
89077 Ulm

DATAGROUP Berlin
A division of DATAGROUP Business Solutions GmbH
Sonnenallee 221 F
12059 Berlin

DATAGROUP Munich
A division of DATAGROUP Business Solutions GmbH
Parkring 30
85748 Garching near Munich  

DATAGROUP Defense IT Services
A business unit of DATAGROUP Business Solutions GmbH
Auf den Tongruben 3
53721 Siegburg

DATAGROUP BIT Oldenburg GmbH
Stau 123
26122 Oldenburg

DATAGROUP Cyber Security GmbH
7 Wilhelm-Schickard-Str.
72124 Pliezhausen

Mercoline GmbH
Wittestr. 30 L
13509 Berlin

CLOUDETEER GmbH
Brandshofer Deich 68
20539 Hamburg

DATAGROUP GO GmbH
Wilhelmstraße 80
49477 Ibbenbüren

DATAGROUP Rottweil GmbH
Saline 29
78628 Rottweil

systemzwo GmbH
Pfarrer-Weiß-Weg 10
89077 Ulm

DATAGROUP Rhein-Main GmbH
Konrad-Adenauer-Straße 3
55218 Ingelheim

Inn2 GmbH
Sonnenstraße 3
83022 Rosenheim

DATAGROUP Enterprise Consulting GmbH
Sonnenstraße 3
83022 Rosenheim

Almato Iberia S.L.U.
@mar Building
C/ Pallars 193-205, 6th floor, left
08005 Barcelona

Almato Logistics Software S.L.
@mar Building
C/ Pallars 193-205, 6a, left
08005 Barcelona

DATAGROUP Enterprise Service Kft
1095 Budapest, Soroksári út 44, 2nd
floor

DATAGROUP Banking Operations Center
Moldavska Cesta 10/B,
04011, Košice / Slovakia

DATAGROUP Polska Sp. z o.o.
Straszewskiego 10/2
31-101 Kraków

DATAGROUP Operations Lithuania UAB
Europos Pr. 23A,
46329 Kaunas,
Republic of Lithuania

2. Communication via email/phone/contact form/service portal

Purpose of data processing/legal basis:

Personal data that you provide to us via email, phone, mail, contact forms, or the service portal will, of course, be treated confidentially. We use your data to process your request. We also store your data for future contact. The legal basis for data processing is Article 6(1)(f) of the GDPR. DATAGROUP’s legitimate interest in this regard stems from the need to respond to inquiries from our customers, business partners, and interested parties, thereby maintaining and promoting customer satisfaction.

The company to which you submit your request is responsible for processing your request in accordance with data protection laws.

We use the phone features of Microsoft Teams. The information about Teams in this privacy statement applies accordingly to the phone feature.

It cannot be ruled out that, for example, email addresses of external parties may be processed in DATAGROUP’s systems for the purpose of IT security. In connection with the provision of contractual services, it may be necessary to provide customers with evidence of work performed. In this context, personal data of the relevant service providers (in particular, first and last names) may be processed. Data processing is based on Article 6(1)(f) of the GDPR. The legitimate interest lies in the proper documentation of the services provided.

Recipients/categories of recipients:

As a general rule, we do not disclose data to third parties outside of DATAGROUP. In exceptional cases, data is processed on our behalf by processors. These are carefully selected in each instance, monitored by us, and contractually bound in accordance with Article 28 of the GDPR.

Furthermore, it may be necessary for us to forward requests to other companies within DATAGROUP, to the extent that this is necessary for processing.

Within the service portal, managers at DATAGROUP’s clients may, under certain circumstances, view tickets created by other users within the company.

Retention period/criteria for determining the retention period:

All personal data you provide to us in connection with requests outside of customer service will be retained by us for 90 days.

Voice messages on answering machines remain stored until the person who received the call deletes them.

Service tickets in the help desk, reports, and log files from the service portal are retained for as long as necessary for DATAGROUP. Closed tickets are deleted from the service portal after six months.

3. Data Processing of Contact Persons

Purpose of data processing / Legal basis:

DATAGROUP companies process the contact information of contacts at customers, prospective customers, suppliers, and other business partners for communication via email, telephone, fax, and mail. The legal basis for data processing is Article 6(1)(f) of the GDPR. DATAGROUP’s legitimate interest in this regard stems from the need to maintain or establish business relationships with customers, prospective customers, suppliers, and other business partners, and to maintain personal contact with contact persons in the process. To the extent that a legitimate interest exists, DATAGROUP companies may compare business partners against so-called sanctions lists pursuant to Article 6(1)(f) of the GDPR. In connection with the provision of contractual services, it may be necessary to provide customers with evidence of work performed. In this context, personal data of the relevant service providers (in particular, last name and first name) may be processed. Data processing is based on Article 6(1)(f) of the GDPR. The legitimate interest lies in the proper documentation of the services provided.

Recipients/categories of recipients:

In connection with the preparation of performance records, personal data of business partners—specifically last name and first name—may be disclosed to end customers. We generally exclude any further transfer of the data to third parties outside of DATAGROUP.  Within DATAGROUP, your data is transferred, among other things, for the purpose of carrying out or entering into the business relationship. In exceptional cases, data is processed on our behalf by processors. These are always carefully selected, monitored by us, and contractually bound in accordance with Article 28 of the GDPR. 

Retention period/criteria for determining the retention period:

Personal data is retained for the purpose of carrying out business relationships as long as there is a legitimate interest in doing so.

