Source: https://www.congree.com/en/legal-notice/privacy-statement
Timestamp: 2019-04-19 02:33:10+00:00

Document:
We place great emphasis on the protection of your personal data that are collected, processed, and used in connection with your visit to our website. This section provides information on which personal data we process, for what purpose, on what basis, and for how long.
Further information on our company is available in the legal notice of our website at https://www.congree.com/en/legal-notice/.
Where we obtain the consent of the data subject for processing personal data, point (a) of Art. 6 (1) of the General Data Protection Regulation (GDPR) serves as the legal basis for processing personal data.
Where personal data need to be processed for the performance of a contract with the data subject, point (b) of Art. 6 (1) GDPR serves as the legal basis. This also applies if the processing is required in order to take steps prior to entering into a contract.
Where personal data need to be processed to comply with a legal obligation to which our company is subject, point (c) of Art. 6 (1) GDPR serves as the legal basis.
Where personal data need to be processed in order to protect the vital interests of the data subject or those of another natural person, point (d) of Art. 6 (1) GDPR serves as the legal basis.
If the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, point (f) of Art. 6 (1) GDPR serves as the legal basis for the processing.
Where we, by way of exception, process personal data on the basis of point (f) of Art. 6 (1) GDPR due to of legitimate interests, you have the right to object to our processing of personal data concerning you at any time for reasons relating to your particular situation. If we cannot demonstrate any compelling legitimate grounds for the further processing that override your interests, rights, and freedoms or if we process the respective data for direct marketing purposes, we will no longer process your data (see Art. 21 GDPR).
We erase or block the personal data as soon as the purpose of the storage no longer applies. Moreover, data may be stored if provided for by the European or national legislator in regulations under Union law, laws, or other provisions that we as the controller are subject to. The data will also be blocked if a storage period specified in the said standards ends, unless the data need to continue to be stored for the conclusion or performance of a contract.
Where we, by way of exception, process the data on the basis of our legitimate interests (point (f) of Art. 6 (1) GDPR) according to the previous balancing of interests, we will store these until the legitimate interest no longer exists, the balancing of interests results in a different conclusion, or you effectively object pursuant to Art. 21 GDPR (see highlighted "Note concerning Special Right to Object").
Where we process the data for the performance of a contract, we will store the data until the contract has been performed and settled and no more claims can be asserted under the contract, i.e. until the end of the limitation period. The general limitation period pursuant to Section 195 of the German Civil Code (BGB) is three (3) years. However, certain claims, such as claims for damages, only expire after 30 years. If there is justified reason to assume that this is relevant in the individual case, we will store the personal data for this period. The said limitation periods begin at the end of the year (i.e. on December 31) in which the claim accrues and the creditor learns of the circumstances establishing the claim and of the person of the debtor or should have learned of these if he had not been guilty of gross negligence.
User data: Data of users of our website are collected and processed by us on a non-personal basis. We cannot map these data to particular persons. The IP address is only processed in anonymized form. If, by way of exception, personal data should be involved, we process these for the purpose of protecting our legitimate interests on the basis of point (f) of Art. 6 (1) GDPR. Our legitimate interests in this meaning are our interest in the security and integrity of our website and of the data on our web server (especially malfunction and error detection as well as tracking of unauthorized access), marketing interests, and interests in statistical surveys (to improve our website, our services, and our offerings). By balancing the various considerations, we have come to the conclusion that the processing of data is necessary to protect the said legitimate interests and are not overridden by your interests or fundamental rights and freedoms, which require the protection of personal data.
Data of potential customers/press representatives: Where we process data of potential customers of our services or press representatives, this is only done where you enter and submit these data to us by way of an input field or by e-mail. You are free to provide this information. We will only process these data for the purpose of handling your inquiry to us. The processing of these data freely submitted to us for the purpose of obtaining information about our services takes place in the form of processing prior to entering into a contract pursuant to point (b) of Art. 6 (1) GDPR as well as on the basis of the consent given by you through the transmission pursuant to point (a) of Art. 6 (1) GDPR.
Customer data: We process our customers' data for contract processing purposes pursuant to point (b) of Art. 6 (1) GDPR and/or on the basis of consent given pursuant to point (a) of Art. 6 (1) GDPR. This also applies if the processing is required in order to take steps prior to entering into a contract (e.g. for the preparation and negotiation of offers).
Data of suppliers/business partners: We process the data of our suppliers and business partners for contract processing purposes pursuant to point (b) of Art. 6 (1) GDPR and/or on the basis of consent given pursuant to point (a) of Art. 6 (1) GDPR. This also applies if the processing is required in order to take steps prior to entering into a contract (e.g. for the preparation and negotiation of offers).
