Source: https://www.arges.de/company/privacy-policy/
Timestamp: 2019-04-25 11:56:32+00:00

Document:
This data protection statement provides you with information about the type, extent and purpose of processing personal data (hereinafter “data“ for short) within our online offer and the websites, functions and contents connected with it, as well as external online presences, such as our social media profile (hereinafter jointly referred to as “online offer”). With regard to the terminology used, such as “processing“ or “controller“, we make reference to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).
Meta/communications data (e.g. equipment information, IP addresses).
Visitors and users of the online offer (hereinafter, we also refer to the data subjects altogether as “users”).
“Personal data“ is any information relating to an identified or identifiable natural person (in the following “data subject“); a natural person is considered identifiable who can be identified directly or indirectly – especially by means of allocation to an identifier, such as a name, to an identification number, to location data, to an online identification (e.g. cookie) or who can be identified with one or several special characteristics which are an expression of the physical, physiological, genetic, psychological, economic, cultural or social identity of this natural person.
“Processing“ is any operation executed with or without the assistance of automated processes or any such set of operations in connection with personal data. The term has a broad meaning and comprises practically any handling of data.
“Pseudonymisation“ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
“Profiling“ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
“Controller“ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
In accordance with Art. 13 GDPR, we advise you of the legal bases of our data processing. If the legal basis is not specified in the data protection statement, the following applies: Legal basis for obtaining consents is Art. 6 paragraph 1 letter a and Art. 7 GDPR; the legal basis for processing in order to perform our services and for the implementation of contractual measures as well as for answering inquiries is Art. 6 paragraph 1 letter b GDPR; the legal basis for processing in order to meet our legal obligations is Art. 6 paragraph 1 letter c GDPR, and the legal basis for processing in order to safeguard our legitimate interests is Art. 6 paragraph 1 letter f GDPR. In the event that vital interests of the data subject or of another natural person require the processing of personal data, Art. 6 paragraph 1 letter d GDPR will serve as the legal basis.
According to Art. 32 GDPR, we take suitable technical and organisational measures to ensure a level of protection which is commensurate with the risk – taking into account the state of the art, the costs of implementation, and the type, scope, circumstances and the purposes of processing as well as the different probabilities of occurrence and the severity of risk in terms of the rights and freedoms of natural persons.
The measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical admission to the data, as well as their corresponding access, their input, transfer, ensuring their availability and separation. Moreover, we established procedures ensuring the exercise of the rights of data subjects, erasure of data and reactions to any risk to data. Furthermore, we take into account the protection of personal data already with the development or selection of hardware, software as well as methods according to the principles of data protection by design and by default (Art. 25 GDPR).
As far as we disclose – within the scope of our processing – data to other persons and enterprises (processors or third parties), transfer such data to them or otherwise grant them access to the data, this shall only be on the basis of a statutory authorisation (e.g. if a transfer of data to third parties – such as payment service providers – is required pursuant to Art. 6 paragraph 1 letter b GDPR for contract performance), or if you consented, or if a legal obligation thus provides, or on the basis of our legitimate interests (e.g. when using representatives, web hosters, etc.).
As far as we engage third parties with the processing of data based on a so-called "processing contract", this shall be effected on the basis of Art. 28 GDPR.
As far as we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or as far as this occurs within the scope of utilisation of third party services or the disclosure or transfer of data to third parties, this shall only be effected if this is done for performance of our (pre-)contractual obligations, or done based on your consent, on a statutory obligation or on the basis of our legitimate interests. Subject to statutory or contractual permissions, we process the data or have them processed in a third country only if the special prerequisites of Art. 44 et seq. GDPR exist. That means processing is effected on the basis of special guarantees, such as the officially accepted establishment of a data protection level corresponding to that of the EU (e.g. for the U.S., by the "privacy shield") or compliance with officially accepted, specific contractual obligations (so-called "standard contractual clauses").
