Source: https://www.brainloop.com/en-gb/privacy-notice
Timestamp: 2019-04-26 04:19:36+00:00

Document:
Privacy notice and information of persons concerned according to Article 13 and Article 14 of the EU General Data Protection Regulation (GDPR).
Brainloop AG (hereinafter: "Brainloop") and its affiliated companies take the issue of data protection very seriously and want to ensure that your privacy is protected as a Brainloop customer and user of the Brainloop website.
We have thus prepared this statement on data protection in which we explain how your data is handled. We reserve the right to change the content of this statement from time to time; we therefore recommend that you review it at regular intervals.
In individual areas of the Brainloop website (e.g. the Help section) less data processing takes place than the extent described here.
We process your personal data only with your consent or if permitted by law. We process only the data required to provide our services and to use our website, or data that you voluntarily provide to us.
Personal data includes all information relating to an identified or identifiable natural person (hereinafter “person concerned”). A natural person is considered identifiable if he or she can be identified directly or indirectly, in particular through assignment to an identifier such as a name, ID number, location data, an online ID, or one or more particular characteristics that express the natural person’s physical, physiological, genetic, psychological, economic, cultural, or social identity.
Data subject is any identified or identifiable natural person whose personal data is processed by the party responsible for data processing (Brainloop).
Processing means any executed operation in connection with personal data such as collecting, recording, organizing, arranging, storing, editing or changing, selecting, querying, utilizing, disclosing through transmission, dissemination or other means of delivery, comparing, linking, restricting, deleting, or destroying.
A processor is a natural person or legal entity, authority, institution, or other office that processes personal data on behalf of the responsible party.
Consent is any statement of intent voluntarily given by the person concerned in an informed and unambiguous manner for the particular case, in the form of a declaration or other clear affirmative action with which the person concerned indicates that he or she is agreement with the processing of the personal data pertaining to him or her.
3.2 Brainloop saves and uses Data entered by the user on the website (e.g. first name, last name, email address) on the systems of the company Salesforce.com Sàrl, Route de la Longeraie 9, 1110 Morges, Switzerland (hereinafter “Salesforce”) for the purpose of customer relationship management. Salesforce is Brainloop’s data processor and acts exclusively in accordance with Brainloop’s instructions. Brainloop has concluded appropriate contractual agreements with Salesforce in order to comply with the applicable legal requirements.
3.3 The period of data storage is based on the legal retention requirements.
brainloop_contact: This cookie saves information on your visit of the website. It allows users to be recognized on the website and use all of its functionalities. The cookie is necessary to properly display and use the website. It expires when your visit to the website ends.
selected_language:This cookie saves your chosen language for the website. It expires after six months.
In this case an opt-out cookie will be set that will prevent the collection of your data when visiting this website in the future. Further information is available at http://www.google.com/analytics/terms/us.html and at https://policies.google.com/?hl=en. We also use Google Analytics to evaluate data from the double-click cookie for statistical purposes. If you do not wish this, you can deactivate it using Google ads personalization (https://support.google.com/ads/answer/2662922?hl=en).
Further information is available at http://www.google.com/analytics/terms/gb.html and at https://www.google.com/intl/en/policies/.
4.3 Our website utilizes the remarketing function of Google Inc. (“Google”). The operating company of the Google Remarketing services is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351. This function allows us to address visitors to our website with specific advertising by displaying ads that are personalized and based on their interests when they visit other websites in the Google Display Network.
4.4 We use the marketing automation software HubSpot on our website.
(1) HubSpot uses a cookie that it places on the user’s computer to collect data.
It collects the following data: information about the computer you are using, your visit to our website, especially your IP address, your location, your browser, the referral source and the duration of your visit to our website. This information is stored on one of HubSpot’s servers. The legal basis for the processing of aforementioned data is § 15 para. 3 TMG and Art. 6 para. 1 lit. f GDPR.