Your personal data will only be forwarded or otherwise transmitted to third parties if this is necessary for the performance of the contract (e.g. to process an order) or for billing purposes (e.g. to handle a payment in connection with the purchase of goods or services) or with your effective prior consent.
The newsletters are delivered via CleverReach , a newsletter delivery service provider of CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede, Germany.
The newsletters contain a so-called "web beacon", i.e. a pixel-size file that is queried by the CleverReach server when the newsletter is opened. Within the scope of this query, technical information such as information about the browser and your system as well as your IP address and the access time, is collected. This information is used for the technical improvement of the services on the basis of the technical data, target groups and their reading behavior, access locations (which can be determined with the help of the IP address), and access times.
Statistical surveys also include the determination whether the newsletters have been opened, when they were opened, and which links are clicked. Though it is technically possible to map this information to the individual newsletter recipients, neither we nor CleverReach intends to monitor individual users. Rather, the analyses enable us to understand our users' reading habits and adapt our content to their needs or to send different content depending on our users' fields of interest.
Purpose of the data processing: The collection and processing of the user's e-mail address serves the delivery of the newsletter. We use the e-mail address for advertising purposes.
Legal basis for processing the data: The legal basis for processing the data following the user's subscription to the newsletter with the user's consent is point (a) of Art. 6 (1) GDPR.
Duration of the storage: The data will be erased as soon as they are no longer needed for the purpose of their collection. Accordingly, the user's e-mail address will be stored for as long as the newsletter subscription remains active.
Objection and removal: The user can cancel the newsletter subscription informally and free of charge whenever he wishes. A link for this purpose is provided in every newsletter.
Purposes of the data processing: The temporary processing of the data by the system is necessary in order to enable delivery of the content of our website to the user's computer. For this, the user's IP address must be stored for the duration of the session.
Legal basis for processing the data: The temporary storage of the data and of the log files takes place on the legal basis of point (f) of Art. 6 (1) GDPR. Our overriding legitimate interest in this data processing lies in the above-mentioned purposes.
Duration of the storage: The data will be erased as soon as they are no longer needed for the purpose of their collection. Where the data are collected to provide the website, this is the case as soon as the respective session ends. Where data are stored in log files, this is the case after no more than seven days. However, the data may continue to be stored. In this case, the IP addresses of the users will be deleted or anonymized so that the requesting client can no longer be mapped.
Objection and removal: The collection of data to provide the website and the storage of data in log files is necessary for the operation of the website. Accordingly, the user cannot object to this.
Our website features contact forms that can be used for electronic contacts. If a user makes use of this option, the data entered in the input screen will be transmitted to us and stored by us.
Purposes of the data processing: The processing of the personal data from the input screen exclusively serves our processing of the contact and your inquiry. In the event of a contact, this also represents the legitimate interest in processing the data.
Legal basis for processing the data: If consent has been given by the user, point (a) of Art. 6 (1) GDPR is the legal basis for processing the data. Otherwise, our legitimate interest in processing the data pursuant to point (f) of Art. 6 (1) GDPR is the legal basis for the processing.
If a contract already exists (e.g. in the event of a support request), we process the data for the performance of the contract pursuant to point (b) of Art. 6 (1) GDPR.
Duration of the storage: The data will be erased as soon as they are no longer needed for the purpose of their collection.
For the personal data from the input screen of the contact form and those transmitted by e-mail, this is the case when the respective conversation with the user is finished. The conversation will be deemed finished as soon as the circumstances imply that the respective matter has been conclusively clarified.
Where data are processed for the performance of a contract, we will erase the data at the latest when the contract is terminated and no more claims can be asserted under the contract.
Objection and removal: The user may withdraw any previously granted consent to the processing of personal data or object to the further data processing due to legitimate interests (see "Note concerning Special Right to Object" above). In such a case, the conversation cannot be continued.
Where the data processing may be (partially) continued on other legal bases (e.g. for the performance of contracts), the data to which this applies will continue to be processed in a permissible way.
When individual pages are accessed, we set so-called "cookies". These are little text files that are stored on the user's device (PC, smartphone, tablet). When a user accesses a website, a cookie may be saved to the user's operating system. This cookie contains a specific character sequence that enables unique identification of the browser when the website is accessed again.
Server user session cookie to map server sessions to the respective visitor in order to enable the processing of scripts (pure session cookie that is deleted after the user's session/concerns all forms on the website, e.g. contact form and newsletter form).
