Source: https://www.csm.de/en/privacy-statement
Timestamp: 2019-04-24 02:59:09+00:00

Document:
“Personal data" means any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by assignment to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more special features that express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
“Responsible party” means any natural or legal person, public authority, agency or body which alone or jointly with others decides on the purposes and means of the processing of personal data.
In compliance with Art. 13 GDPR we shall inform you on the legal basis of our data processing. If the legal basis in the data protection declaration is not explicitly mentioned, the following applies: The legal basis for obtaining consent are Art. 6 para 1(a) and Art. 7 GDPR, the legal basis for data processing in order to provide our services, fulfil contractual obligations as well as respond to inquiries is Art. 6 para 1(b) GDPR, the legal basis for data processing in order to fulfil our legal obligations is Art. 6 para 1(c) GDPR, and the legal basis for data processing in order to pursue our legitimate interests is Art. 6 para 1(f) GDPR. In the event that vital interests of the data subject or another natural person necessitate the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.
We would like to ask you to inform yourself regularly about the content of our data protection declaration. We will adapt the data protection declaration as soon as changes in our data processing require this. We will inform you if the changes require your cooperation (e.g. consent) or other individual notification.
If, in the course of our data processing, we disclose, send or grant access to data to other persons or companies (subcontractors or third parties), we will do this only on a legal basis (e.g. when the data transfer to a third party, for example a financial service provider, is necessary to fulfil contractual obligations according to Art. 6 para 1(b) GDPR), when consent has been obtained, if it is a legal obligation, or on the basis of pursuing our legitimate interests (for example when using a agents, web hosts, etc.).
If we entrust third parties with data processing on the basis of a so-called “processing contract”, this shall be done in accordance with Art. 28 GDPR.
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or in the context of the use of third party services or disclosure or transmission of data to third parties, this will only be done if it is to fulfil our (pre) contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only in the presence of the special conditions of Art. 44 et seq. GDPR. This means that the processing takes place, for example, on the basis of special guarantees, such as the officially recognised statement of a data protection level corresponding to the EU (e.g. for the USA through the "Privacy Shield") or compliance with officially recognised specific contractual obligations (so-called "standard contractual clauses").
You have the right to request that the data concerning yourself which you have provided to us shall be received in accordance with Art. 20 GDPR and that it be transferred to other responsible parties.
According to Art. 77 GDPR, you also have the right to file a complaint with the supervisory authority responsible.
You can object to the future processing of data concerning you in accordance with Art. 21 GDPR at any time. The objection may in particular be lodged against processing for the purposes of direct marketing.
“Cookies" are small files that are stored on the user's computer. Various data can be stored inside the cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after his or her visit to an online offer. Temporary cookies ("session cookies" or "transient cookies") are cookies that will be deleted after a user leaves an online offer and closes his browser. The contents of a shopping basket in an online shop or a login status, for example, can be stored in such a cookie. Cookies are referred to as "permanent" or "persistent" if they remain stored even after the browser has been closed. For example, the login status can be saved when users visit the site again after several days. Likewise, the interests of users used for range measurement or marketing purposes may be stored in such a cookie. Third-Party-Cookie" are cookies that are offered by other providers than the responsible person who operates the online service (otherwise, if they are only their cookies, one speaks of "First-Party Cookies").
If users do not wish cookies to be stored on their computer, they are requested to disable the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. The rejection of cookies may lead to functional limitations of this online offer.
The data processed by us will be deleted or their processing restricted in accordance with Art. 17 and 18 GDPR. Unless explicitly stated in this data protection declaration, the data stored by us will be deleted as soon as they are no longer required for their intended purpose and there is no legal requirement to retain them. If the data are not deleted because they are needed for other and legally permissible purposes, their processing will be restricted. This means that the access to data will be blocked and not processed for other purposes. This applies, for example, to data that has to be stored for commercial or for tax reasons.
According to legal requirements in Germany, the storage shall take place in particular for 10 years according to sections 147 para. 1 AO, 257 para. 1 no. 1 and 4, para. 4 HGB (German Commercial Code) (books, records, management reports, accounting records, commercial books, documents relevant for taxation, etc.) and 6 years according to section 257 para. 1 no. 2 and 3, para. 4 HGB (German Commercial Code) (commercial letters).
The hosting services used by us are intended to provide the following services: Infrastructure and platform services, computing capacity, storage space and database services, security services and technical maintenance services which we use for the purpose of operating this online service.
In this context, we or our hosting provider process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors to this online service on the basis of our legitimate interests in the efficient and secure provision of this online service in accordance with Art. 6 para. 1 lit. f GDPR in conjunction with Art. 28 GDPR (conclusion of an order processing contract).
