Source: https://www.stepstone.be/about-us/privacy-statement/
Timestamp: 2019-04-26 16:35:53+00:00

Document:
Thank you for visiting our website. The protection and confidentiality of your personal data is of particular importance for StepStone.
In this document we will inform you about the processing of personal data in connection with the services we offer at www.stepstone.be and other websites or apps (collectively referred to as “Platforms”) that incorporate this Privacy Statement. Personal data comprises all information that relates to an identified or identifiable natural person (Article 4 (1) GDPR). This includes information such as your name, e-mail address, postal address, or telephone number. Information that is not directly associated with your identity, e.g. the number of users of an Internet site, does not fall within this scope.
We provide you with a short version and a long version of our privacy statement. The short version gives you a quick overview of the essential aspects of data processing. The long version gives you a detailed insight.
Data processing about businesses and their employees we process data in the context of a legitimate interest or a contract or due to a legal obligation.
We use data processors. These may therefore receive personal data, as described in detail in the long version of the Privacy Statement. Furthermore, we may also transmit or provide data to third parties within the scope of your consent or a contract with you, as described in particular in the long version, so that these can receive data as described there.
In certain cases, we transfer personal information to countries outside the EU or the EEA (so-called third countries). Essentially, this can be the case if you are applying for a job and the job provider is based in a third country. Furthermore, we use data processors or, within the scope of a legitimate interest, service providers that process data in some cases in third countries. More details can be found in the long version of the privacy statement.
Generally speaking, the personal data is stored as long as the purpose exists. The individual storage periods have been set out in the long version for the respective purpose of the processing.
You have various rights related to the processing of personal data. You have (depending on the circumstances) the right to request access to the personal data (Article 15 GDPR), to rectification (Article 16 DGVO) or erasure (Article 17 GDPR), to restriction of processing (Article 18 GDPR), a right to object (Art. 21 DSGVO) and a right to data portability (Art. 20 DSGVO). If the processing is based on a consent, you can withdraw it at any time.
If you believe that the processing of your personal data is in violation of the GDPR, you have the right to complain to a supervisory authority.
8. Is there an obligation to provide personal information?
If you want to create a job agent or a MyStepStone account or if you would like to use our services as a business customer (you can find more details in the long version of the privacy statement), you have to provide certain data within the scope of the contract to be concluded. We will specify such data. In any other context, the provision of personal data is neither required by law nor by contract, nor are you required to provide personal information. However, the provision of personal data for the use of our services may also be partially required within the services we provide. In other words, if you do not provide us with the information we specify to be necessary, we may not be able to provide you with the full scope of services.
We reserve the right to change the privacy statement in accordance with the data protection regulations. The current version can be found here at this point or another place on our website or app that can easily be found. If we intend to process your data for other purposes than those for which it was collected, we will inform you in advance in accordance with the law.
If we provide an application form on our Platforms for job advertisements that are posted on our Platforms, and you complete this without being logged in to a MyStepStone account (see clause 3.2.2 below) and click the button to submit the application, we will submit the information you provide in the application form to the provider who posted the advertisement on our Platform. The legal basis here is your consent in accordance with Art. 6 (1) sentence 1 GDPR.
Please note that the respective recruiter might not be based in the EU or the EEA so it may be necessary under this contract to transfer the data to a country or that your application will be accessed from a country which has a lower level of protection under data protection law than in the EU or the EEA. Please note that in the case of an application where the recruiter is not revealed, there is usually no right be informed about the recipient, since this would adversely affect the confidentiality interests of the recruiter.
Additionally we may send emails about StepStone services that are similar to those you already use. Legal basis is a legitimate interest as per Art. 6 (1) sentence 1 f GDPR, namely the pursuit of our business interests.
You may object to all types of StepStone newsletters at any time.
If you raise an objection with us against marketing purposes, we may put your personal contact information (name, address, telephone number, fax number, e-mail address) on a blacklist to ensure that we no longer send you any unwanted marketing material. The legal basis is a legitimate interest within the meaning of Art. 6 (1) (f) GDPR, where the legitimate interest is that we can meet our obligations from your objection against marketing. The data will be stored for this purpose until you expressly withdraw the objection to marketing in writing.
StepStone organizes market surveys from time to time. As part of such surveys we will not collect any personal data, but at the end of the survey we might offer you the opportunity to participate in a competition. In order to participate in the competition you will have to provide us with your e-mail address, which we will only use for the purpose of the competition to notify you if you have won a prize. In particular, the e-mail address will be stored completely separately from your answers to the survey. The legal basis for the storage of your email address is your consent under Art. 6 (1) (a) GDPR. We will store your email address for this purpose until the end of the respective competition.
StepStone offers a salary planner. StepStone’s salary planner compares the salary-related details provided by users about the user’s current job position, salary, professional experience, education, age and gender with the same data of other users in an aggregated statistical database and analyzes this comparison in order to present a salary comparison for the user. After entering the above information and an e-mail address, StepStone will send the user an access link to the salary comparison after confirmation via double-opt-in email. The legal basis for this processing is your consent. Consent is deemed given when you click the respective button to receive the StepStone salary planner. We will store the salary planner we created for you for a period of five years.