4. Newsletter Subscription

Purpose of data processing/legal basis:

You have the option to subscribe to our newsletter through various channels (this website, at trade shows). The legal basis for data processing in connection with the distribution of newsletters is your consent in accordance with Article 6(1)(a) of the GDPR and § 7(2) of the UWG. The purpose of data processing in connection with subscribing to the DATAGROUP newsletter is to inform subscribers about offers, promotions, products, events, and services provided by the companies of the DATAGROUP Group.

When you subscribe to the free DATAGROUP newsletter, we require your email address as mandatory information. If you voluntarily provide additional personal data during registration (last name, first name, company, job title, and topic selection), we will use this data exclusively for target group analysis and internal evaluation.

After you submit the registration form, you will receive an email from us containing a confirmation link. As soon as you click the link included in that email, you will be subscribed to the newsletter. You will be notified of this via a follow-up email. By confirming your subscription, you consent to the processing of your email address and any optional information you provided for the purposes stated here. For verification purposes, we store the time and IP address used when subscribing to the newsletter.

We use HubSpot’s analytics features to send our newsletters. For this purpose, a so-called tracking pixel (an invisible one-pixel image) is included in the emails. When the newsletter is opened, this image is retrieved by HubSpot’s servers. This allows us to determine whether and when an email has been opened. HubSpot notes that, under certain circumstances, opens may also be recorded when a recipient clicks on a link in the email or responds to the email, even if the tracking pixel has not been loaded. In addition, we track whether and which links within the newsletter are clicked. To this end, the links included in the newsletter are technically tracked via HubSpot. Tracking parameters may be added to the destination URLs to statistically analyze the use of individual links.

In connection with the use of these tracking and analytics features, the following data in particular may be processed:

• Recipient’s email address
• Information regarding the sending, delivery, and any undeliverability of the email
• Information regarding opening, clicking, and other interactions with the email’s content
• Information about the email client used and, in some cases, the type of device

We use the data collected in this way to measure success, analyze user behavior, optimize our newsletters, and tailor future content to users’ needs.

The legal basis for processing the tracking data is your consent pursuant to Article 6(1)(a) of the GDPR. To the extent that the use of cookies or similar technologies is necessary for reading or storing information on your device, this is also based on your consent in accordance with § 25(1) of the TDDDG. You grant this consent when you subscribe to the newsletter and may revoke it at any time with future effect.

You may revoke your consent to subscribe to the DATAGROUP newsletter at any time with future effect by clicking the unsubscribe link in one of the newsletters or by sending an email to marketing@datagroup.nl

Recipients/Categories of Recipients:

As a general rule, we do not disclose data to third parties outside of DATAGROUP. To send the newsletter, we have engaged the service providers HubSpot, Inc. and CleverReach GmbH & Co. KG. We have carefully selected and vetted these providers and have contractually bound them in accordance with Article 28 of the GDPR. Within the DATAGROUP corporate group, your data is transferred by DATAGROUP SE to other companies so that they, too, can send you information.

Retention period/criteria for determining the retention period:

If you withdraw your consent to receive the DATAGROUP newsletter, the data collected for this purpose will be deleted immediately, unless it is also required for another purpose.

5. Data Processing for Marketing Purposes

Purpose of data processing/legal basis:

The DATAGROUP companies use personal data for marketing purposes, in particular for advertising via email, telephone, and mail. The purpose of data processing in the context of marketing measures is to inform data subjects about the products and services of the DATAGROUP companies. The legal basis for sending advertising by mail is Article 6(1)(f) of the GDPR. DATAGROUP’s legitimate interest in this regard stems from the need to send customers and interested parties information about products and services. The legal basis for marketing activities via email or telephone is generally a declaration of consent provided by you. For marketing activities targeting existing customers, Section 7 of the German Unfair Competition Act (UWG) may also apply.

You may object at any time, with future effect, to receiving advertising—without incurring any costs other than the standard postage rates—by sendinga message tomarketing@datagroup.nl

If you object to receiving advertising, we will store your data in an advertising opt-out file pursuant to Article 6(1)(f) of the GDPR. DATAGROUP’s legitimate interest in this regard stems from the need to ensure compliance with the objection raised.

Recipients/categories of recipients:

In principle, your data will not be disclosed to third parties. If external processors are used to send advertising, they are contractually bound in accordance with Article 28 of the GDPR and have been verified to have appropriate organizational and technical security measures in place. Within DATAGROUP, your data may be transferred to other companies for marketing purposes.

Retention period/criteria for determining the retention period:
If you object to receiving advertising, your data will be blocked immediately and subsequently deleted, unless it is also retained for other purposes.

6. Receipt of Job Applications

Purpose of data processing/legal basis:

When we receive job applications, we collect data necessary for conducting the application process and establishing an employment relationship. In addition, as part of the use of the applicant management system, we also collect data related to its use, known as usage data. Usage data consists of information necessary to operate our websites, such as details regarding the start, end, and extent of use of our website, including login information. These processing activities comply with data protection and telemedia regulations.

In connection with the application process and/or the use of the system, additional processing operations may also take place that are either based on a legitimate interest pursuant to Article 6(1)(f) GDPR, or on the basis of your consent in accordance with Article 6(1)(a) of the GDPR. Processing operations that fall under a legal obligation to process or a public interest, Article 6(1)(c) and (e) of the GDPR, may also apply, such as in the context of criminal prosecution or investigations by government agencies. Through individual settings in your web browser, the configuration of the relevant cookie settings, and your user behavior, you can determine and control the scope of the processing yourself.