We, or our hosting provider, collect data on each access to the server on which this service is located (so-called server log files) on the basis of our legitimate interests as defined in Art. 6 para. 1 lit. f GDPR. The access data includes the name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.
Log file information is stored for security reasons (e.g. for the clarification of abuse or fraud actions) for the duration of a maximum of 7 days and deleted afterwards. Data, which must be stored for further evidentiary purposes, are excluded from deletion until the respective incident has been finally clarified.
We process inventory data (e.g., names and addresses as well as contact data of users), contract data (e.g., services used, names of contact persons, payment information) for the purpose of fulfilling our contractual obligations and services pursuant to Art. 6 para. 1 lit b GDPR. The entries marked as mandatory in online forms are required for the conclusion of the contract.
When using our online services, we store the IP address and the time of the respective user action. The data storage is based on our legitimate interests, as well as the user's protection against misuse and other unauthorized use. This data will not be passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so in accordance with Art. 6 para. 1 lit. c GDPR.
The deletion of the data takes place after the expiration of legal warranty and comparable obligations, the necessity of data storage is reviewed every three years; in the case of legal archiving obligations, the deletion takes place after their expiration. Information in any customer account is retained until its deletion.
We process data in the context of administrative tasks as well as the organisation of our business, financial accounting and compliance with legal obligations, such as archiving. We process the same data that we process within the scope of providing our contractual services. The processing bases are Art. 6 para. 1 lit. c GDPR, Art. 6 para. 1 lit. f GDPR. Customers, interested parties, business partners and website visitors are concerned by the processing. The purpose and our interest in the processing lies in the administration, financial accounting, office organization, archiving of data, i.e. tasks which serve the maintenance of our business activities, performance of our tasks and provision of our services. The cancellation of the data with regard to contractual services and contractual communication corresponds to the data specified in these processing activities.
We disclose or transmit data to the tax authorities, consultants, such as tax consultants or auditors, as well as other billing agencies and payment service providers.
Furthermore, on the basis of our business interests, we store information on suppliers, event organisers and other business partners, e.g. for the purpose of establishing contact at a later date. This data, which is mainly company-related, is stored permanently.
In order to operate our business economically, to identify market trends, customer and user preferences, we analyse the data available to us on business transactions, contracts, enquiries, etc., in order to identify the most suitable and appropriate solutions. We process inventory data, communication data, contract data, payment data, usage data, metadata on the basis of Art. 6 para. 1 lit. f GDPR, whereby the persons concerned are customers, interested parties, business partners, visitors and users of the online offer.
The analyses are carried out for the purpose of economic evaluations, marketing and market research. We can consider the profiles of the registered users with information e.g. on their purchase transactions. The analyses help us to increase user-friendliness, to optimise our range of products and services and to improve business efficiency. The analyses serve us alone and are not disclosed externally unless they are anonymous analyses with summarized values.
If these analyses or profiles are person-related, they will be deleted or anonymised upon termination by the user, otherwise after two years from the conclusion of the contract. In addition, macroeconomic analyses and general tendency definitions are prepared anonymously wherever possible.
We process the applicant data only for the purpose and within the scope of the application procedure in accordance with the legal requirements. The processing of applicant data is carried out to fulfil our (pre)contractual obligations within the context of the application procedure within the terms of Art. 6 para. 1 lit. b GDPR Art. 6 para. 1 lit. f GDPR insofar as data processing becomes necessary for us, e.g. within the scope of legal procedures (in Germany, section 26 GDPR also applies).
The application procedure requires that applicants provide us with the applicant data. If we offer an online form, the required applicant data are designated, otherwise they result from the job descriptions and basically include personal details, postal and contact addresses and the documents belonging to the application, such as cover letter, curriculum vitae and certificates. In addition, applicants may voluntarily provide us with additional information.
Insofar as specific categories of personal data in the sense of Art. 9 para. 1 GDPR are voluntarily disclosed during the application procedure, their processing is additionally carried out in accordance with Art. 9 para. 2 lit. b GDPR (e.g. health data, such as severely disabled status or ethnic origin). Insofar as specific categories of personal data in the sense of Art. 9 para. 1 GDPR are requested from applicants as part of the application procedure, their processing will also be carried out in accordance with Art. 9 para. 2 lit. a GDPR (e.g. health data if these are necessary for the exercise of the profession).
Applicants can also send us their applications by e-mail. Please note, however, that e-mails are generally not sent in encrypted form and the applicants themselves must ensure that they are encrypted. We can therefore accept no responsibility for the transmission channel of the application between the sender and the reception on our server. Instead of applying via online form and e-mail, applicants still have the option of sending their application by post.