(2) When you register for one of our offers using a web-based form, you give Brainloop consent to use the data collected via the web-based form after you fill it out and confirm the data protection notice. Your contact information – including your name, email address, company name, address and phone number are collected and saved. We only use this data for statistical analyses in order to ensure the trouble-free operation of our offering and to optimize it on an ongoing basis. We also use the data to optimize our marketing activities. We hereby confirm that your data is stored in HubSpot databases and under certain conditions also in Salesforce CRM database. The data stored in Salesforce will only be passed on to affiliated companies of the Diligent group of companies, in particular Diligent Corp., who process the data as contract processors for Brainloop while observing appropriate guarantees in accordance with Art. 44 ff. GDPR -(for details see section 10 below). The personal information we process includes information about you that is freely available on the internet and that HubSpot also stores. We reserve the right to use the information to contact visitors to our website by mail or phone, assuming they have provided their contact details for this purpose, to enable us to find out which of our company’s services they are interested in.
HubSpot is a software company based in the USA with a subsidiary in Ireland. Contact: HubSpot, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland. Phone: +353 1 518 7500. HubSpot complies with the TRUSTe Privacy Seal standard. Brainloop and HubSpot have signed an agreement that comprises the standard EU contractual clauses in order to regulate data transmission. Further information about HubSpot and its privacy protection is available at http://legal.hubspot.com/privacy-policy. If you do not want the information about your visit to be used, please do not hesitate to contact us (see section 10 for contact details).
If you do not want data regarding your usage to be collected by HubSpot and Google Analytics, you can disable the tracking function of both tools by clicking on the link below.
This places an opt-out cookie in your browser that will prevent your data from being collected in the future when you visit this website.
Brainloop offers social plugins from various social networks (e.g. Xing, LinkedIn, Twitter, etc.) on its website.
Access to XING (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany) can be found on our website via the “X” or “XING” icon. When you click to activate the “XING” icon a connection with the XING server is established and the XING Share Button functions (especially the calculation/display of the counter value) are loaded on the respective Internet page. XING does not save any personal data from you when you access this Internet page; XING also does not save any IP addresses in particular. There is no evaluation of your usage behavior through cookies in connection with the XING Share Button. The respective current data protection information regarding the XING Share Button as well as supplementary information may be found at https://www.xing.com/app/share?op=data_protection.
In order to protect your privacy regarding the other social plugins (e.g. YouTube), we use a technical solution to integrate them which prevents data (e.g. IP addresses) from already being sent to the respective social networks just through opening our website.
6.1 If you consent into our Data Privacy notice and by completing our web-based-forms we are allowed to use your data (e.g. first and last name, email address) for sending information on Brainloop products and services if you have expressly requested this (e.g. using the contact form) or subscribed to the Brainloop information services. A confirmation email is sent to the email address first entered for information mailing in a double opt-in process for legal reasons. We also send a confirmation email to prospects who contact us via web-based-form. This confirmation email serves to check whether the owner of the email address has authorized receipt of the information email.
In order for Brainloop to receive information about the interactions on the email recipient’s side, a function called “tracking pixel” is used in the HubSpot products. This function uses image resources to recognize when a recipient opens an email sent via one of the HubSpot products. When an email is sent via the HubSpot marketing or sales product, an image tag for a miniscule image is inserted in the body of the email. If the recipient opens the message with an appropriately configured email client, the client sends a request for the image to the HubSpot platform. This request is converted into the email opening rate, which is available to Brainloop for evaluation. These pixel requests contain no information that may be traced back to persons and are masked by a long, randomly generated character sequence.
You may revoke your statement of consent given to us and your consent to the storage of personal data at any time with effect for the future in accordance with section 8 of this Data Privacy notice. If you have subscribed to the Brainloop information services, you may also revoke your consent by clicking the link contained in the respective email.
In addition, you can use the “deactivate tracking” function according to section 4.5.
6.2 We may additionally use your date as permitted by law for sending you information on our products and services through the post, for example. You may object to this use of your data at any time with effect for the future; information on your right to object can be found in section 8.
7.1 We process personal data regarding you for the purposes of your application for employment, in so far as it is required for the decision on employment. The legal basis is § 26 Par. 1 along with Par. 8 S. 2 of the German Federal Data Protection Act (FDPA). This applies to data in connection with your application, such as data on your identity (first and last name, address, contact information), information on your professional qualifications and education, information on professional training, or other information that you provide to us in connection with your application. In addition, we may process professional information that you have made publicly available, such as on profiles in social media networks.
Further, we may process your personal data to the extent necessary to defend against legal claims arising from the application process. The legal basis is Art. 6 Par. 1 lit. f GDPR.