Visiting the Website

For operational and maintenance purposes and in accordance with the provisions of telemedia law, interactions are logged (“system logs”), which are necessary for the operation of the career portal or are processed for the purpose of system security, for example, to analyze attack patterns or unauthorized usage behavior (“evidence function”). Your web browser automatically transmits the following data when you visit the career portal:

• date and time of access,

• browser type and version,

• operating system used,

• amount of data transmitted,

• the visitor’s IP address

This data is not used for direct identification in the context of applicant management and is deleted after 52 days, in accordance with statutory retention periods, unless longer retention is necessary for legal or factual reasons, such as for evidentiary purposes. In individual cases, retention for the purposes mentioned may be applicable. The legal basis is Article 6(1)(f) of the GDPR and telemedia law.

Session Cookies

We store so-called “cookies” to provide you with comprehensive functionality and to make using our websites more convenient. “Cookies” are small files that are stored on your computer via your web browser. If you do not wish to use “cookies,” you can prevent them from being stored on your computer by adjusting your web browser settings accordingly. Please note that this may limit the operation and functionality of our website.

On the careers page, we use the JSESSIONID cookie as a technically necessary session cookie. This cookie stores a so-called session ID, which allows various requests from your browser to be linked to the respective session. This enables your computer to be recognized when you return to our website. This session cookie is deleted when you log out or close your browser. The legal basis for data processing is Article 6(1)(f) of the GDPR and Section 25(2)(2) of the TTDSG.

Job Application Process

As part of the application process, you can create and manage an account in the career portal after setting up a username and password. In addition to submitting an individual application, you can use other features in the softgarden application management system and configure your personal settings (e.g., inclusion in a talent pool).

To ensure an efficient and promising application, please include the following information with your application:

• Contact information (address, phone number)

• Information from your resume, such as education, vocational training, work experience, and language skills

• Social media profiles (e.g., XING, LinkedIn, Facebook)

• Documents related to job applications (application photos, cover letters, diplomas, certificates, work samples, etc.)

The legal basis for processing this data for the purpose of conducting the application process and establishing an employment relationship is Section 26(1), first sentence, of the German Federal Data Protection Act (BDSG) and Article 6(1)(b) of the General Data Protection Regulation (GDPR). Furthermore, the controller’s use of the applicant management system is based on a legitimate interest pursuant to Article 6(1)(f) of the GDPR. If consent within the meaning of Article 6(1)(a) is required for a specific processing activity, is required for a specific processing activity, the data controller will request this from you separately and in a transparent manner, unless, based on the principle of transparency, it results from consistent and voluntary behavior on your part, such as, for example, voluntary participation in a video interview.

Joint Recruitment Process

When two or more companies conduct a joint recruitment process, the companies involved share joint responsibility from a data protection perspective. In such cases, applicants may exercise their data protection rights with either of the companies involved. The legal basis for the transfer of applicant data between the companies involved is Article 6(1)(b) of the GDPR.

Feedback Module

In addition to your job application, we may ask you to provide feedback after a job interview and three months after you start working for us. To do this, we will send you an invitation link that directs you to the evaluation system where you can submit your feedback. The purpose of the processing is the further development and optimization of our recruitment and application processes and of our corporate image. For this purpose, the following data is processed automatically:

• Contact information (name, email)

• Job title of the position you applied for

• Location of the position

• Job category

• Applicant ID

The feedback itself is stored anonymously in the database. No link is made to any individual. In addition to a star rating for individual questions, you have the option here to leave comments. We expressly ask that you do not include any personal data in your comments. The information collected in this way may be displayed on our review page along with your feedback or shared with external partners such as kununu. Participation is entirely voluntary and takes place only with your consent; without this consent, providing feedback is not possible. The legal basis is Article 6(1)(a) of the GDPR.

Job Alert Subscription

To stay informed about new job openings, you can subscribe to the job newsletter or have suitable job openings displayed on our career board (RSS feed). You can further customize your subscription by providing details about your desired position and location. Additionally, your email address is required to subscribe. The legal basis for this is your consent to receive the newsletter pursuant to Article 6(1)(a) of the GDPR. You can withdraw your consent to receive the newsletter at any time via the unsubscribe link in the newsletter (opt-out). No personal data is processed via the RSS feed itself to inform you about new job openings.

Talent Pool

As part of your job application or by clicking the “Contact Us” button, you have the option to sign up for our talent pool. This processing is necessary to automatically qualify you for future job openings, including similar or otherwise suitable positions. When you register for the talent pool via the “Contact Us” button, you will be asked to provide the following information:

• Title, academic degree (optional)

• First name, last name, email address

• Fields of interest

• Current career level

• Preferred location(s)

• XING profile or resume

Inclusion in the talent pool is strictly voluntary, requires your consent, and is done via an opt-in link. The legal basis is Article 6(1)(a) of the GDPR. Your data will remain stored in the talent pool for 24 months. At the end of this period, we will ask you whether you consent to storing your data for another 24 months. If you do not grant this consent, your data will be removed from the talent pool after 2 weeks.

Action: Employees recruit employees

If you are referred as a job applicant by an active employee of the DATAGROUP corporate group and you are hired, the employee who referred you will be notified of your hiring and will receive a referral bonus. The referring employee may also be employed by another company. To the extent necessary, this other company will also be notified of your appointment. The legal basis for this data processing is Section 26(1), first sentence, of the BDSG and Article 6(1)(b) of the GDPR, as the information is necessary for the performance of the referring employee’s employment relationship.