You have the right to demand confirmation to the effect of whether corresponding data are processed, and information about such data as well as the right to further information and copies of the data according to Art. 15 GDPR.
According to Art. 16 GDPR, you have the right to demand completion of the data concerning you or correction of the incorrect data concerning you.
According to Art. 17 GDPR, you have the right to demand that the data concerned are immediately erased or, alternatively, according to Art. 18 GDPR, you have the right to demand restriction of processing of the data.
According to Art. 20 GDPR, you have the right to demand that you receive the data concerning you and which you provided to us and demand their transmission to other controllers.
According to Art. 77 GDPR, you furthermore have the right to file a complaint with the responsible supervisory authority.
According to Art. 7 paragraph 3 GDPR, you have the right to withdraw already granted consents effective for the future.
According to Art. 21 GDPR, you have the right to object at any time to future processing of the data concerning you. In particular, you may object to processing for direct marketing purposes.
Cookies are small files saved on the users' computers. Various information may be stored in the cookies. A cookie primarily serves to store information about a user (or the device on which the cookie is saved) during or even after the user's visit to an online presence. Temporary cookies or "session cookies" or "transient cookies" are those cookies which are erased after a user leaves an online presence and closes his or her browser. Such a cookie may be used, for example, to save the contents of a shopping basket in an online shop, or to save a login status. Cookies are called "permanent" or "persistent" which remain stored even after the browser is closed. The login status may thus be stored, for example, if the users visit such a web presence after several days. Also, such a cookie may save the users' interests which are used for range measurements or for marketing purposes. "Third party cookies" are those which are offered by other providers than the controller who operates the online presence (if only this controller's cookies are concerned, they are called "first party cookies").
We may use temporary and permanent cookies and will advise you thereof within the scope of our data protection statement.
If users do not want cookies stored on their computer, they are requested to deactivate the corresponding option in the system settings of their browser. Stored cookies may be erased in the browser's system settings. The exclusion of cookies may result in a limited functionality of this online presence.
In accordance with Art. 17 and 18 GDPR, the data processed by us are erased or restricted in their processing. Unless explicitly stated within the scope of this data protection statement, the data stored with us are erased as soon as they are no longer required for their intended purpose and if erasure is not in conflict with statutory safekeeping obligations. As far as data are not erased because they are required for other purposes and those permitted by law, their processing shall be restricted. That means the data are blocked and not processed for other purposes. This is applicable, for example, for data which must be retained for commercial or tax law reasons.
In accordance with legal requirements in Germany, safekeeping shall be especially for 10 years pursuant to Sections (§§) 147 paragraph 1 Fiscal Code [AO], 257 paragraph 1 no. 1 and 4, paragraph 4 Commercial Code [HGB] (books, records, management reports, accounting vouchers, trading books, documents relevant for taxation, etc.) and for 6 years pursuant to Section (§) 257 paragraph 1 no. 2 and 3, paragraph 4 Commercial Code [HGB] (commercial letters).
In accordance with legal requirements in Austria, safekeeping shall be especially for 7 years pursuant to Section (§) 132 paragraph 1 Federal Fiscal Code [BAO] (accounting documents, vouchers/invoices, accounts, vouchers, business papers, statement of income and expenditures, etc.); for 22 years in connection with real estate properties; and for 10 years regarding documentation in connection with electronically rendered services, telecommunications, radio and television services which are provided to non-entrepreneurs in EU Member States and for which the Mini One Stop Shop (MOSS) taxation system is used.
We are processing the data of our contract partners and interested parties as well as those of other contracting entities, customers, patrons, clients or contracting partners (uniformly designated as "contract partners") according to Art. 6 paragraph 1 letter b GDPR to provide them with our contractual or precontractual services. The data processed thereby and/or the necessity of their processing are determined according to the underlying contract relationship.
Processed data include the master data of our contract partners (e.g. names and addresses), contact data (e.g. email addresses and telephone numbers) as well as contract data (e.g. services used, contract content, contractual communication, names of contact persons) and payment data (e.g. bank accounts, payment history).