We can only provide you with the salary planner if we can statistically analyze all salary related details from all users. Thus, we will also collect the data provided by you under point 3 a to produce the salary comparison under clause 3 a in a statistical database. We will not store any personal data about you that could be linked directly to you. In particular, we will not store your email address in this database. The legal basis for this processing is a legitimate interest of StepStone to provide the salary planner and there is no reason why any of your interests or fundamental rights and freedoms which require protection of personal data override our interest.
We use data processors to host our Platforms and for back-up services, meaning that personal data that is stored on our platforms is transferred to these data processors. These data processors are Amazon Webservices, Inc., 410 Terry Drive Ave North, WA 98109-5210 Seattle, USA (who processes data solely in the EU), StepStone GmbH, Axel-Springer-Str. 65, 10969 Berlin, Germany and StepStone Continental Europe GmbH, Völklinger Straße 1, 40219 Düsseldorf, Germany. These data processors will store the data for the same duration as it is stored on our Platforms for the various purposes defined in this Privacy Statement.
Accordingly, these parties may also be provided with your personal data in the course of data processing commissioned by us. It will be stored there for a period that is otherwise lawful for purposes under this Privacy Statement, i.e. in particular for the contractual communications in the course of contracts with you or otherwise for promotional communications.
The use of Selligent, Inc. is permitted under Art. 45 GDPR, as they are Privacy Shield certified and thus, according to the Implementing Decision of the Commission (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content / DE / TXT / HTML /? Uri = CELEX: 32016D1250 & from = DE), an adequate level of data protection exists. The certification can be viewed at https://www.privacyshield.gov/participant?id=a2zt0000000PBKYAA4&status=Active.
The legal basis for our use of Selligent is a legitimate interest under Art. 6 (1) sentence 1 f GDPR, namely the execution of our business purposes in the course of the processes described elsewhere in this Privacy Statement. No conflicting interest is apparent in this respect, in particular due to the fact that we have entered into a data processing agreement with Selligent.
We use Akamai Technologies GmbH, Parkring 20-22, 85748 Garching, Germany and Akamai Technologies, Inc., 150 Broadway, Cambridge, 02142 MA, USA as data processors for the purposes of proxy caching and web application firewall services. That means that any visit to our websites is routed through the servers of Akamai, meaning that the user will not be connected directly to our servers but to those of Akamai and Akamai will then request the content from our servers and will deliver it to the user. Proxy caching in this context means that Akamai will cache selected content (but not personal data) for a period of 24 hours, so that this can be delivered faster to you. The web application firewall means that Akamai will try to identify malicious web traffic and will prevent it from accessing our websites. Akamai does not store any personal data, but any dataflows between our servers and the user will be routed through Akamai, so that this can also include personal data. Data transferred to Akamai Technologies, Inc is transferred outside the EU and the EEA. This is permissible under Art. 45 GDPR because Akamai Technologies, Inc is Privacy Shield certified and thus an adequate level of protection exists according to the Implementing Decision of the Commission (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016D1250&from=DE). The certification can be viewed at https://www.privacyshield.gov/participant?id=a2zt0000000Gn4RAAS&status=Active.
In specific cases we use the reCAPTCHA service https://www.google.com/recaptcha/intro/ by Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA, (“Google”) based on a legitimate interest (i.e. the interest to ensure the correctness of data, avoidance of automatic registrations / orders by so-called bots, and economical operation of our online offering within the meaning of Art. 6 (1) f) GDPR).
We use re-Captcha to distinguish whether an input is made by a human or abusively by automated, mechanical processing. The query in this context includes the sending of the IP address and any other data required by Google for the reCAPTCHA service to Google. Your input will be transmitted to Google and analyzed for this purpose.
For more information about Google reCAPTCHA and Google’s Privacy Statement, please visit the following links: https://www.google.com/intl/en/policies/privacy/ and https://www.google.com/recaptcha/intro/android. html.
In the context of a legitimate interest according to Art. 6 para. 1 p. 1 GDPR, namely an attractive design of our websites, we use the YouTube for the integration of videos. YouTube is operated by YouTube LLC, headquartered at 901 Cherry Avenue, San Bruno, CA 94066, USA. YouTube is represented by Google Inc., located at 1600 Amphitheater Parkway, Mountain View, CA 94043, USA.
On some of our websites we use plugins from YouTube. If you access our websites with such a plug-in – for example a media library – a connection to the YouTube servers will be established and the plugin will be displayed. It will then be communicated to the YouTube server which of our websites you have visited. If you are logged in as a member of YouTube, YouTube can assign this information to your personal user account. When using the plugin, e.g. by clicking on the start button of a video, Youtube can also assign this information to your user account. You can prevent this by logging out of your YouTube user account and other user accounts of the YouTube LLC and Google Inc. before using our website and deleting the corresponding cookies from the companies.
As a Google subsidiary, Youtube is certified under the Privacy Shield Agreement, which provides a guarantee to comply with European privacy legislation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).For more information on data processing and tips for data protection by YouTube (Google), see www.google.de/intl/de/policies/privacy/.
StepStone offers a variety of services for your career development. StepStone aims to support you at all stages of your professional life. In particular, you can subscribe to a Job Agent and can create a MyStepStone account in which we process personal data. In this section 3.2, we inform you about the purpose, the respective legal basis as well as the storage duration of these processing operations.