Should an employment relationship be established between us, we may process your personal data already received for the purposes of the employment relationship as well, if required for carrying out or terminating the employment relationship (legal basis: § 26 Par. 1 FDPA).
Applicant data are stored as long as necessary for the decision regarding your application. If no employment relationship is established between us, your application data are deleted four months after the negative decision is announced, if a longer period of storage is not required to avoid litigation.
You have the right to request a confirmation from Brainloop regarding whether your personal data are being processed. You may contact our data protection officer or the address provided in section 10 at any time for this purpose.
In addition, you have the right to know whether your personal data were transmitted to a third country or to an international organization. If this is the case, you also have the right to receive information about the appropriate guarantees in connection with the transmission.
If you would like to exercise this right to information, you may contact our data protection officer or the address provided in section 10 at any time.
You have the right to request the immediate correction of incorrect personal data concerning you. You also have the right, under consideration of the purposes of the data processing, to request that incomplete personal data be made complete – including by means of a supplementary statement.
If you would like to exercise this right to correction, you may contact our data protection officer or the address provided in section 10 at any time.
You are revoking your consent upon which the processing is based according to Art. 6 Par. 1 a GDPR or Art. 9 Par. 2 a GDPR and there is no other legal basis for the processing.
You are objecting according to Art. 21 Par. 1 GDPR and there are no overriding legitimate reasons for the data processing, or you object to the processing according to Art. 21 Par. 2 GDPR.
The deletion of the personal data is necessary to meet a legal obligation according to the law of the European Union or the Member States to which Brainloop is subject.
In so far as one of the reasons above applies and you would like to effect the deletion of your personal data saved at Brainloop, you may contact our data protection officer or the address provided in section 10 at any time.
If the personal data were made public by Brainloop and if Brainloop is obliged to delete them as the responsible party according to Art. 17 Par. 1 GDPR, Brainloop will take appropriate measures under consideration of the available technology and the implementation costs to inform other responsible parties processing the published personal data that you have requested that they delete all links to the data and copies of the data, in so far as the data processing is not required.
If one of these prerequisites is given and you would like to request the limitation of personal data stored by Brainloop you may contact our data protection officer or the address provided in section 10 at any time.
You have the right to receive the personal data that you have provided Brainloop outside of the Brainloop Secure Dataroom or MyRoom offered by Brainloop in an organized, accessible, and machine-readable format. You are also entitled to transmit the personal data to another responsible party without interference by Brainloop, in so far as the processing is based on consent according to Art. 6 Par. 1 lit. a GDPR or Art. 9 Par. 2 lit. a GDPR, or on a contract according to Art. 6 Par. 1 lit. b GDPR, and in so far as the processing is done with automated procedures and is not necessary for performing a task in the public interest or in the exercise of public authority delegated to the responsible party.
When exercising your right to data portability according to Art. 20 Par. 1 GDPR, you have the further right to have the personal data transmitted directly from one responsible party to another responsible party, if this is technically feasible and does not infringe upon the rights and freedoms of other persons.
If you would like to exercise this right to data portability, you may contact our data protection officer or the address provided in section 10 at any time.
You have the right to object at any time, for reasons resulting from your particular situation, to the processing of your personal data taking place based on Art. 6 Par. 1 lit. e or f GDPR. This also applies to profiling based on these provisions.
Brainloop no longer processes personal data in the case of an objection unless we can demonstrate compelling legitimate reasons for the processing that outweigh the interests, rights, and freedoms of the person concerned, or unless the data processing serves to assert, exercise, or defend legal claims.
If personal data are used for direct advertising purposes, you have the right at any time to object to the processing of your personal data for such advertising. If you object to Brainloop to the data being processed for direct advertising purposes, Brainloop will no longer process your personal data for these purposes.
If you would like to exercise this right to object, you may contact our data protection officer or the address provided in section 10 at any time.
If you would like to exercise this right to revoke consent, you may contact our data protection officer or the address provided in section 10 at any time.
Without prejudice to any other judicial remedy, you have the right to complain to a supervisory authority responsible for data protection if you are of the opinion that the processing of your personal data violates the GDPR. The responsible supervisory authorities are those of the Member State of your residence, your workplace, or the place of alleged infringement. The supervisory authority to which the complaint was made will inform the complainant of the status and results of the complaint including the possibility of legal remedy according to Art. 78 GDPR.
