Source: https://www.auto1-group.com/privacy/
Timestamp: 2019-04-24 03:49:46+00:00

Document:
Thank you for your interest in our company and for visiting our website www.auto1-group.com (hereinafter the “Website”). AUTO1 Group GmbH (hereinafter “AUTO1 Group” or “we”) takes the protection of your personal data very seriously.
Should personal data (e.g. the name, address, e-mail address or telephone number of a person affected [such person hereinafter the “Data Subject”]) be processed, then this is done exclusively in accordance with the EU General Data Protection Regulation (hereinafter “GDPR”) and the country-specific data protection provisions applicable to AUTO1 Group (German Data Protection Act in the version in force from 25 May 2018 [Bundesdatenschutzgesetz], hereinafter “GDPA”).
Any processing of personal data for which there is no statutory legal basis will occur (if at all) only with the Data Subject’s consent.
This data privacy statement provides information to you on the nature, scope and purpose of the personal data processed by AUTO1 Group as well as the rights to which you are entitled.
The legal basis for this processing activity is Art. 6(1)(f) GDPR. This data in anonymised form is analyzed by AUTO1 Group statistically, on the one hand, and with the aim of increasing data protection and data security, on the other.
The anonymous data of the server log files is stored separately from all personal data provided by a Data Subject.
AUTO1 Group collects the personal data that the applicant has provided via the online applicants’ portal (hereinafter the “Applicants’ Data”).
Responsibility for carrying out the application process as well as processing the application lies with AUTO1 Global Services GmbH & Co. KG, a subsidiary of AUTO1 Group, (hereinafter “AUTO1 Global“). For this purpose AUTO1 Group transmits the Applicants’ Data to AUTO1 Global. The Applicants’ Data is only used for purposes of the application process. In addition, AUTO1 Group may forward the Applicants’ Data to the AUTO1 Subsidiary to which the applicant is applying.
Prior to any transmission of the Applicants’ Data, the applicants’ attention is explicitly drawn to the processing of the Applicants’ Data by AUTO1 Global and the forwarding of their Applicants’ Data to AUTO1 Global and to the respective responsible AUTO1 Subsidiary, whereupon the applicants give their express consent in that regard. This consent is the legal basis for this processing according to Art. 6(1)(a) GDPR. Without that express consent by the applicants the application process cannot be started.
Applicants may revoke their consent at any time with effect for the future by sending an e mail to datenschutz@auto1-group.com. Such revocation of consent constitutes a withdrawal of an applicant’s application.
For purposes of the application process, we use the software of SmartRecruiters Europe Ltd, 59–60 Thames Street, Windsor, Berkshire SL4 1TX, United Kingdom (hereinafter “SmartRecruiters“).
For this purpose, Applicants’ Data is stored and processed on the servers of SmartRecruiters in Germany and the EU. AUTO1 Group has carefully chosen SmartRecruiters. The protection of the Applicants’ Data has been ensured by way of a contract with SmartRecruiters regarding contract data processing, under which SmartRecruiters processes the personal data only when commissioned to do so by AUTO1 Group and according to its instructions. The legal basis for this is Art. 28 GDPR.
SmartRecruiters relies on the services provided by SendGrid Inc., 1801 California Street, Suite 500 Denver, CO 80202, USA (hereinafter “SendGrid“) in order to facilitate the sending and receipt of e mails to and from applicants via the software of SmartRecruiters. In that context, Applicants’ Data is transmitted to servers of SendGrid in the US and thus to a country outside the EU or the European Economic Area.
The transmission is permissible pursuant to art. 45 GDPR because SendGrid has been certified under the Private Shield framework and, therefore, an appropriate level of data protection exists in accordance with the Commission Implementing Decision (EU) 2016/1250. The certification can be viewed at https://www.privacyshield.gov/participant?id=a2zt0000000TRktAAG&status=Active.
Applicants’ Data is usually erased automatically 12 months after the application process has been concluded. Between the completion of the application and recruitment process and the erasure, the data is stored for evidentiary purposes. The legal basis for this processing activity is Art. 6(1)(f) GDPR.
AUTO1 Group receives assistance from outside service providers for certain technical data analysis, processing or storage processes (e.g. to obtain aggregated, non-personal statistics from data bases or for the storage of backup copies). These service providers are carefully selected and meet high data protection and data security standards. They are obligated to maintain strict confidentiality and process personal data only when commissioned to do so by AUTO1 Group and according to AUTO1 Group’s instructions. The legal basis for the involvement of such service providers is Article 28 GDPR.
AUTO1 Group cooperates with companies and other entities which provide specialized expertise with regard to special areas (e.g. tax consultants, legal counsel, accounting firms, logistics companies). These entities are either legally or contractually obliged to maintain confidentiality. If a transmission of personal data to these entities is necessary, the legal basis is, depending on the respective kind of cooperation, Article 6(1)(b) or, (f) GDPR.