We will submit an application to a recruiter via your MyStepStone account when you complete our application form and click the button to submit the application. The legal basis is your contract with us as per to Art. 6 para. 1 p. 1 b GDPR. Please note that the respective recruiter might not be based in the EU or the EEA so it may be necessary under this contract to transfer the data to a country or that your application will be accessed from a country which has a lower level of protection under data protection law than in the EU or the EEA. Please note that in the case of an application where the recruiter is not revealed, there is usually no right be informed about the recipient, since this would adversely affect the confidentiality interests of the recruiter.
We store the applications you make through our Platforms in your MyStepStone account for you until you delete a stored application.
You can create a profile under the contract for your MyStepStone account. Which personal data is transmitted to us in this context depends on your uploads or your input into the relevant fields. We will analyze the content and structure of any uploaded documents in an automated process in order to improve the services we provide to you. You can define the scope of the contractual use of this profile. You can either use it to apply to vacant positions only (including applications to box number advertisements), see below; or you can make the profile accessible partially or fully to potential employers who are StepStone customers and use the StepStone CV database or similar products. In the context of profiles made fully available, we may also use your profile data to find publicly available, business-related social media profiles and link these to your profile. Your profile will be stored until you delete it or the contract for your MyStepStone account is terminated. Please be informed that, as far as you make your profile accessible to recruiters, a recruiter could also be located outside of the EU/EEA. That means that as part of the contract between you and us, it might be necessary, that your profile is accessed from a country that does not have the same level of data protection as the EU or EEA.
If you have created a profile and access a job application form made available on our Platforms for job advertisements published on our Platforms, we will use your profile data to complete this form and, when you click the button to submit the application, we will send the data recorded with the form and make your profile accessible to the recruiter who published the respective job advertisement with us. Again, Please be informed that the respective recruiter might not be located in the EU or EEA, so that as part of the contract between you and us, it might be necessary, that the data is transmitted to or accessed from a country that does not have the same level of data protection as the EU or EEA.
Additionally, we use information provided by you as part of a profile in order to optimize the job search and job recommendations for you and other users of our Platforms using the statistical model described in clause 3.1.2 In this context we store certain parts of your profile which by themselves or in combination with each other cannot be used to identify you along with a pseudonymized user ID in the statistical model. Based solely on this pseudonymized ID you are not identifiable from within the statistical model: an identification would theoretically only be possible by externally pseudonymizing the user ID assigned to your MyStepStone account and then comparing the outcome with all pseudonymized user IDs stored in the statistical model. If we optimize the job search and the job recommendations for you with the statistical model, this is done in the context of your contract via the MyStepStone account on the legal basis of Art. 6 (1) (b) GDPR. If we use the data to generally improve our statistical model and thus also services for other users, this is done on the basis of a legitimate interest under Art. 6 (1) (f) GDPR. By deleting your MyStepStone account, your data will be completely anonymized in the statistical model, as the pseudonymized user ID stored in it will no longer allow any reference to your MyStepStone account. Our legitimate interest is in pursuing our business interests to improve our services. No conflicting interest is apparent, since the data is required during the contract period for achieving the purpose of the contract for the MyStepStone account and identification is no longer possible after the end of the contract.
With Facebook Connect, you can use your Facebook account to open a new MyStepStone account at StepStone or to connect to a MyStepStone account. If you create a MyStepStone account via Facebook or log in to an existing MyStepStone account via Facebook, we will gain access to your public profile and your e-mail address.
We use this information to pre-populate or update your MyStepStone account at StepStone and then provide you with the MyStepStone account in accordance with clause 3.2.2.
Since we use your Facebook data to create a MyStepStone account, the legal basis is the contract for the MyStepStone account pursuant to Art. 6 (1) (b) GDPR, as in described in clause 3.2.2. We will store your personal data for the purposes and period described in point 3.2.2.
Our services for recruiters aim to provide businesses with a wide selection of suitable candidates. In doing so, we process personal data of businesses (data relating to businesses is only personal data if the business is operated by one or more natural person/s) or employees of such businesses. The respective businesses may be in a contractual or pre-contractual relationship with us, but in some cases we may also process data about businesses and their employees if there is no such pre-contractual relationship. In this section 3.3 we inform you about the purpose, the respective legal basis as well as the retention period of such processing about businesses or their employees as well as the data categories, provided we do not collect the personal data from the data subject. The data will be deleted as soon as it is no longer necessary for the achievement of the purpose, that is, no contract with the customer exists and we no longer intend to enter into a contract with the respective customer and a legitimate interest no longer exists and, moreover, we are no longer obliged to keep records that may contain personal data.
We process personal data for the purpose of contract management, that is, so that we can provide our customers with the contractual services and also for associated pre-contractual purposes. If the customer is a natural person, the legal basis is that the processing is required for the performance of a contract or for the performance of pre-contractual measures pursuant to Art. 6 (1) sentence 1 b GDPR. If we process personal data of employees of the customer, the legal basis is a legitimate interest pursuant to Art. 6 (1) sentence 1 f GDPR. The legitimate interest lies in the conduct of our business and that of the customer. There is no conflicting interest of the data subject because, from the point of view of our customer, we are required to perform the processing in the context of the existing employment relationship with the data subject (section 26 GDPR). We store personal data for this purpose for the term of the contract.