We principally do not process special categories of personal data unless they are component parts of any commissioned or contractual processing.
We process data which are required for the substantiation and performance of the contractual services and we make reference to the necessity of their disclosure as far as they are not evident for the contract partners. Any disclosure to external persons or enterprises shall only be effected if it is required within the framework of a contract. In terms of processing the data entrusted to us within the scope of an order, we shall act in accordance with instructions by contracting entities and the statutory requirements.
Within the scope of any utilisation of our online services, we may store the IP address and the point in time of the respective user action. Storage is effected on the basis of our legitimate interests, as well as the interests of users in protection against misuse and other unauthorised use. Such data shall principally not be transferred to third parties unless the transfer is required for pursuing our claims pursuant to Art. 6 paragraph 1 letter f GDPR or if a statutory obligation exists in this respect pursuant to Art. 6 paragraph 1 letter c GDPR.
Erasure of data is effected if the data are no longer required for compliance with contractual or statutory duties of care, as well as for handling any possible warranty and comparable obligations, with the necessity of safekeeping the data being reviewed every three years; otherwise, the statutory storage obligations are applicable.
We process data within the scope of administrative tasks and the organisation of our business operation, financial accounting and compliance with statutory obligations, such as archiving. We here process the same data which we process within the framework of rendering our contractual services. Fundamentals of processing are provided in Art. 6 paragraph 1 letter c GDPR, Art. 6 paragraph 1 letter f GDPR. Customers, interested parties, business partners and website visitors are affected by processing. The purpose of and our interest in processing lies in administration, financial accounting, office organisation, archiving of data – thus functions used for the maintenance of our business activities, performance of our tasks and provision of our services. Any erasure of data with regard to contractual performance and contractual communications is in compliance with the information indicated with these processing activities.
In this respect, we disclose or transmit data to the fiscal administration, to consultants such as tax consultants or certified public accountants, as well as other fees/charges offices and payment service providers.
Based on our business interests, we furthermore store information about suppliers, organisers and other business partners – for the purpose of future contacts for example. We principally store such predominantly enterprise-specific data on a permanent basis.
In order to be able to run our business economically and to detect market trends, needs or demands of contract partners and users, we analyse the data available to us regarding business transactions, contracts, inquiries, etc. In this respect, we process inventory data, communications data, contract data, payment data, use data, meta data on the basis of Art. 6 paragraph 1 letter f GDPR, and the data subjects including contract partners, interested parties, customers, visitors and users of our online presence.
Analyses are done for the purpose of business assessments, marketing and market research. We can here take into account the profiles of registered users with information, e.g. regarding the services they have used or claimed. These analyses help us increase user friendliness, optimisation of our offers and operational efficiency. The analyses are solely for us and are not disclosed externally unless anonymous analyses with joint figures are concerned.
As far as these analyses or profiles are personalised, they shall be erased or anonymised upon the users' termination; otherwise, two years as of contract conclusion. Incidentally, macro-economic analyses and general trend provisions are prepared in anonymous forms as far as possible.
We process applicants' data only for the purpose and within the scope of the applicants' process in accordance with the statutory requirements. Applicants' data are processed in order to meet our (pre-)contractual obligations within the scope of the application procedure as defined by Art. 6 paragraph 1 letter b GDPR Art. 6 paragraph 1 letter f GDPR as far as data processing – e.g. within the scope of legal procedures – will be required for us (in Germany, Section (§) 26 German Federal Data Protection Act (BDSG) is additionally applicable).
The application procedure requires that applicants communicate their application data to us. As far as we offer an online form, the necessary application data are designated, otherwise result from the job description and principally include information about the person, postal and contact addresses, as well as the documents which are part of the application, such as cover letter, curriculum vitae, also references and certificates. Also, applicants may provide us with voluntary, additional information.