Recipients/categories of recipients:

Your data will not be disclosed to unauthorized third parties in the context of applicant management and will be processed exclusively for the purposes specified in this privacy statement. For example, access by internal departments and department heads of the data controller is permitted on the basis of legitimate interests, to the extent that knowledge of the data from the application process is necessary and permitted for the selection of applicants or for the company’s internal administrative purposes. To this end, your data may be forwarded via email or within the management system to third parties within the company (including works councils) and the corporate group. The legal basis for this may be Section 26(1) of the BDSG, Article 6(1)(b), Article 6(1)(f), and Article 6(1)(a) of the GDPR.

softgarden e-Recruiting GmbH

To ensure the efficient processing of application procedures, we use an applicant tracking system provided by softgarden e-Recruiting GmbH, Tauentzienstr. 14, 10789 Berlin (contact: datenschutz@softgarden.de), which handles applicant management as a processor within the meaning of Article 4(8) of the GDPR. A data processing agreement has been concluded with the provider in accordance with Article 28 of the GDPR, which ensures compliance with data protection regulations. We remain your primary point of contact for exercising your rights as a data subject and for handling the application process.

Cloudflare:

We use the services of the ISO 27001-certified provider Cloudflare Inc., 101 Townsend St, San Francisco, USA, or its subsidiary Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany (“Cloudflare”), to enhance the security of our recruitment platform—particularly to protect against DDoS attacks—and to improve delivery speed. Cloudflare provides a network of servers capable of delivering content to end users in an optimized manner and blocking virus-infected traffic.

The services provided by Cloudflare include the “Data Localization Suite” product, which comprises the “Regional Services” and “Metadata Boundary for Customers” components. Both components ensure that the transfer of personal data when using our platform takes place exclusively within the EU.

“Regional Services” ensure that the customer’s content traffic—in this case, the end user’s traffic— is securely routed to Cloudflare PoPs within the region we have selected and is monitored within a Point of Presence (PoP) in this defined region.

We have selected Germany as the region, which means that all data traffic is processed exclusively on servers in Germany. Metadata Boundary ensures that Cloudflare does not transfer any customer logs originating from the services used outside the European Union.

The personal data processed by Cloudflare includes all content submitted by our applicants; that is, in addition to the IP address, all files (application documents) and multimedia images, graphics, audio, or video, as well as any interaction between their browser and our system.

Cloudflare sets technically necessary cookies that are required for security and for the secure provision of the service, § 25(2)(2) TDDDG.

Your personal data will be retained by Cloudflare for as long as necessary for the purposes described, typically 124 calendar days.

Retention period/criteria for determining the retention period:

Your data will be retained for the duration of the application process and in accordance with legitimate retention periods after the application process has ended. In the event of a rejection, the data will be retained for 4 months. Upon expiration of the retention period, the data will be fully anonymized. The processing of anonymized data falls outside the material scope of data protection provisions; therefore, anonymized data may be processed for statistical and analytical purposes, for conducting market research, or for product development.

7. Registration for seminars and events

Purpose of data processing / Legal basis:

If you wish to book seminars or register for events through our website, we require the information marked as required fields on the registration form. You may fill in the unmarked fields at your discretion. As part of the booking process, you will receive an email from us confirming your registration. The booking process is not complete until you click the link in this email. We process the data you provided during the booking to fulfill the booking and organize the seminar or event registration. The legal basis for this data processing is Article 6(1)(b) of the GDPR.

Based on Article 6(1)(f) of the GDPR, we store participant data for future marketing purposes on the basis of a legitimate interest. This includes storing meeting details (title, date, time, duration, Teams link), organizer and participant information (name, email address), and registration and participation status. It also includes engagement data (the time a participant joined or left the webinar; duration of participation). 

If you grant us your consent for this, we will also use your data to send you marketing information about the relevant seminar or event via email, mail, or phone after the seminar or event has ended. You may revoke this consent at any time with future effect by clicking the unsubscribe link in one of the emails or by sendingan email to marketing@datagroup.nl The legal basis for data processing in connection with the sending of information is your consent pursuant to Article 6(1)(a) of the GDPR and Section 7(2) of the UWG. Existing customers may also receive information about similar seminars and events without consent pursuant to Section 7(3) of the German Unfair Competition Act (UWG). Please refer to the information in Section 5 of this privacy statement.

If you grant us your consent for this purpose, photos and videos will be taken during seminars and events, which will be used by DATAGROUP Digital Solutions GmbH and DATAGROUP affiliates for internal and external communication purposes. This includes, in particular, publication on the DATAGROUP website and on DATAGROUP’s social media channels (e.g., LinkedIn, Instagram, Facebook). You may appear in these recordings. Consent is voluntary and may be withdrawn at any time with future effect. Withdrawal does not affect the lawfulness of the processing that has taken place up to that point. Withdrawal should be directed to: SAPHCM_Seminare@datagroup.de. 

Recipients/categories of recipients:

We partially disclose the names of those who register for a seminar on our website to our training partner, which provides the training courses. Our training partner requires this information for the organizational management of its training programs and subsequently forwards the data to the examination institute. There, the data is stored in a database, from which the exam form and the final certificate are generated. Data from event registrants is not shared. In addition, data may be shared with service providers we engage.

Photos and video recordings may be graphically edited prior to publication using Canva (Canva Pty Ltd, 110 Kippax St, Surry Hills NSW 2010, Australia). We have imposed obligations on the service provider in accordance with Article 46 of the GDPR.