Furthermore we store accounting records in order to comply with statutory retention periods under Art. 6 of the law of the 17 Juli 1975 regarding the accounting of enterprises and Art. 9 of the Royal Decree of 12 September 1983 executing the law of 17 Juli 1975 regarding the accounting of enterprises for the duration of seven years, whereby the term begins on the 1st January of the year following the finalization of the accounting book. Legal basis for this purpose is Art. 6 Abs. 1 lit. c GDPR.
We process the personal data of a business or its employees (as a contact person) obtained in connection with a contract with or a request from a prospective customer, including after the end of the contract and, if no contract is entered into, for the purpose of customer services and particularly, in case of a new request of the customer or prospective customer, to be able to recommend suitable services on the basis of the previous contracts or inquiries. The legal basis is a legitimate interest under Art. 6 (1) sentence 1 f GDPR. The legitimate interest lies in the execution of our business activities. We store personal data for this purpose for as long as we believe the respective customer might enter into an initial or further contract with us in future, which is the case as long as the customer does not specifically inform us that he or she does not intend to enter into any contract with us under any circumstances.
In order to use and manage their contractual services, our customers or their employees can use the StepStone Recruiter Space. In this context, we process such personal data of the respective customer or its employees as was provided by them, as well as the respective contractually agreed or offered services and the manner in which they are utilized. When using our Direct Search Database we also collect and save when which CVs were accessed. In order to prevent abuse and thereby guarantee proper billing and to ensure and verify that the StepStone Recruiter Space and the contractual services are functioning correctly at all times, and in particular to allow our customer service team to solve problems that may arise for specific customers, we will, upon every use of the StepStone Recruiter space, additionally collect and store the Corporate User ID (i.e. the user’s username) and the Company ID (i.e. the name of this customer based on the specific user’s affiliation with a specific StepStone customer).
If the customer is a natural person, the legal basis is that the processing is required for the performance of a contract or for the performance of pre-contractual measures pursuant to Art. 6 (1) sentence 1 b GDPR. If we process personal data of the customer’s employees, the legal basis is a legitimate interest pursuant to Art. 6 (1) sentence 1 f GDPR. The legitimate interest lies in the conduct of our business and that of the customer. There is no conflicting interest of the data subject because, from the point of view of our customer, we are already required to perform the data processing in the context of the existing employment relationship with the data subject (section 26 GDPR). Personal data will be stored for this purpose for the term of the contract for the use of the StepStone Recruiter Space.
Additionally, we use the data collected under this section in anonymous form to produce statistics about the general behavior of the customers of the Direct Search Database. This allows us to make the services more customer-friendly. The legal basis is a legitimate interest pursuant to Art. 6 (1) sentence 1 f GDPR. The legitimate interest lies in the execution of our business activities.
If our customers publish advertising products or company portraits on our Platform, we process personal data of the customer where the customer is a natural person. If our customer specifies an employee’s contact data in an advertisement product, we process this employee’s personal data to provide the relevant data to our users as part of the advertisement on our Platform and to ensure that the advertisement can be found via the search functionality on our Platforms. To increase the reach of the advertisement by submitting it to our co-operation partners, we may, in whole or in part, submit the advertisement content to our co-operation partners who provide the advertisement or a preview on their web site. If the customer is a natural person, the legal basis is that the processing is necessary for the performance of a contract pursuant to Art. 6 (1) sentence 1 b GDPR. If the advertisement contains contact details of employees of the customer, the legal basis is a legitimate interest pursuant to Art. 6 (1) sentence 1 f GDPR. The legitimate interest lies in the conduct of our business and that of the customer. There is no conflicting interest of the data subject because, from the point of view of our customer, we are required to perform the processing in the context of the existing employment relationship with the data subject (section 26 GDPR). We will store the data for this purpose for the contractual term during which the job advertisement is available on our Platforms.
If you place an online order on our website, we will collect various information required for the performance of the contract. Initially you can log in to an existing customer account if you have received corresponding access data from us. If such customer account does not yet exist, or if you have no access data (anymore), a customer account will be created in our system upon your registration. If the customer account already exists, the data entered may be merged with existing data. The legal basis for account creation is that such a customer account is necessary for the preparation of a contract (article 6 paragraph 1 b GDPR).The legal basis for the processing is Art. 6 (1) sentence 1 b GDPR. The data is stored for the duration of the contract as per above clause 3.3.1. For the handling of payments we use BS PayOne GmbH, Lyoner Straße 9, D-60528 Frankfurt/Main, Germany. BS PayOne independently determines the purposes and means of processing of personal data, so that BS PayOne becomes controller (Art. 4 No. 7 GDPR) of your data by transmission. Under the following link you can receive information about the data processing by the BS PayOne https://s3-eu-west-1.amazonaws.com/bspayone-docs/bspayone/BSPAYONE_Information-zur-Datenverarbeitung-gem-Art14-DSGVO.pdf The legal basis for the transmission of your personal data to PayOne GmbH is the fulfillment of the contract as per Art. 6 (1) sentence 1 b GDPR.