The user data collected by technically necessary cookies are not used for the purpose of creating user profiles.
Legal basis for processing the data: The legal basis for processing personal data using cookies is point (f) of Art. 6 (1) GDPR, i.e. a legitimate interest on our part. Our legitimate interest lies in the purposes specified above.
Where the user has given his consent, the legal basis for processing personal data using cookies for analysis purposes is also point (a) of Art. 6 (1) GDPR.
Duration of the storage, objection and removal: Some of the cookies we use are deleted from your hard disk after the end of the browser session (so-called "session cookies"). Other cookies remain on your device and enable us or our partner companies to recognize your browser the next time you visit the website (persistent cookies).
Purpose of the data processing: The use of the analysis tools and/or of the analysis cookies serves the purpose of improving the quality of our website and its content. In this way, we learn how the website is used and can thus continually optimize our offering. The information about your use of this website, which is generated by the cookie, is usually sent to a Google server in the USA and stored there.
Legal basis for processing the data: The legal basis for processing personal data using cookies is point (f) of Art. 6 (1) GDPR, i.e. an overriding legitimate interest on our part. Our legitimate interest lies in the purposes specified above. As Google Inc. has joined the EU-US Privacy Shield, the transmission of data to the USA is permissible.
Objection and removal: You can prevent the storage of cookies by configuring your browser software accordingly; in this case, however, you might not be able to use all functions of this website. Moreover, you can prevent the collection of data concerning your use of the website (including your IP address), which are generated by the cookie, and the processing of these data by Google by downloading and installing the browser plugin that is available under the following link: http://tools.google.com/dlpage/gaoptout?hl=en.
Purpose of the data processing: Google Maps is used for the purpose of improving the quality of our website and its content and to provide you with a simple, useful, and well-known map service for orientation, for the display of our company facilities, for planning your trip, etc.
Legal basis for processing the data: The legal basis for processing personal data using Google Maps is point (f) of Art. 6 (1) GDPR, i.e. a legitimate interest on our part. Our legitimate interest lies in the purposes specified above. As Google Inc. has joined the EU-US Privacy Shield, the transmission of data to the USA is permissible.
Purpose of the data processing: YouTube videos are embedded for the purpose of presenting multimedia content to the user on the website, thereby upgrading and improving the user experience on the website. As this makes our website more attractive, the use of YouTube also serves our marketing and advertising purposes.
In some cases, this website makes use of SlideShare, a service of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, to show you presentations. This service is integrated by means of a two-click solution. This means that as a matter of principle, no personal data are forwarded when you visit our website. Personal data will be transmitted to SlideShare.com (LinkedIn Ireland Unlimited Company), Google Analytics (Google, Inc.), and ComScore, Inc., a cookie will be set in your browser, and the data will be stored in the USA only if you start the presentation. The collected data and the data processing workflows are beyond our control. Moreover, we do not know the full scope of the data collection, the purposes, and the storage durations.
ComScore stores these data as usage profiles and uses them for the purpose of advertising, market research, and/or needs-oriented design of its web pages. Such an analysis is performed for the purpose of delivering needs-oriented advertising.
Purpose of the data processing: SlideShare is embedded for the purpose of being able to present multimedia content in the form of presentations to the user on the website, thereby upgrading the user experience on the website, and for the purpose of providing the user with information on the subject matter and expertise of our company as well as on topics related to the subject matter of our company. As this makes our website more attractive, the use of SlideShare also serves our marketing and advertising purposes.
Our website also contains so-called "social plugins"—little software programs of the social network Facebook. These are operated exclusively by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). On our website, you can recognize these plugins from the Facebook logo or the word "Like".
Purpose of the data processing: The use of the Facebook plugin takes place for the purpose of enabling direct feedback ("Like") and direct sharing of our submissions and information ("Share") and thus serves our advertising and marketing interests.
Objection and removal: If you do not wish Facebook to be able to map the visit to our website to your Facebook account, please log out from your Facebook user account and block the execution of script contents of Facebook in your browser, e.g. using the script blockers of www.noscript.net or www.ghostery.com .
Purpose of the data processing: The use of the Twitter plugin takes place for the purpose of enabling direct feedback and direct sharing of our submissions and information via Twitter ("Tweet") and thus serves our advertising and marketing interests.
Objection and removal: If you are a member of Twitter and do not want Twitter to collect data about you via our website and link them to your member data that are stored at Twitter, log out from Twitter before visiting our website.
You can also modify your Twitter privacy settings in the account settings at http://twitter.com/account/settings .