Besides the legal basis listed in sec. 4.2, 4.3 and 4.4. above, the following applies: If we obtain consent for the processing of data, the legal basis is Art. 6 Par. 1 lit. a GDPR. If processing personal data is required to fulfil an agreement (e.g. agreement on the use of the Brainloop Services) or to process inquiries regarding Brainloop services before an agreement is concluded, the processing takes place according to Art. 6 Par. 1 lit. b GDPR. If Brainloop is under a legal obligation that requires the processing of personal data, such as meeting tax and social security obligations, the legal basis of such processing is Art. 6 Par. 1 lit. c GDPR.
10.1 Brainloop ensures a high level of security when passing on your data. We therefore only transmit your data to partner companies and service providers who have been carefully selected beforehand and who are contractually obliged in accordance with the relevant data protection regulations (order processing relationships).
In addition, a transfer of data to partner companies and service providers only occurs if this is necessary to perform the services offered, if you have given us your consent, or if the transfer is legally required or permissible. Your data will neither be sold to third parties nor marketed in any other way. The transmission of data to state agencies and authorities only takes place within the framework of mandatory legal provisions.
In order to ensure a uniform level of data protection, data will only be transferred to partner companies and service providers in third countries outside the scope of the GDPR if suitable guarantees in accordance with Art. 44 ff. GDPR have been made with the contract processor. This is done in particular through agreement on "standard contractual clauses (contract processors) pursuant to Article 26(2) of Directive 95/46/EC for the transfer of personal data to contract processors established in third countries where an adequate level of protection is not ensured" ("EU standard contractual clauses (contract processors)") pursuant to Article 46(2)(c) GDPR. A copy of these regulations is available upon request from the office listed in section 11.
An up-to-date list of all partner companies and service providers is available upon request from the office listed in section 11.
10.2 Brainloop will also share your data with companies of the Diligent Group affiliated with Brainloop, in particular Diligent Corp., USA (1385 Broadway, 19th Floor, New York, NY 10018). An up-to-date list of all Diligent Group companies affiliated with Brainloop is available upon request from the office listed in section 11.
to support, prepare and optimize marketing measures.
10.2.2 The applicant data collected by Brainloop (see section 7 above) will be passed on, for example, for the implementation of personnel planning and development measures concerning several companies of the Diligent Group.
10.2.3 Brainloop remains responsible for the processing of personal data when passing on data to affiliated companies of the Diligent Group, in particular Diligent Corp., USA (1385 Broadway, 19th Floor New York, NY 10018). The affiliated companies of the Diligent Group act exclusively as contract processors for Brainloop hereby.
10.2.4.1 A uniform level of data protection is established by agreement on “standard contractual clauses (contract processors) pursuant to Article 26(2) of Directive 95/46/EC for the transfer of personal data to contract processors established in third countries where an adequate level of protection is not ensured” (“EU standard contractual clauses (contract processors)”) pursuant to Article 46(2)(c) GDPR. A copy of these regulations is available upon request from the office listed in section 11.
10.2.4.2 Diligent Corp., USA (1385 Broadway, 19th Floor New York, NY 10018), also participates in the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework and is certified for compliance with these Privacy Shields. Diligent Corp., in trusting the respective Privacy Shield, has committed to subjecting all personal data received from member states of the European Union (EU) or Switzerland to the respective principles of the Privacy Shield. For more information about the Privacy Shield, visit the U.S. Department of Commerce's Privacy Shield List: https://www.privacyshield.gov/list.
Website: www.iitr.de Any person concerned may contact our data protection officer directly at any time regarding all data protection questions and suggestions.
The representative according to Art. 27 GDPR of contract processors not established in the European Union of the affiliated companies of the Diligent Group is Diligent Boardbooks Limited, 1 Strand, Grand Buildings, First Floor, London, WC2N 5HR, United Kingdom.

References: § 15
 Art. 6
 Art. 44
 § 26
 Art. 6
 § 26
 Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 17
 Art. 6
 Art. 9
 Art. 6
 Art. 20
 Art. 6
 Art. 78
 Art. 6
 Art. 6
 Art. 6
 Art. 44
 Art. 27