Cookies are text files that are placed and stored on a computer system via an internet browser. Cookies are stored on the hard drive of the user’s computer and do not cause any damage there. The cookies of the Website contain personal data about the user. Cookies save the user of the Website the trouble of, for example, having to re-enter data, simplify the transmission of specific content and help AUTO1 Group in identifying particularly popular areas of the Website. This enables AUTO1 Group, among other things, to adjust the contents of the Website exactly to the needs of its users. The legal basis for this processing activity is Art. 6(1)(f) GDPR.
The user may, at any time, prevent this Website from placing any cookies by making a corresponding adjustment to the settings of the internet browser used, and thereby permanently objecting to the placing of cookies. Furthermore, any cookies that have already been placed may be deleted at any time via an internet browser or other software programs. This is possible in all the commonly-used internet browsers.
If the user deactivates the placing of cookies in the internet browser used, potentially not all functions of this Website will be usable to their full extent.
This Website uses Google Tag Manager.
This service allows website tags to be managed via an interface. Tags are small code elements which serve, among other things, to measure traffic and visitor behavior. Google Tag Manager only implements tags. No cookies are used, and hence no personal data is collected, as part of that process.
Google Tag Manager triggers other tags, which in turn potentially collect data. Google Tag Manager does not, however, access this data. If a deactivation was effected at the level of the domain or cookie, it remains in place for all tracking tags provided that they are implemented with Google Tag Manager.
This Website uses the tracking tool CrazyEgg.com in order to record randomly selected individual visits (only with an anonymized IP address). Using cookies, this tracking tool allows an analysis of the way in which you use the Website (e.g. what content is being clicked on). To that end, a user profile is displayed visually. The tool creates user profiles using pseudonyms. The legal basis for this processing activity is your consent according to Art. 6(1)(a) GDPR/Art. 6(1)(f) GDPR.
You may at any time object to the processing of the data generated by CrazyEgg.com by following the instructions at http://www.crazyegg.com/opt-out.
For further information on data protection at CrazyEgg.com please see http://www.crazyegg.com/privacy.
Google Analytics is a web-analytics service. Web analytics is the collection, compilation and analysis of data regarding the behavior of visitors to webpages. A web-analysis service collects, among other things, data as to the question from which webpage a Data Subject has arrived on a webpage (known as a referrer), which sub-sites of the website were accessed or how often and for which length of stay a sub-site was viewed. A web analysis is primarily used to optimize a webpage and to carry out a cost-benefit analysis of internet advertising.
The operating company of the Google-Analytics component is Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. Google LLC has been certified under the Privacy-Shield frame-work and thereby offers a guarantee that it is in compliance with European data protec-tion law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
For web analysis via Google Analytics AUTO1 Group uses the suffix “_gat._anonymizeIp”. By means of this suffix, the IP address of the internet connection of the Data Subject is truncated and anonymized by Google if our Website is accessed from a member state of the European Union or from another contracting state of the Agreement on the European Economic Area.
The purpose of the Google-Analytics component is the analysis of the flow of visitors on the Website. Google uses the data and information collected, among other things, to analyze the use of the Website in order to compile online reports for us that show the activities on the Website and to provide additional services connected to the use of the Website.
Google Analytics uses what is known as “cookies”, i.e. text files that are stored on your computer and enable an analysis of how you have used the website.
Each time that one of the individual pages of this Website — which is operated by the controller responsible for the processing and on which a Google-Analytics component has been integrated — is accessed, the internet browser on the IT system of the Data Subject is automatically induced by the respective Google-Analytics component to transmit data to Google for purposes of online analysis. In the context of this technical process, Google will learn of personal data — such as the IP address of the Data Subject —, which enables Google, among other things, to trace the provenance of the visitors and clicks and as a result to allow commissions to be invoiced.
By means of the cookie, personal data — for example the time of access, the place from which our Website was accessed, and the number of times that the Data Subject visited our Website — is stored. Each time our Website is visited, this personal data, including the IP address of the internet connection used by the Data Subject, is transferred to Google in the US. This personal data is stored by Google in the US. Google potentially transmits this personal data, which was collected via the technical process, to third parties.
As has already been set out above, the Data Subject may, at any time, prevent our Website from placing any cookies by making a corresponding adjustment to the settings of the internet browser used, and thereby permanently object to the placing of cookies. Such an adjustment to the settings of the internet browser used would also prevent Google from placing a cookie on the IT system of the Data Subject. In addition, a cookie that has already been placed by Google Analytics can be deleted at any time via the internet browser or other software programs.
For more information and the applicable data protection provisions of Google please see https://www.google.de/intl/de/policies/privacy/ and http://www.google.com/analytics/terms/de.html.
AUTO1 Group processes and stores other personal data only for such period of time as is required in order to achieve the purpose of the storage.
Once the purpose of the storage has ceased to exist, the personal data is erased or anonymised as a matter of routine and in accordance with legal provisions. Usage data is generally erased after 30 days.
processing is necessary for the purposes of the legitimate interests pursued by AUTO1 Group or by a third party.
In the event of an objection, AUTO1 Group will no longer process the personal data unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or the aim of the processing is to establish, exercise or defend against legal claims.

References: Art. 6
 Art. 6
 Art. 28
 art. 45
 Art. 6
 Art. 6
 Art. 6