In the event of a successful application, the data provided by the applicants may be further processed by us for employment purposes. Otherwise, if the application for a job offer is not successful, the applicant's data will be deleted. Applicants' data will also be deleted if an application is withdrawn, to which applicants are entitled at any time.
Applicants are hereby informed that they will be included in our "talent pool" for a period of two years on the basis of their consent in accordance with Art. 6 para. 1 lit. b and Art. 7 GDPR.
The application documents in the talent pool will be processed solely within the scope of future job advertisements and the employee search and will be deleted at the latest after the deadline. Applicants are hereby informed that their consent to their inclusion in the Talent Pool is voluntary, has no influence on the current application procedure and that they can revoke this consent at any time for the future and declare objection within the terms of Art. 21 GDPR.
Users can optionally create a user account. During the registration process, the necessary mandatory information will be provided to the users. The data entered during registration will be used for the purpose of using the offer. Users may be informed by e-mail of information relevant to the offer or registration, such as changes in the scope of the offer or technical details. If users have terminated their user account, their data will be deleted with regard to the user account, subject to its retention for commercial or tax reasons pursuant to Art. 6 para. 1 lit. c GDPR. On termination, it is the responsibility of the users to secure their data before the end of the contract. We are entitled to irretrievably delete all user data stored during the term of the contract.
Within the scope of using our registration and login functions as well as the use of the user account, we store the IP address and the time of each user action. The data storage is based on our legitimate interests, as well as the user's protection against misuse and other unauthorized use. This data will not be passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so in accordance with Art. 6 para. 1 lit. c GDPR. The IP addresses are anonymized or deleted after 7 days at the latest.
When contacting us (e.g. via contact form, e-mail, telephone or via social media), the user's details will be processed for the purpose of processing the contact enquiry and processing it in accordance with Art. 6 para. 1 lit. b GDPR. The user data can be stored in a customer relationship management system ("CRM system") or comparable query management system.
We will delete the requests if they are no longer required. We review the appropriateness every two years; furthermore, the statutory archiving obligations apply.
By the following information we inform you about the contents of our newsletter as well as the registration, mailing and statistical evaluation procedures and your rights of objection. By subscribing to our newsletter, you declare your consent to the receipt and procedures described.
Contents of the newsletter We send newsletters, e-mails and other electronic notifications containing advertising information (hereinafter referred to as "newsletters") only with the consent of the recipient or a legal permission. Insofar as the contents of the newsletter are specifically described within the context of registration for the newsletter, they are deemed authoritative for the consent of the user. In addition, our newsletters contain information about our services and us.
Double-Opt-In and logging: The registration to our newsletter takes place in a so-called Double-Opt-In procedure. This means that you will receive an e-mail after registration requesting you to confirm your registration. This confirmation is necessary so that it is not possible to register with external e-mail addresses. The registrations for the newsletter are logged in order to be able to verify the registration process according to the legal requirements. This includes storing the times of login and confirmation as well as the IP address. Likewise the changes of your data stored with the mailing service provider are logged.
Login data: To subscribe to the newsletter, it is sufficient to enter your e-mail address. Optionally we will ask you to enter a name in the newsletter in order to be able to address you personally.
Germany: The newsletter mailing and the performance measurement associated with it is based on the consent of the recipients in accordance with Art. 6 para. 1 lit. a, Art. 7 GDPR in conjunction with section 7 para. 2 no. 3 UWG or on legal permission in accordance with section 7 para. 3 UWG.
The registration procedure is recorded on the basis of our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR. We are interested in deploying a user-friendly and secure newsletter system that serves our business interests, meets users' expectations, and allows us to provide evidence of consent.
Cancellation/revocation - You can cancel the reception of our newsletter, i.e. revoke your consent, at any time. You will find a link to the cancellation of the newsletter subscription at the end of each newsletter. We may store the unsubscribed e-mail addresses for up to three years based on our legitimate interests before deleting them to provide evidence of prior consent. The processing of these data is limited to the purpose of a possible rejection of claims. An individual request for deletion is possible at any time, provided that the former existence of a consent is confirmed at the same time.
The dispatch of the newsletter is carried out by the mailing service provider Inxmail GmbH, Wentzingerstr. 17, D-79106 Freiburg, Germany. You can find the data protection regulations of the mailing service provider here: https://www.inxmail.com/data-conditions. The mailing service provider is appointed on the basis of our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR and an order processing contract in accordance with Art. 28 para. 3 sentence 1 GDPR.
The mailing service provider can use the recipient's data in pseudonymous form, i.e. without allocation to a user, to optimise or improve its own services, e.g. for technical optimisation of the mailing and the presentation of the newsletter or for statistical purposes. However, the mailing service provider does not use the data of our newsletter recipients to write to them itself or to pass the data on to third parties.