Retention period/criteria for determining the retention period:

We retain the data of seminar and event participants, to the extent necessary, for the legally prescribed retention periods. After that, and in all other cases, the data is generally deleted. Participant data is stored for marketing purposes for a period of twelve months. If you have given your consent to receive information, we will retain your data for this purpose until you withdraw your consent. Recordings are retained for a period of 5 years and then deleted. Published recordings are not deleted. 

8. Cookies

Essential cookies:

This website uses so-called cookies in part. Cookies do not harm your computer and do not contain viruses. Cookies serve to make our website more user-friendly, effective, and secure. Cookies are small text files that are placed on your computer and stored by your browser.

Most of the cookies we use are so-called “session cookies.” These are automatically deleted at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies allow us to recognize your browser on your next visit.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. If you disable cookies, the functionality of this website may be limited.

You can change your cookie settings here: Enable/Disable Cookies

The legal basis for data processing by so-called “necessary cookies” is Article 6(1)(f) of the GDPR and Section 25(2)(2) of the TDDDG. Essential cookies enable basic functions and are required for the website to function properly. We have a legitimate interest in making the website as user-friendly as possible.

The following cookies set by this website are necessary for the website to function:

 

Marketing cookies:
Google Ads conversion:

We use Google Ads to draw attention to our attractive offers through advertisements (so-called Google Ads) on external websites. Based on the data from the ad campaigns, we can determine how successful individual advertising measures are. Our goal is to show you ads that are relevant to you, make our website more appealing to you, and ensure a fair calculation of advertising costs.

These ads are displayed by Google via so-called “ad servers.” For this purpose, we use ad server cookies, which allow us to measure certain success metrics, such as ad impressions or user clicks. If you arrive at our website via a Google ad, Google Ads will store a cookie on your computer. These cookies typically expire after 90 days and are not intended to identify you personally. The following data is typically collected as analytics data in connection with this cookie: the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions), and opt-out information (indicating that the user no longer wishes to be targeted) are typically stored as analytics data.

These cookies enable Google to recognize your web browser. If a user visits certain pages on an Ads client’s website and the cookie stored on their computer has not yet expired, Google and the client can recognize that the user clicked on the ad and was redirected to that page. Each Ads client is assigned a different cookie. Cookies cannot therefore be tracked across the websites of Ads clients. We do not collect or process any personal data ourselves in connection with the aforementioned advertising measures. We receive only statistical analyses from Google. Based on these analyses, we can determine which of the advertising measures used are particularly effective. We do not receive any further data regarding the use of the advertising measures; in particular, we cannot identify users based on this information.

When you use these marketing tools, your browser automatically establishes a direct connection to Google’s server. We have no control over the scope and further use of the data collected by Google through this tool and therefore inform you to the best of our knowledge: Through the integration of Ads Conversion, Google receives the information that you have visited the relevant section of our website or clicked on one of our ads. If you are registered with a Google service, Google may associate the visit with your account. Even if you are not registered with Google or are not logged in, there is a possibility that the provider may track and store your IP address.

The legal basis for the processing of your data is the consent you have provided pursuant to Article 6(1)(a) of the GDPR and Section 25(1), first sentence, of the TDDDG. The transfer of personal data to entities outside the EU takes place on the basis of your consent in accordance with Article 49(1)(a) of the GDPR. You may withdraw this consent at any time. In addition, Google in the U.S. is subject to the EU-U.S. Privacy Shield Framework. For more information about data protection at Google, please visit:http://www.google.com/intl/de/policies/privacy andhttps://services.google.com/sitestats/de.html.

The following cookies set by this website are related to Google Ads Conversion:

9. Server Log Files

The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These include

• browser type/browser version
• operating system used
• referring URL
• the name and URL of the requested file
• date, time, and time zone of the server request
• The IP address of the internet device making the request

This data cannot be directly linked to specific individuals. This data is not combined with other data sources. We reserve the right to review this data retrospectively if we receive concrete evidence of unauthorized use.

The legal basis for processing this data is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the purposes of data processing mentioned above. Recipients of this data may include processors we engage to host the website.  This data is not otherwise disclosed to external parties. The data is retained for a period of 7 days. 

10. Analytics

Purpose of processing / Legal basis:

This website uses features of the web analytics service Google Analytics. Google Analytics uses so-called “cookies.” These are text files that are stored on your computer and enable an analysis of your use of the website. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics is linked to other data about you, such as your search history, personal accounts, usage data from other devices, and any other data Google has about you. Data processing is primarily carried out by Google.

The information generated by cookies regarding your use of this website is generally transmitted to a Google server in the U.S. and stored there. Both Google and, potentially, U.S. government agencies have access to this data. However, due to the Google Analytics settings on this website, your IP address is truncated or masked as soon as the data is received by Google Analytics and before it is stored or processed.

The legal basis for the use of Google Analytics is the consent you have provided in accordance with Article 6(1)(a) of the GDPR and Section 25(1), first sentence, of the TDDDG. You may revoke this consent at any time with future effect.

The following cookies set by this website are related to Google Analytics:

Recipients/categories of recipients:

As part of the Google Analytics service, Google Ireland Limited acts as our data processor in accordance with Article 28 of the GDPR. In this context, data processing may also take place by Google outside the EU or the EEA (specifically in the U.S.). With regard to Google in the U.S., an adequate level of data protection is ensured on the basis of the adequacy decision (EU-U.S. Data Privacy Framework). Google also commits to entering into standard contractual clauses with any further subprocessors. You consent to the transfer of your data to these entities in accordance with Article 49(1)(a) of the GDPR. For entities outside the EU, an adequate level of data protection may not be ensured under certain circumstances.