Our website uses the "+1" button of the social network Google+, which is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). The button can be recognized from the "+1" symbol on white or color background.
Purpose of the data processing: The use of the Google+ plugin takes place for the purpose of enabling direct feedback and direct sharing of our submissions and information via Google+ and thus serves our advertising and marketing interests.
Objection and removal: If you are a member of Google+ and do not want Google to collect data about you via our website and link them to your member data that are stored at Google, log out from Google+ before visiting our website.
You can access the latest data protection information on the XING "Share" button and other information at https://www.xing.com/app/share?op=data_protection .
Purpose of the data processing: The use of the XING plugin takes place for the purpose of enabling direct feedback and direct sharing of our submissions and information via the XING network and thus serves our advertising and marketing interests.
Objection and removal: If you are a member of XING and do not want XING to collect data about you via our website and link them to your member data that are stored at XING, log out from XING before visiting our website.
Objection and removal: If you are a member of LinkedIn and do not want LinkedIn to collect data about you via our website and link them to your member data that are stored at LinkedIn, log out from LinkedIn before visiting our website.
On our website and especially in the blog, we use the Gravatar service of Automattic, Inc. 132 Hawthorne Street San Francisco, CA 94107, USA.
Purpose of the data processing: We process the e-mail address exclusively for the purpose of facilitating comments and discussions in our blog area and to improve the user experience. Gravatar is a service for which users can register and store profile images and their e-mail addresses. When user leave submissions or comments with the respective e-mail address on other web pages (especially in blogs), their profile images can be displayed next to the submissions or comments. For this, the e-mail address specified by the user will be transmitted to Gravatar in encrypted form for the purpose of checking whether it is associated with a profile. This is the only purpose of the transmission of the e-mail address, and it will not be used for any other purposes, but be erased thereafter.
Legal basis of the data processing: Gravatar is used on the basis of our legitimate interests pursuant to point (f) of Art. 6 (1) GDPR; with the help of Gravatar, we enable the authors of submissions and comments to personalize their submissions with a profile image.
Objection and removal: If you do not wish a user image associated with your e-mail address at Gravatar to appear in the comments, use an e-mail that is not stored at Gravatar for your comments. Moreover, users may use an anonymous e-mail address or none at all if they do not wish their own e-mail address to be sent to Gravatar. Users can prevent the transmission of data entirely by not using our comment system.
Automattic is certified under the Privacy Shield agreement and thus guarantees compliance with European data protection law: https://www.privacyshield.gov/participant?id=a2zt0000000CbqcAAC&status=Active .
Depending on the topic discussed with our employees, you might enter personal data in the chat window. The type of these data depends on the content of your inquiry.
You can voluntarily provide your own data (name, e-mail address) in order to receive a transcript of your chat.
The website and thus the data transmission via the website is encrypted according to the SSL standard (Let's Encrypt Authority X3, encryption type SHA-256 with RSA encryption).
Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"): Provider of the web analysis tools Google Analytics, the map service Google Maps, and the social network Google+.
We attach a lot of importance to data protection. Below, we inform you how we process your data and which rights you have.
Your personal data are processed according to the provisions of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other relevant data protection regulations. The processing and use of the individual data depends on the agreed or requested service. Please refer to our contract documents, forms, declarations of consent, and other information provided to you (e.g. on the website or in the general terms and conditions) for further details and explanations concerning the purposes of the processing.
If you have given us your consent to the processing of personal data, the consent constitutes the legal basis for the respective processing.You can withdraw your consent at any time with effect for the future.
We process your personal data for the performance of our contracts with you, i.e. especially for the performance of software maintenance, software support, and other services associated with our software.Additionally, your personal data are processed for the performance of measures and activities within the scope of pre-contractual relationships.
We process your personal data where this is necessary for the compliance with legal obligations (e.g. commercial/tax laws).In particular, this concerns the archiving of data for data protection and data security purposes and audits conducted by tax authorities and other authorities. Furthermore, it may be necessary to disclose personal data within the scope of official/judicial measures for the purpose of furnishing proof, prosecution, or enforcement of claims under civil law.
Additionally, we process personal data from public sources (e.g. Internet, media, press).
We forward your personal data within our company to the units that need these data for the performance of contractual and statutory obligations and for pursuing our legitimate interests.
No data are processed outside the EU/EEA.
To the extent necessary, we process your personal data for the duration of our business relationship; this also includes the initiation and winding-up of a contract.