We process personal data about our customers as well as other companies and companies that are not in a business relationship with us and in this context, if necessary, also from the respective contact persons for the purpose of direct marketing, as far as legally permitted. If we did not collect this data directly from the respective data subject, we may also collect contact data about the data subject from publicly available sources, in particular the website of the respective company, classified directories, or advertisements of the respective business. In connection with these direct marketing purposes, we can also process information about the previous contracts of our customers and specifics about the business such as industry or size of the business in order to make the advertising as appropriate as possible. The legal basis is a legitimate interest in accordance with Art. 6 (1) sentence 1 f GDPR. The legitimate interest lies in the processing of personal data for the purpose of direct advertising itself (see recital 47 GDPR). The data subjects have the right to object at any time to the processing of personal data concerning them for the purpose of such advertising. You object at any time under the contact details set out in clause 1; in the case of advertising by e-mail, you will also find an opt-out link directly in the respective e-mail. We will store personal data for this purpose as long as we are still interested in entering into a contract with the respective business or until the business objects.
When you register for a StepStone webinar, we collect certain information to enable you to participate in the webinar. The legal basis here is your consent in accordance with Art. 6 (1) sentence 1 a GDPR. We will store the data for this purpose until the webinar has taken place. We use LogMeIn, Inc., 333 Summer Street, Boston, MA 02210 USA to collect the registration data and provide the webinar as a data processor, and this party will be a recipient of your personal data in this context. Data will be transferred to the USA, i.e. into a country outside of the EU or the EEA. The transfer is permitted under Art. 45 GDPR as LogMeIn, Inc., is Privacy Shield certified and thus an adequate level of protection exists according to the Implementing Decision of the Commission (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016D1250&from=DE). The Privacy Shield notice can be accessed at https://www.logmeininc.com/de/legal/privacy-shield. Additionally, we have entered into the standard contractual clauses which are available at https://logmeincdn.azureedge.net/legal/20170201/DPA/LMIDataProcessingAddendum2017.v1SAMPLE.pdf as a sample, so that a transfer is also permitted under Art. 46 (2) (c) GDPR.
We will also use the information you input to provide you with marketing as described in section 3.3.5, which is included herein by reference.
San Francisco, California 94103, to process customer inquiries. Information such as last name, first name, postal address, telephone number, and email address is recorded on our website in order to answer your questions.
If you contact us by email or via a form, we use the personal data you provide exclusively for processing the specific request. The data and the history of the service request are stored for follow-up questions and subsequent contact.
Data will be transferred to the USA, i.e. into a country outside of the EU or the EEA. The transfer is permitted under Art. 45 GDPR as Zendesk Inc., is Privacy Shield certified and thus an adequate level of protection exists according to the Implementing Decision of the Commission (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016D1250&from=DE). The Privacy Shield certificate can be accessed at https://www.privacyshield.gov/participant?id=a2zt0000000TOjeAAG&status=Active. Additionally, we have entered into the standard contractual clauses which are available at http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32010D0087 as a sample, so that a transfer is also permitted under Art. 46 (2) (c) GDPR.
The ground of processing for the use of Zendek is legitimate interest as per Art. 6 para 1 f GDRP. The legitimate interest is to provide you with an easy to use customer support tool.
On our website we use services by Criteo SA, 32 Rue Blanche, 75009 Paris in the framework of our common responsibility as defined under Art. 26 GDPR.
The purpose of the processing is retargeting, which means that when you have viewed certain offers on the website, we may show you advertising for similar offers from us on websites or other third-party platforms. We designate the scope of the respective advertising campaign in line with the contract with Criteo. The implementation of this advertising campaign, including the decision on which advertisements are delivered where is then the responsibility of Criteo. To that end a code from Criteo is executed on our pages directly by Criteo and what are known as (re)marketing tags (invisible graphics or code, also known as web beacons) are integrated into the website. These are used to store an individual cookie, i.e. a small file on your device (comparable technologies may also be used instead of cookies). This file records which websites the user locates, the content he or she is interested in and which offers he or she has clicked. It also stores technical information on the browser and operating system, referring websites, time of visit and other information on the use of the online offering. Criteo may also combine the above information with information from other sources. If the user subsequently visits other websites, tailored advertisements can be displayed depending on his or her interests.
Criteo stores the data for 13 months and the cookies set by Criteo expire automatically after 13 months.
Within the scope of the joint responsibility for the data processing described in this clause 4.1, you can assert your rights under the GDPR against us and Criteo either with us or with Criteo.
The legal basis is a legitimate interest under Art. 6 (1) sentence 1 f GDPR, namely pursuance of our business purposes.
The purpose of the processing is retargeting, that is, if you have viewed certain offers on our websites, we may display advertisements on similar websites for you on websites or other third-party platforms. For this purpose, individual cookies are stored through our website by Trackuity on your device. Trackuity uses only anonymized data, personal data is not stored.
Legal basis is a legitimate interest in accordance with Art. 6 para. 1 sentence 1 f DSGVO, namely the pursuit of our business purposes and targeted marketing.