Retention period/criteria for determining the retention period:

We retain user and event data for a period of 2 months.

You can prevent cookies from being stored by adjusting your browser settings. However, please note that in that case, you may not be able to fully use all features of this website. In addition, you can prevent Google from collecting the data generated by the cookie regarding your use of the website (including your IP address) and from processing this data by clicking the following link: Enable/Disable Cookies. For more information on the terms of use and data protection, please visithttp://www.google.com/analytics/terms/de.html orhttps://www.google.de/intl/de/policies/. On this website, Google Analytics has been extended with the code “gat.anonymizeIp();” to ensure that IP addresses are recorded anonymously (so-called IP masking).

11. YouTube Videos

We have embedded YouTube videos on some subpages of our website.

When you visit these subpages, content from YouTube is loaded. In this context, YouTube also receives your IP address, which is technically necessary for retrieving the content. In principle, we have no influence over the further processing of data by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. However, when embedding the videos, we have ensured that the enhanced privacy mode offered by YouTube is activated. The use of YouTube and the associated transfer of your IP address are based on the consent you have provided in accordance with Article 6(1)(a) of the GDPR. The transfer of personal data to destinations outside the EU is based on Article 49(1)(a) of the GDPR. You may withdraw these consents at any time. For more information on the handling of user data, please refer to YouTube’s Privacy Policy at:https://policies.google.com/privacy?hl=de&gl=de.

Please note: When you play a YouTube video on our website, this is considered consent in the sense described above, even if you have not previously given consent in the Consent Management Tool.

The following cookies set by this website are related to YouTube:

 

12. Google reCAPTCHA

To secure online forms, we also use the reCAPTCHA service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). This service involves the transfer of your IP address and, if necessary, other data to Google that is required for the reCAPTCHA service. Google’s privacy policy applies to this data. For more information about Google reCAPTCHA’s privacy policy, please visit:https://www.google.com/intl/de/policies/privacy/.

The legal basis for data processing in connection with Google reCAPTCHA is Article 6(1)(f) of the GDPR. Our legitimate interest lies in protecting our web forms and in protecting against spam and abuse.

13. Stock Price Chart

We have integrated a stock price chart on some subpages of our website. Visiting these subpages may result in content being loaded from the third-party provider EQS Group AG, Karlstraße 47, 80333 Munich. In this context, EQS also receives your IP address, which is technically necessary for retrieving the content. In principle, we have no influence over the further processing of data by EQS. The transfer of your IP address is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the attractive design of our website.

14. Microsoft Teams

If you participate in an online meeting as an external participant, you will receive an access link via email from the meeting organizer. When registering for the online meeting, you must then provide your name and, if applicable, your email address.

If you do not wish to exchange data with us via Microsoft Teams as defined in Article 9 of the GDPR, we ask that you hide this data in advance or otherwise render it unrecognizable.

The DATAGROUP company whose employee sent you the invitation link is responsible for the collection and processing of your personal data in connection with the use of Microsoft Teams. You can find the contact information in this privacy statement or in the email signature of the invitation.

Purposes of data processing/legal basis:

We use Microsoft Teams to hold online meetings, video conferences, and/or webinars and, where applicable, to exchange documents with participants.

For data processing relating to contacts at external organizations, the legal basis is Article 6(1)(f) of the GDPR. Our interest lies in improving organization and communication with our contacts. To the extent that our contact is a direct contractual partner and a natural person, Article 6(1)(b) of the GDPR serves as the legal basis.

By clicking on “Confirm / With Reservations” and confirming the appointment, you expressly consent, in accordance with Article 9(2)(a) of the GDPR, to the processing of data or information regarding your ethnic origin, religion, or health (e.g., skin color, glasses, or head coverings), or special categories of personal data may be processed.

Furthermore, in accordance with Article 49(1)(a) of the GDPR, you expressly consent to the fact that data may also be transferred to entities outside the EU/EEA where there is no adequate level of data protection within the meaning of the General Data Protection Regulation. You are aware of the associated risks, such as the lack of enforcement of data subjects’ rights and potential access by government authorities.

You may revoke these consents at any time with future effect. In the event of revocation, any documents stored in Microsoft Teams will be deleted.

The Microsoft Teams transcription feature allows what is spoken during a meeting via Microsoft Teams to be converted directly into text and displayed in real time during the meeting. Transcriptions can be started and stopped at any time by the meeting organizer or by a moderator authorized by the organizer. The transcribed text is displayed to all participants during the meeting. Participants are notified via a notification of both the start and end of the transcription.

The legal basis for data processing when using the transcription feature is Article 6(1)(f) of the GDPR. DATAGROUP has a legitimate interest in using this feature, as it facilitates work by automating the taking of minutes during digital meetings via MS Teams.

Recipients / Data Transfer:

Microsoft Teams is a service provided by Microsoft Ireland. For more information about the processing of your data when using this service, please visit: https://news.microsoft.com/de-de/datenschutz-und-sicherheit-in-microsoft-teams-nutzer/.

Personal data processed in connection with the storage of documents in Microsoft Teams is generally not disclosed to third parties, unless it is specifically intended for disclosure. Please note that, just as with in-person meetings, the content of the stored documents is often intended precisely to share information with customers, prospective customers, or third parties and is therefore intended for disclosure. Other recipients: The provider of “Microsoft Teams” necessarily gains access to the aforementioned data, to the extent provided for in our data processing agreement with “Microsoft Teams.”