The newsletters contain a file that is retrieved from our server when the newsletter is opened or, if we use a mailing service provider, from its server. Within the scope of this retrieval, technical information such as information about the browser and your system, as well as your IP address and time of retrieval are first collected.
This information is used for the technical improvement of the services on the basis of technical data or target groups and their reading behaviour on the basis of their retrieval points (which can be determined with the help of the IP address) or access times. Statistical surveys also include determining whether newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to the individual newsletter recipients. It is, however, neither our ambition nor, if used, that of the mailing service provider to monitor individual users. The evaluations serve us much more to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.
As part of Matomo's range analysis, the following data is processed on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online service within the meaning of Art. 6 para. 1 lit. f GDPR): the type of browser and browser version you use, the operating system you use, your country of origin, the date and time of the server enquiry, the number of visits, the length of your stay on the website and the external links you click on. The user’s IP address will be anonymized before it is stored.
Users can object to the anonymous collection of data by the Matomo program at any time with effect for the future by clicking on the link below. In this case, a so-called opt-out cookie is stored in your browser, which means that Matomo no longer collects any session data. If users delete their cookies, however, this has the consequence that the opt-out cookie is also deleted and must therefore be again activated by the users.
We would like to point out that this may involve the processing of user data outside the territory of the European Union. This may entail risks for users, e.g. by making it more difficult to enforce users' rights. With respect to US vendors certified under the Privacy Shield, we would like to point out that they are committed to comply with EU privacy standards.
The processing of users' personal data is carried out on the basis of our legitimate interests in effective information for users and communication with users pursuant to Art. 6 para. 1 lit. f. GDPR. If the users are asked by the corresponding providers for their consent to data processing (i.e. declare their consent e.g. by ticking a checkbox or confirming by clicking a button), the legal basis for processing is Art. 6 para. 1 lit. a., Art. 7 GDPR.
For detailed description of the respective processing and the opt-out possibilities, we refer to the linked information of the providers below.
Also in case of requests for information and the assertion of user rights, we point out that these can be asserted most effectively with the providers. Only the providers have access to the data of the users and can directly take appropriate measures and provide information. If you still need help, please do not hesitate to contact us.
- Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) - data protection declaration: https://www.facebook.com/about/privacy/, Opt-Out: https://www.facebook.com/settings?tab=ads und http://www.youronlinechoices.com, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active.
- Google/ YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) – data protection declaration: https://policies.google.com/privacy, Opt-Out: https://adssettings.google.com/authenticated, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.
- Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA) – data protection declaration/ Opt-Out: http://instagram.com/about/legal/privacy/.
- Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA) - data protection declaration: https://twitter.com/en/privacy, Opt-Out: https://twitter.com/personalization, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active.
- Pinterest (Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA) – data protection declaration/ Opt-Out: https://about.pinterest.com/en/privacy-policy.
- LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland) - data protection declaration https://www.linkedin.com/legal/privacy-policy , Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active.
- Xing (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Deutschland) - data protection declaration/ Opt-Out: https://privacy.xing.com/en/privacy-policy/.
Within the scope of our online services, we act on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online services in the sense of Art. 6 para. 1 lit. f. of the GDPR) content or service offers from third parties in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as "content").
This always assumes that the third-party providers of this content recognize the IP address of the user, since they could not send the content to their browser without the IP address. The IP address is thus required for the presentation of these contents. We do our best to use only those contents whose providers only use the IP address to deliver the contents. Third parties may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may include technical information about the browser and operating system, referring websites, time of visit and other information about the use of our website, as well as may be linked to such information from other sources.
We integrate videos of the platform “YouTube” of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Data protection declaration: https://www.google.com/policies/privacy/, Opt-Out: https://adssettings.google.com/authenticated.
We integrate the function for recognition of bots, e.g. for entries in online forms ("ReCaptcha") of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Data protection declaration: https://www.google.com/policies/privacy/, Opt-Out: https://adssettings.google.com/authenticated.
We integrate the maps of the service "Google Maps" of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The data processed may include, in particular, IP addresses and location data of users, which are not collected without their consent (usually performed as part of the settings made on their mobile devices). The data may be processed in the USA. Data protection declaration: https://www.google.com/policies/privacy/, Opt-Out: https://adssettings.google.com/authenticated.

References: Art. 13
 Art. 6
 Art. 7
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 44
 Art. 20
 Art. 77
 Art. 21
 Art. 17
 Art. 6
 Art. 28
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 9
 Art. 9
 Art. 9
 Art. 9
 Art. 6
 Art. 7
 Art. 21
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 7
 Art. 6
 Art. 6
 Art. 28
 Art. 6
 Art. 6
 Art. 6
 Art. 7
 Art. 6