We have a contract processing agreement with Hotjar. The use of Hotjar is based based on a legitimate interest according to Art. 6 para. 1 p. 1 f DSGVO. Our legitimate interest is the user-friendly design of our websites.
To analyze the usage of our apps, we use the app analysis service AppSee of Shift 6 Ltd. Menorat Hamaor 3, Tel Aviv, Israel.
You will find further information about the privacy of Appsee at: http://www.appsee.com/legal/privacypolicy.
The legal basis for the use of Appsee is a legitimate interest under Art. 6 para. 1 sentence 1 f DSGVO. Our legitimate interest is the user-friendly design of our offers.
You can object to the use of Appsee at any time by changing the setting of the slider for anonymous statistics in the app under “Settings”.
We use the Fabric Crashlytics service offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland to better address technical issues related to our mobile apps. Fabric Crashlytics is an analytics service that collects technical information about the device (such as the operating system and model) and app usage data, specifically related to system crashes and errors. We use this information to collect data on app usage specifically related to system crashes and errors, and to better understand how our users use the app to improve the app. The information collected is available only in anonymous form. A storage of personal data does not take place. Google Ireland Limited may use Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, as a subcontractor. Google Inc. is certified under the Privacy Shield Agreement, which provides a guarantee to comply with European privacy legislation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active. Other subcontractors that Google can use can be found here: https://fabric.io/terms/subprocessors.
The legal basis for the use of Fabric Craslytics is a legitimate interest under Art. 6 para. 1 sentence 1 f DSGVO. Our legitimate interest is the user-friendly design of our apps.
You can opt out of using Fabric Crashlytics at any time by changing the setting of the slider for anonymous statistics in the app under “Settings”.
We also use the app analysis service Adjust (adjust GmbH, Saarbruecker Str. 38a, 10405 Berlin) to analyze the usage of our apps. The Adjust service has been tested and certified according to the ePrivacyseal (European Privacy Seal) (see https://www.eprivacy.eu/en/customers/awarded-seals/).
When using the app, Adjust collects installation and usage data on our behalf. We use this anonymous information to understand how our users interact with our app. Adjust uses your anonymized IDFA or Android ID as well as your anonymized IP and MAC address. It is not possible to identify you. A storage of personal data does not take place accordingly.
The legal basis for the data analysis and use of Adjust is a legitimate interest (ie interest in the analysis, optimization and economic operation of our apps) in the sense of Art. 6 (1) (f) GDPR for the purposes of our own Market research, advertising purposes and the optimization and user friendly design of the apps. There is no apparent conflicting interest, especially since we have concluded a data processing agreement with Adjust.
You can opt out of using Adjust at any time by changing the setting of the slider for anonymous statistics in the app under “Settings”.
In our apps we use technology from Google Firebase (Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA, “Google”) with various functionalities.
Firebase Analytics enables the analysis of the use of our apps. This completely aonymized information about the use of our app is collected and transmitted to Google and stored there. Google uses the advertising ID of the device. Google will use this information to evaluate the use of our app and to provide us with other services related to the use of apps. In Device Settings, you can restrict the use of the Advertising ID (iOS: Privacy / Advertising / No Ad Tracking, Android: Account / Google / View). Google Analytics for Firebase (Google Inc.). We also use Firebase Remote Config, which allows us to run A / B tests and customize the behavior and appearance of the app without having to download a new version. Personal data is not stored.
Google Inc. is certified under the Privacy Shield Agreement, which provides a guarantee to comply with European privacy legislation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active). Subcontractors that Google can use can be found here: https://firebase.google.com/terms/subprocessors.
The legal basis for the use of data analysis and the use of Firebase is a legitimate interest (ie interest in the analysis, optimization and economic operation of our apps) within the meaning of Art. 6 (1) (f) GDPR).
You can opt-out of using Firebase at any time by changing the setting of the slider for anonymous statistics in the app under “Settings”.
Adform uses AdmantX s.p.a. Via Nuova Poggioreale, 11 80123 Napoli – Italy as data processor so that AdmantX s.p.a. might have receive personal data.
Legal basis for the use of Adform is a legitimate interest within the meaning of Art. 6 para. 1 f DSGVO. The legitimate interest lies in making our services user-friendly and addressing potential customers in a target group-oriented manner.
The “Facebook Pixel” from the social network Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA, is used within our website. This means that what are termed tracking pixels are integrated into our pages. When you visit our pages, the tracking pixel creates a direct link between your browser and the Facebook server.
Transfer of data to the USA is permissible under Art. 45 GDPR because Facebook is Privacy Shield certified and thus an adequate level of protection exists according to the Implementing Decision of the Commission (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016D1250&from=DE). The certification can be viewed at https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active.
On the grounds of our legitimate interests (i.e. interest in the analysis, optimization, and economical operation of our online offering within the meaning of Art. 6 (1) (f) GDPR), we use the marketing and remarketing services (for short: “Google Marketing Services”) of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, (“Google”).