Data Processing Outside the European Union:

In principle, no data processing takes place outside the European Union (EU), as we have limited our storage locations to data centers within the European Union. However, we cannot rule out the possibility that data may be routed through Internet servers located outside the EU or the EEA. In some countries, there is a risk that government authorities may access the data for security and surveillance purposes without you being notified or having the opportunity to seek legal remedies. We have entered into a data processing agreement with the provider of “Microsoft Teams.” Additionally, Microsoft in the U.S. is subject to the EU-U.S. Privacy Shield Framework.

You are not required to communicate with us via Microsoft Teams. If you prefer, communication can take place by other means (for example, via email or phone).

Within the DATAGROUP, Microsoft Teams is made available to the other companies of DATAGROUP SE.

Transcripts may be shared within the DATAGROUP.

Retention period/criteria for determining the retention period:

We generally delete personal data when there is no longer a need for further storage. Such a need may exist, in particular, when the data is still required to fulfill contractual obligations, or to assess, grant, or reject claims under warranty and, if applicable, guarantee. In the case of statutory retention obligations, deletion will only be considered after the relevant retention obligation has expired.

To the extent relevant—Specific information regarding recordings in Microsoft Teams:

For use in connection with our DATAGROUP Academy, in webinars for external parties/customers, or for other purposes communicated on a case-by-case basis, we would like to make digital audio and video recordings of the meeting (“recordings”). The subject matter is indicated in the invitation. The recording is stored digitally by the meeting host. This may include audio recordings, video recordings, and public chat messages from meeting participants (“Data”).

The digital recordings will be made available to meeting participants and posted on DATAPEDIA, our intranet, for informational and training purposes. All DATAGROUP companies (recipients) have access to DATAPEDIA.

The legal basis for data processing is your consent pursuant to Article 6(1)(a) and Article 9(2)(a) of the GDPR. You may withdraw this consent at any time with future effect. Providing your data is neither a contractual nor a legal requirement. Failure to grant consent or withdrawal of consent has no impact on your contractual relationship with us. Withdrawal must be directed to theCorporate Communications departmentvia widerruf@datagroup.de. The recordings will be deleted immediately once the stated purpose has expired, at the end of the period specified in the invitation, unless you have already withdrawn this consent. Personal data may be transferred to third countries under certain circumstances; this is done on the basis of standard contractual clauses.

Transcripts are retained for 60 days.

15. Scheduling Appointments

Purposes of data processing/legal basis:
To simplify and optimize the online scheduling of appointments, we offer the option to schedule appointments online via the “Microsoft Bookings” service. In connection with scheduling appointments, we process your email address, preferred appointment (date, time), your name, and your message. The legal basis for data processing is Article 6(1)(b) of the GDPR and, where applicable, Article 6(1)(f) of the GDPR. DATAGROUP’s legitimate interest in this context stems from the need to schedule and fulfill the appointment you have requested.

The data controller within the meaning of data protection law is the company with which you are booking an appointment.

Recipients/categories of recipients:
When using this tool, we are supported by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft Ireland acts as a processor in accordance with Article 28 of the GDPR. A data processing agreement has been concluded with Microsoft.

Retention period/criteria for determining the retention period:
We retain personal data for appointment management purposes for a period of 10 years. After that, your data will be deleted.

16. Your Rights as a Data Subject

Pursuant to Article 15(1) of the GDPR, you have the right to request, free of charge, information about the personal data stored about you by DATAGROUP.

Furthermore, provided the legal requirements are met, you have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), and restriction of processing (Art. 18 GDPR) of your personal data.

If the data processing is based on Article 6(1)(e) or (f) of the GDPR, you have the right to object under Article 21 of the GDPR. If you object to the data processing, it will no longer take place in the future, unless the data controller can demonstrate compelling and legitimate grounds for further processing that outweigh the data subject’s interest in the objection.

If you yourself provided the processed data, you have the right to data portability in accordance with Article 20 of the GDPR.

If the data processing is based on consent pursuant to Article 6(1)(a), or Article 9(2)(a) of the GDPR, you may withdraw your consent at any time with future effect, without affecting the lawfulness of the processing carried out prior to such withdrawal.

In the above-mentioned cases, if you have any questions, or in the event of a complaint, please contact the data protection officer in writing or by email.

In addition, you have the right to file a complaint with a data protection supervisory authority. The competent authority is the data protection supervisory authority of the state where you reside or where the data controller has its registered office.

In the case of joint controllers, you will receive the relevant information from the responsible entity with which you establish or maintain a business relationship.

17. No Obligation to Provide Personal Data

Unless otherwise stated in the preceding sections, the provision of personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not required to provide your personal data, unless otherwise indicated above. Failure to provide your personal data may, under certain circumstances, result in our inability to respond to your contact request, or prevent you from participating in the application process or an event.

18. Data Protection Officer

Our Data Protection Officer is happy to assist you with any questions or suggestions regarding data protection:
Dr. iur. Christian Borchers
Datenschutz Süd GmbH
Wörthstraße 15
97082 Würzburg
office@datenschutz-sued.de

19. Privacy Policy for Social Media Pages

Privacy Policy for Our Social Media Pages

Below, we would like to inform you about how we handle your data in accordance with Article 13 of the General Data Protection Regulation (GDPR).