Upon transfer of their application to us, the applicants declare their consent with the processing of their data for purposes of the application procedure in accordance with the type and scope specified in this data protection statement.
As far as special categories of personal data – within the meaning of Art. 9 paragraph 1 GDPR – are provided on a voluntary basis within the scope of the application procedure, they will be processed additionally according to Art. 9 paragraph 2 letter b GDPR (e.g. health data, such as disability or ethnic origin). As far as special categories of personal data – within the meaning of Art. 9 paragraph 1 GDPR – are requested from applicants within the scope of the application procedure, they will be processed additionally according to Art. 9 paragraph 2 letter a GDPR (e.g. health data if they are required for professional activities).
As far as made available, applicants may transmit their applications by means of an online form on our website. Data are sent to us by encrypted transmission according to the state of the art.
Applicants may furthermore transmit their applications via email. Please note, however, that emails are principally not sent in encrypted form and that the applicants themselves must take care of the encryption. Accordingly, we cannot accept any liability for the transmission path of the application between the sender and the receipt on our server; we accordingly recommend to rather use an online form or dispatch by postal service. Instead of sending the application via the online form or email, applicants are also still able to send us their application by postal service route.
In case of a successful application, we are able to further process the data provided by the applicants for the purpose of the employment relationship. Otherwise, the applicants' data are erased if their applications for vacancies are unsuccessful. The applicants' data are also erased if an application is withdrawn to which the applicants are entitled at any time.
Subject to a justified revocation by the applicants, erasure is effected after the expiration of a period of six months so that we are able to answer any possible follow-up questions to the application and are able to meet our obligation to provide proof under the General Equal Treatment Act. Invoices regarding possible reimbursement of travel expenses are archived according to the requirements under tax laws.
Within the scope of the application, we offer applicants the opportunity to be included in our "talent pool" for a period of two years on the basis of consent within the meaning of Art. 6 paragraph 1 letter b and Art. 7 GDPR.
The application documents in the talent pool are processed solely within the scope of future job advertisements and recruitments and will be destroyed at the latest after expiration of the period. The applicants will be informed that their consent to be included in the talent pool is voluntary, that it has no effect on the current application procedure and that they may revoke this consent at any time for the future and are able to declare their objection within the meaning of Art. 21 GDPR.
When contacting us (e.g. by contact form, email, telephone or via social media), the user's information for processing the contact inquiry and its handling will be processed pursuant to Art. 6 paragraph 1 letter b (within the scope of contractual/pre-contractual relations), Art. 6 paragraph 1 letter f (other inquiries) GDPR. The users' information may be stored in a customer relationship management system ("CRM system") or in a comparable inquiry organisation.
We erase the inquiries if they are no longer required. We review their necessity every two years; furthermore, the statutory archiving obligations are applicable.
With the following information, we advise you about the content of our Newsletter, as well as about the registration, dispatch and statistical evaluation process and your rights to object. With your subscription of our Newsletter, you agree to its receipt and the described procedures.
Content of the Newsletter: We will send the Newsletter, emails and other electronic communications with promotional information (hereinafter "Newsletter") only with the recipients' consent or a legal permission. As far as the Newsletter's contents are described in concrete terms within the scope of a registration for the Newsletter, they are relevant for the users' consent. Apart from that, our Newsletters include information about our services and us.
Double opt-in and recording: Registration for our Newsletter is effected in a so-called double opt-in process. That means, after registration, you will receive an email asking you to confirm your registration. This confirmation is necessary so that nobody can register with wrong email addresses. Registrations for the Newsletter are recorded to be able to prove the registration process according to the legal requirements. This includes the storage of the point in time of the registration and the confirmation as well as the IP address. Likewise, the changes of your data are recorded which are stored with the delivery service provider.
Registration data: In order to register for the Newsletter, it is sufficient to provide your email address. Optionally, we ask you to indicate a name, for the purpose of addressing you personally in the Newsletter.