The Google Marketing Services enable us to display advertisements for and on our website in a more targeted manner to so that users are only shown advertisements that they may be interested in. If a user sees e.g. advertisements for products that he or she was interested in on other websites, this is referred to as “remarketing”. For this purpose, when our websites and other websites are accessed on which Google Marketing Services are active, Google directly executes a Google code and what are termed (re)marketing tags (invisible graphics or code, also known as “web beacons”) are integrated into the website. These are used to store an individual cookie, i.e. a small file on the user’s device (comparable technologies may also be used instead of cookies). The cookies may be set by various domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com, or googleadservices.com. This file records which websites the user searches for, the content he or she is interested in and which offers he or she has clicked. It also stores technical information on the browser and operating system, referring websites, time of visit, and other information on the use of the online offering. Similarly, the user’s IP address is recorded, whereby in the context of Google Analytics we state that the IP address is shortened in within Member States of the European Union or in other signatory states of the Agreement on the European Economic Area. Only in exceptional cases is it transferred in full to a Google server in the USA and shortened there. The IP address is not merged with the user’s data within other Google offerings. Google may also combine the above information with information from other sources. If the user subsequently visits other websites, tailored advertisements can be displayed depending on his or her interests.
The user’s data is processed in a pseudonimyzed form as part of the Google Marketing Services. This means that Google stores and processes e.g. not the user’s name or e-mail address, but instead processes the relevant data based on the cookie within pseudonymized user profiles. This means that, from Google’s perspective, the advertisements are not managed and displayed for a specifically identifiable person, but for the holder of the cookie, irrespective of who the holder of this cookie is. This does not apply if a user has expressly permitted Google to process the data without this pseudonymization. The information about the user collected by Google Marketing Services is transferred to Google and stored on Google’s servers in the USA.
The Google Marketing Services deployed by us include the “Google AdWords” online advertising program. Google AdWords supplies every AdWords customer with a different “conversion cookie”. This means that cookies cannot be traced via the websites of AdWords customers. The information obtained using the cookie enables conversion statistics for AdWords customers to be produced who have opted for conversion tracking. The AdWords customers are notified of the total number of users who clicked their advertisement and were forwarded to a page containing a conversion tracking tag. However, they are not given any information that could be used to personally identify users.
Additionally, we may deploy the “Google Tag Manager” to integrate and manage the Google analytics and marketing service within our website.
If you would like to opt out of interest-driven advertising from Google Marketing Services, you can use the settings and opt-out options provided by Google: http://www.google.com/advertisements/preferences.
Our websites use Optimizely, a web-analytics service from Optimizely Inc. (631 Howard Street, Suite 100, San Francisco, CA 94105, United States) for the simplification and performance of A/B tests to further develop this website. The information generated by a cookie about your use of the website is usually transferred to one of Optimizely’s servers in the USA and stored there. The cookie generated by Optimizely has a term of ten years.
Transfer of data to the USA is permissible under Art. 45 GDPR because Optimizely is Privacy Shield certified and thus an adequate level of protection exists according to the Implementing Decision of the Commission (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016D1250&from=DE). The certification can be viewed at https://www.privacyshield.gov/participant?id=a2zt0000000TNkWAAW&status=Active .
Your opt-out option: You can deactivate tracking by Optimizely at any time by following the instructions at https://www.optimizely.com/opt_out.
We use the “Tealium Audience Stream”, a service by Tealium Inc., 11085 Torreyana Road, San Diego, CA 92121, USA (Tealium) within our website. This collects and stores data that we use to create pseudonymized user profiles. On our behalf, Tealium will use this information to structure your use of the website in line with your needs automatically and in real time and to display advertising. For this purpose, information including the following is collected: viewed and clicked advertisements, articles, advertising, visitor numbers, subject matter of the page, etc.
The pseudonymized user profiles are not merged with personal data about the bearer of the pseudonym without consent, which must be provided separately. Similarly, the IP address transmitted by your browser is not merged with the usage profiles.
Cookies are used is used to create the usage profiles, or similar technology for mobile end devices. The information generated by the cookie about your use of this website is stored exclusively in Germany. You can prevent the storage of the cookies by making a corresponding setting in your browser software; however, please note that if you do so you may not be able to use all functions of this website fully.
You may opt out of the data collection and storage for the purposes of web analysis and the placement of advertisements with future effect by following the instructions on http://tealium.com/de/privacy/.
This website uses a Tag Management System (TMS), a service from Tealium Inc., 11085 Torreyana Road, San Diego, CA 92121, USA (Tealium), for the dynamic customization of parts of the website. To enable this functionality, a cookie called utag_main is set. The TMS is needed for us to provide our services and can therefore not be deactivated. The cookie has a term of twelve months.
Data transferred to Tealium is transferred to the USA and thus to a country outside the EU and the EEA. This is permissible under Art. 45 GDPR because Tealium is Privacy Shield certified and thus an adequate level of protection exists according to the Implementing Decision of the Commission (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016D1250&from=DE). The certification can be viewed at https://www.privacyshield.gov/participant?id=a2zt0000000TSaYAAW&status=Active.
We use Adobe Analytics, a web-analytics tool from Adobe Systems Software Ireland Limited, that enables us to optimize our services in line with your requirements.
No personal data is stored because of the anonymization.
As a user of our websites you of course have the option to block cookies at any time in your browser settings. You can opt out of any future recording of your user behavior on the Platform at any time; click the following link for instructions on how to deactivate cookies on your computer: https://www.adobe.com/privacy/opt-out.html.