Moreover, we are subject to various retention and documentation obligations, e.g. under the German Commercial Code (HGB) and the German Tax Code (AO). The retention and document periods stipulated therein amount to up to 10 years after the end of the business relationship or pre-contractual legal relationship.
Finally, the storage period is also determined by the statute of limitations, which e.g. pursuant to Sections 195 ff of the German Civil Code (BGB), usually amount to three years but may amount to up to 30 years in certain cases.
8. Does Automated Individual Decision-Making (Including Profiling) Take Place?
We do not use any fully automated individual decision-making procedures pursuant to Art. 22 GDPR. Should we use these procedures in individual cases, we will inform you of this separately insofar as this is required by law.
You have the right of access pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR, and the right to data portability pursuant to Art. 20 GDPR. Furthermore, you have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR. As a matter of principle, you have the right to object to our processing of personal data pursuant to Art. 21 GDPR. However, this right to object only applies if particular circumstances of your personal situation are on hand; rights of our company may override your right to object. To exercise one of these rights, please contact our data protection officer (geiger@mage-solutions.de).
You merely need to provide the data that are required for initiating and performing a business relationship or a pre-contractual relationship with us or that we are required to collect by virtue of law. Without these data, we are usually unable to conclude or perform a contract. This may also pertain to data required later on within the scope of the business relationship. Where we request data from you beyond this scope, you are expressly informed that this is voluntary.
You may at any time object to the processing of your data on the basis of point (f) of Art. 6 (1) GDPR (processing of data on the basis of balancing of interests) or point (e) of Art. 6 (1) GDPR (data processing in the public interest), especially if there are grounds relating to your particular situation. This also applies to any profiling on the basis of this provision in the meaning of Art. 4 no. 4 GDPR.
If you object, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims.
We may also process your personal data for direct advertising purposes. If you do not want to receive any advertising, you can object to this at any time. This also applies to profiling insofar as it is associated with such direct advertising. We will observe this objection for the future.
We will no longer process your data for direct advertising purposes if you object to the processing for these purposes.
The objection can be sent to the address specified in section 1 without complying with any formal requirements.
If you have given us your consent to the processing of personal data, the consent constitutes the legal basis for the respective processing. You can withdraw your consent at any time with effect for the future.
We process your personal data for the performance of our contracts with you, specially when processing orders and utilizing your services. Additionally, your personal data are processed for the performance of measures and activities within the scope of pre-contractual relationships.
We process your personal data where this is necessary for the compliance with legal obligations (e.g. commercial/tax laws). In particular, this concerns the archiving of data for data protection and data security purposes and audits conducted by tax authorities and other authorities. Furthermore, it may be necessary to disclose personal data within the scope of official/judicial measures for the purpose of furnishing proof, prosecution, or enforcement of claims under civil law.
Your personal data are processed according to the provisions of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other relevant data protection regulations. Please refer to our contract documents, forms, declarations of consent, and other information provided to you (e.g. on the website or in the general terms and conditions) for further details and explanations concerning the purposes of the processing.
We process your personal data for the purpose of processing the application procedure. The processing may also take place electronically. This is the case especially where you send us your application documents electronically, e.g. by e-mail or via a web form on the website.
We process your personal data where this is necessary for the compliance with legal obligations.
Moreover, processors engaged by us (Art. 28 GDPR) may receive your data especially in the field of support/maintenance of IT applications.
If the data controller concludes an employment contract with an applicant, the submitted data will be stored for the purpose of handling the employment relationship under consideration of the statutory regulations. If the data controller does not conclude any employment contract with an applicant, the application documents will be erased automatically three months after the notice of refusal, unless the erasure would conflict with other legitimate interests of the data controller. "Other legitimate interests" in this meaning include, but are not limited to, an obligation to furnish proof in proceedings under the German General Treatment Act (AGG).
7. Does Automated Individual Decision-Making (Including Profiling) Take Place?
You have the right of access pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR, and the right to data portability pursuant to Art. 20 GDPR.
Furthermore, you have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR. As a matter of principle, you have the right to object to our processing of personal data pursuant to Art. 21 GDPR. However, this right to object only applies if particular circumstances of your personal situation are on hand; rights of our company may override your right to object. To exercise one of these rights, please contact our data protection officer (geiger@mage-solutions.de).
You merely need to provide us with the data required for the application process. Without these data, we are usually unable to conclude an employment contract with you. Where we request data from you beyond this scope, you are expressly informed that this is voluntary.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 21
 Art. 6
 Art. 21
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 22
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 20
 Art. 77
 Art. 21
 Art. 6
 Art. 6
 Art. 4
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 20
 Art. 77
 Art. 21