Shipment of the Newsletter and the connected performance assessment is effected on the basis of the consent by the recipients pursuant to Art. 6 paragraph 1 letter a, Art. 7 GDPR in combination with § 7 paragraph 2 no. 3 Law against Unfair Competition (UWG); or, if no consent is required, on the basis of our legitimate interests in direct marketing pursuant to Art. 6 paragraph 1 letter f GDPR in combination with § 7 paragraph 3 Law against Unfair Competition (UWG).
The registration procedure is recorded on the basis of our legitimate interests pursuant to Art. 6 paragraph 1 letter f GDPR. Our interest focuses on the application of a user-friendly and safe Newsletter system which not only serves our business interests but is also in accordance with the users' expectations and, moreover, allows us to provide proof of the consents.
Termination/withdrawal - You may terminate the receipt of our Newsletter at any time, i.e. withdraw your consents. You will find a link for termination of the Newsletter at the end of each Newsletter. We may store the unsubscribed email addresses for up to three years on the basis of our legitimate interests before erasing them in order to be able to provide proof of a formerly given consent. Processing of these data is limited to the purpose of a possible defence against claims. An individual application for erasure is possible at any time if the former existence of a consent is confirmed at the same time.
The hosting services used by us serve to make the following services available: Infrastructure and platform services, computing capacity, memory and database services, email dispatch, security services as well as technical maintenance services which we use for the purpose of operating this online presence.
Here, either we ourselves process – or our hosting provider processes – inventory data, contact data, content data, contract data, use data, meta and communications data of customers, interested parties and visitors to this online presence on the basis of our legitimate interests in an efficient and safe provision of this online presence pursuant to Art. 6 paragraph 1 letter f GDPR in combination with Art. 28 GDPR (conclusion of processing contract).
On the basis of our legitimate interests within the meaning of Art. 6 paragraph 1 letter f GDPR, either we ourselves collect – or our hosting provider collects – data about any access to the server on which this service is provided (so-called server log files). Access data include the name of the accessed website, file, date and time of day of the access, transmitted data volume, message about successful access, browser type including version, user's operating system, referrer URL (the site visited before), IP address and requesting provider.
For security reasons (e.g. for detection of misuse or acts of fraud), log file information is stored for a period of 7 days maximum and erased thereafter. Data whose continued safekeeping is required for purposes of evidence are excluded from erasure until final clarification of the respective incident.
Google is certified under the Privacy Shield agreement and thereby offers a guarantee to comply with the European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
Google will use such information on our behalf to analyse the utilisation of our online presence by the users, to compile reports about the activities within this online presence and to provide to us any further services which are connected with the use of this online presence and the internet use. In this respect, pseudonymised use profiles of the users can be prepared from the processed data.
We use Google Analytics only with activated IP anonymisation. That means the users' IP addresses are truncated by Google within the Member States of the European Union or in other contracting states which are party to the Agreement on the European Economic Area. The full IP address is transferred only in exceptional cases to a Google server in the U.S. and truncated there.
The IP address transmitted by the user's browser is not merged with other data by Google. Users may prevent the saving of cookies by a corresponding setting in their browser software; moreover, users may prevent the collection of data generated by the cookie and concerning the use of data relative to the online presence by Google as well as prevent the processing of such data by Google when they download and install the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
Please find additional information on data use by Google, on possibilities of setting and objection not only in Google's data protection statement (https://policies.google.com/technologies/ads) but also in the settings for the presentation of advertisements by Google (https://adssettings.google.com/authenticated).
The users' personal data are erased after 14 months or anonymised.
On the basis of our legitimate interests (i.e. interest in the analysis, optimisation and efficient operation of our online presence within the meaning of Art. 6 paragraph 1 letter f GDPR), we are using the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, ("Google").