Data Controller

We, DATAGROUP SE, manage the following social media pages:

• Facebook: [https://www.facebook.com/datagroupse/]
• YouTube: [https://www.youtube.com/channel/UCdGyD9jRRqEywdV8jbKHHJw]
• XING: [https://www.xing.com/company/datagroupse]
• kununu: [https://www.kununu.com/de/datagroup]
• LinkedIn: [https://www.linkedin.com/company/datagroup-ag/]
• Glassdoor: [https://www.glassdoor.de/Überblick/Arbeit-bei-DATAGROUP-EI_IE951609.11,20.htm]
• Instagram [https://www.instagram.com/datagroup.se/]

You can find our contact information in our legal notice.

In addition to us, there is also the operator of the social media platform itself. The operator is also a joint controller that processes data, over which we, however, have only limited influence. In areas where we can exert influence and configure data processing, we strive—to the best of our ability—to ensure that the social media platform operator handles data in compliance with data protection regulations. In many cases, however, we cannot influence the data processing carried out by the social media platform operator, nor do we know exactly what data they process. The operator will, however, inform you about this in their respective privacy policy.

Data Processing by Us

The data you enter on our social media pages—such as comments, videos, images, likes, public posts, etc.—is published by the social media platform and is never used or processed by us for any other purposes. We reserve the right to remove content only to the extent that this may be necessary. Where applicable, we share your content on our page—if this is a feature of the social media platform—and communicate with you via the social media platform. The legal basis for this is Article 6(1), first sentence, point (f) of the GDPR. Data processing is carried out in the interest of our public relations and communication.

On our Facebook page, we use the “Page Insights” feature. Page Insights are aggregated data that allow us to gain insight into how people interact with our Facebook page. Page Insights may be based on personal data collected in connection with a visit or interaction by individuals on or with our Facebook page and its content. The legal basis is Article 6(1)(f) of the GDPR. Data processing is carried out in the interest of our public relations and communications.

If you wish to object to a specific data processing activity over which we have control, please contact us using the contact information in the legal notice. We will then review your objection or, if necessary, forward it to the social media platform.

If you submit a request to us via the social media platform, we may, depending on the required response, also direct you to other secure communication channels that guarantee confidentiality. You always have the option to send confidential requests to us via the address listed in the legal notice.

As previously mentioned, we ensure that our social media pages comply with privacy laws as much as possible, to the extent that the social media platform provider allows us to do so. In particular, we do not use demographic, interest-based, behavioral, or location-based audience targeting for advertising that the social media platform operator may make available to us. In general, we do not use the social media platform for advertising purposes. As for the statistics provided to us by the social media platform provider, we can influence them only to a limited extent and cannot disable them. However, we ensure that no additional optional statistics are made available to us.

Data Processing by the Social Media Platform Operator

The social media platform operator uses web tracking methods. This web tracking can occur regardless of whether you are logged in or registered with the social media platform. As previously noted, we unfortunately have little influence over the social media platform’s web tracking methods. For example, we cannot disable them.

Please note that it cannot be ruled out that the social media platform provider may use your profile and behavioral data, for example, to analyze your habits, personal relationships, preferences, etc. In this regard, we have no influence over the processing of your data by the social media platform provider.

For more information about data processing by the social media platform provider and further options for objecting, please refer to the provider’s privacy policy:

• Facebook: [https://www.facebook.com/policy.php]
• YouTube: [https://www.so-geht-youtube.de/datenschutzerklaerung/]
• XING: [https://privacy.xing.com/de/datenschutzerklaerung]
• kununu: [https://www.kununu.com/de/info/disclaimer]
• LinkedIn: [https://www.linkedin.com/legal/privacy-policy?_l=de_DE]
• Glassdoor: [https://www.glassdoor.de/about/privacy.htm]

In cases where we are jointly responsible for data processing with the social media platform, you can find the most important information about the joint processing of your data here:

• Facebook: [https://www.facebook.com/legal/terms/page_controller_addendum]
• LinkedIn:https://legal.linkedin.com/pages-joint-controller-addendum

Your Rights as a User

When it comes to the processing of your personal data, the GDPR grants you, as a website user, certain rights:

1.) Right of access (Art. 15 GDPR):

You have the right to request confirmation as to whether personal data concerning you is being processed; if so, you have the right to access this personal data and the information further specified in Article 15 of the GDPR.

2.) Right to rectification and erasure (Articles 16 and 17 of the GDPR):

You have the right to request, without undue delay, the rectification of inaccurate personal data concerning you and, where necessary, the completion of incomplete personal data.

You also have the right to request that personal data concerning you be erased without undue delay, provided that one of the grounds specified in Article 17 of the GDPR applies, for example, when the data is no longer necessary for the purposes for which it was collected.

3.) Right to restriction of processing (Art. 18 of the GDPR):

You have the right to request restriction of processing if any of the conditions set forth in Article 18 of the GDPR are met, for example, if you have objected to the processing, for the duration of any investigation.

4.) Right to data portability (Art. 20 GDPR):

In certain cases, as further specified in Article 20 of the GDPR, you have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format, or to request that this data be transferred to a third party.

5.) Right to object (Art. 21 GDPR):

If data is collected pursuant to Article 6(1)(f) (data processing to pursue legitimate interests), you have the right to object to the processing at any time for reasons arising from your specific situation. We will then no longer process the personal data, unless there are demonstrable compelling and legitimate grounds for the processing that outweigh the interests, rights, and freedoms of the data subject, or the processing is necessary for the establishment, exercise, or defense of legal claims.

Right to File a Complaint with a Supervisory Authority

In accordance with Article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates data protection regulations. In particular, you may exercise your right to lodge a complaint with a supervisory authority in the Member State where you reside, where you work, or where the alleged infringement occurred.