The legal basis for processing this data is a legitimate interest under Art. 6 (1) (f) GDPR. The legitimate interest as defined by Art. 6 (1) (f) GDPR that we are pursuing by processing the data described above is our interest in structuring our offerings in a user- and demand-driven manner. No conflicting interest is apparent, especially because you may opt out at any time.
You IP address is transferred to the USA and thus to a country outside the EU and the EEA. This is permissible under Art. 45 GDPR because Tealium is Privacy Shield certified and thus an adequate level of protection exists according to the Implementing Decision of the Commission (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016D1250&from=DE). The certification can be viewed at https://www.privacyshield.gov/participant?id=a2zt0000000PC0qAAG&contact=true.
Legal basis is a legitimate interest within the meaning of Art. 6 para. 1 f DSGVO. The legitimate interest lies in the fact that we want to tailor our services to the target group and to pursue target group-oriented marketing.
On our websites the SalesViewer® technology from SalesViewer® GmbH, Nikolaistr. 2 44866 Bochum is used to collect and store data for marketing, market research and optimization purposes in the course of data processing.
Data collection and storage can be objected to at any time with effect for the future, by clicking on this link http://www.salesviewer.com/opt-out in order to prevent the collection by SalesViewer® within this website in the future. An opt-out cookie for this website is then stored on your device. If you delete your cookies in this browser, you must click this link again.
SalesViewer® uses the subcontractor Hetzer Online GmbH, Industriestr. 25, 91710, Gunzenhausen for server hosting (Infrastructure SalesViewer®) and Host Europe GmbH, Welserstraße 14, 51149 Cologne for the provision of the DNS server for SalesViewer®.The legal basis is a legitimate interest under Art. 6 (1) sentence 1 f GDPR, namely pursuance of our business purposes for the demand-driven structuring of our offerings. No conflicting interest is apparent, especially because you may opt out at any time and no personal data is stored.
We use data processors as specified above for the respective processing purposes (in particular, „StepStone Surveys„, “ hosting and securing our platforms, administrative, troubleshooting, and support services“ and „Cookies and technologies that we use via third party providers„). These can therefore, as described there, be the recipient of personal data.
Additionally, we may also provide or provide information to third parties under your consent or any agreement you have with us, as described above (in particular under „Application Form„, under „MyStepStone Account“ for a profile made available to you by potential employers and under „Data processing when publishing advertisement products“ in relation to business customers and their employees) so that these can be recipients as described.
In certain cases, we may transfer personal information to a country outside the EU or the EEA (so-called third countries). Essentially, this can be the case if you are applying for a job and the recruiter is based in a third country. More details can be found above under „Application form“ or „MyStepStone Account„. Furthermore, we use data processors or, within the scope of a legitimate interest, service providers that process data in some cases in third countries. For details, see „Sending of Emails and Other Messages,“ „Proxy Caching and Web Application Firewall„, „Google Re-Captcha“ „Youtube Videos„, „StepStone Webinars“ and „Cookies and technologies that we use via third party providers„.
(8) the existence automated decision-making including profiling in accordance with Art. 22 (1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved and the scope and the intended effects of such processing for the data subject.
You have the right to receive a copy of the personal data undergoing the processing. For any further copy you request, we may charge a reasonable fee based on administrative costs. If the application is submitted electronically, the information must be provided in a standard electronic format, unless otherwise specified.
The right to receive the copy must not affect the rights and freedoms of others .
(4) if you have objected to the processing in accordance with Art. 21 (1) GDPR and it has not yet been verified whether our legitimate reasons override yours.
(2) You withdraw your consent upon which the processing was based pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, and no other legal ground for the processing applies.
(3) You object to the processing in accordance with Art. 21 (1) GDPR and no overriding legitimate grounds for the processing apply, or you raise an objection to the processing under Art. 21 (2) GDPR.
(5) The erasure of the personal data concerning you is required in order to comply with a legal obligation under EU law or the law of the Member States to which we are subject.
(6) The personal data concerning you is collected in the context of information society services pursuant to Art. 8 (1 ).
(5) to establish, exercise, or defend legal claims.
(2) the processing is being performed using automated means.
If you want to create a job agent or a MyStepStone account or if you would like to use our services as a business customer, you have to provide certain data within the scope of the contract to be concluded. We will specify such data. In any other context, the provision of personal data is neither required by law nor by contract, nor are you required to provide personal information. However, the provision of personal data for the use of our services may also be partially required within the services we provide. In other words, if you do not provide us with the information we specify to be necessary, we may not be able to provide you with the full scope of services.
We reserve the right to amend this Privacy Statement in consideration of stipulations under data-protection law. You will always be able to locate the current version here or another corresponding, easily locatable point of our website or app. If we are intending to process your data for other purposes, i.e. those for which it was collected, we will notify you about this in advance in compliance with the statutory provisions.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 45
 Art. 6
 Art. 45
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 9
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 45
 Art. 46
 Art. 45
 Art. 46
 Art. 6
 Art. 26
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 45
 Art. 6
 Art. 45
 Art. 45
 Art. 6
 Art. 6
 Art. 45
 Art. 6
 Art. 6
 Art. 22
 Art. 21
 Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 8