We use the online marketing process Google "AdWords" to place advertisements in the Google advertising network (e.g. in search results, in videos, on websites, etc.) so that they are shown to users presumably interested in the advertisements. This allows us to show advertisements more specifically for and within our online presence in order to present users only with those advertisements which are potentially in accordance with their interests. If a user is shown e.g. advertisements for products he or she had been interested in other online presences, this is called "remarketing". For these purposes, a code by Google is executed directly by Google upon access of our and other websites on which the Google advertising network is active, and so-called (re)marketing tags (invisible graphics or code, also called "web beacons") are implemented in the website. With their help, an individual cookie – i.e. a small file – is saved on the user's device (instead of cookies, comparable technologies may also be used). In this file will be noted which websites the user has visited, which contents he or she is interested in and which offers the user clicked on; furthermore, technical information on browser and operating system, referring websites, time of visit, as well as other information on the use of the online presence.
Furthermore, we will obtain an individual "conversion cookie". The information obtained by means of the cookies allows Google to prepare conversion statistics for us. However, we are only told the anonymous total number of users who had clicked on our advertisement and had been transmitted further to a page provided with a conversion tracking tag. We do not obtain any information, however, by means of which it is possible to personally identify any of the users.
The users' data are processed pseudonymously within the scope of the Google advertising network. That means, Google saves and processes, for example, not the users' names or email addresses but rather processes the relevant data in a cookie related form within pseudonymous user profiles; i.e. from a Google viewpoint, the advertisements are not managed and shown for any specifically and concretely identified person but for the cookie holder instead, irrespective of who this cookie holder is. This does not apply if a user explicitly allowed Google to process the data without such pseudonymisation. The information collected about the users is transmitted to Google and saved on Google servers in the U.S..
We maintain online presences within social networks and platforms to communicate with customers, interested parties and users who are active there and in order to be able to inform them about our services there. For accessing the respective networks and platforms, the terms and conditions as well as the data processing guidelines of the respective operators are applicable.
Unless otherwise specified within the scope of the data protection statement, we will process the users' data as far as they communicate with us within the social networks and platforms, for example by writing contributions on our online presences or sending us messages.
On the basis of our legitimate interests (i.e. interest in the analysis, optimisation and efficient operation of our online presence within the meaning of Art. 6 paragraph 1 letter f GDPR), we are using the content or service offers from third party providers in order to implement their contents and services, such as videos or typefaces (hereinafter uniformly called "contents").
This always on the assumption that the third party providers of such contents are aware of the users' IP addresses since they could not send the content to their browser without having the IP address. Thus, the IP address is required for the presentation of such content. We endeavour to use only such content whose respective providers only use the IP address for the delivery of content. Furthermore, third party providers may use so-called pixel tags (invisible graphics, also called "web beacons") for statistical or marketing purposes. Information may be analysed by means of the "pixel tags" – such as the visitor traffic on pages of this website. Moreover, pseudonymous information may be saved in cookies on the user's device and may include, inter alia, technical information on the browser and the operating system, referring websites, visiting time spent on the website as well as other information about the use of our online presence, and it may also be connected with such information from other sources.
We implement maps of "Google Maps" of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, U.S.A. Processed data may include, in particular, the users' IP-addresses and location data; however, they are not collected without their consent (generally within the scope of their mobile device settings). The data may be processed in the U.S.A. Data protection statement: https://www.google.com/policies/privacy/; opt-out: https://adssettings.google.com/authenticated.
Prepared with Datenschutz-Generator.de of Dr. Thomas Schwenke, Lawyer.

References: Art. 4
 Art. 13
 Art. 6
 Art. 7
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 32
 Art. 6
 Art. 28
 Art. 44
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 20
 Art. 77
 Art. 7
 Art. 21
 Art. 17
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 9
 Art. 9
 Art. 9
 Art. 9
 Art. 6
 Art. 7
 Art. 21
 Art. 6
 Art. 6
 Art. 6
 Art. 7
 § 7
 Art. 6
 § 7
 Art. 6
 Art. 6
 Art. 28
 Art. 6
 Art. 6
 Art. 6