Source: http://www.wink.de/dk/data-protection/
Timestamp: 2019-04-20 05:07:19+00:00

Document:
“Personal Data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (such as a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is wide-ranging and means practically any handling of data.
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of personal data processing.
If, during our processing, we disclose data to other persons and companies (order processors or third parties), transmit such data to them or otherwise grant them access to the data, this will only take place on the basis of a legal authorisation (e.g. where transmission of the data to third parties such as payment service providers is necessary for the performance of a contract, as laid down in Art. 6(1)(b) GDPR), or if you have given your consent, or for compliance with a legal obligation or on the basis of our legitimate interests (e.g. when we use representatives, web hosters, etc.).
Where we commission third parties with the processing of data on the basis of a "processing contract", this is carried out on the basis of Art. 28 GDPR.
Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or do so in connection with the use of services from third parties or the disclosure or transfer of data to third parties, then this only takes place if it is necessary to comply with our (pre)contractual obligations, on the basis of your consent or a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual authorisation, we will only process or have the data processed in a third country if the special requirements of Art. 44 ff. GDPR are fulfilled. This means, for example, that processing is carried out on the basis of special guarantees such as the officially recognised setting of a data protection level which matches that of the EU (e.g. " Privacy Shield " for the USA) or based on compliance with officially recognised special contractual obligations ("standard contractual clauses").
You have the right to obtain confirmation as to whether the personal data is being processed and to request information about this data as well as further information and a copy of the data in accordance with Art. 15 GDPR.
Pursuant to Art. 16 GDPR, you have the right to request completion of data concerning you or rectification of inaccurate data concerning you.
You have the right to demand that relevant data be erased immediately in accordance with Art. 17 GDPR or, alternatively, to demand a restriction of the processing of the data in accordance with Art. 18 GDPR.
In accordance with Art. 20 GDPR, you have the right to receive the data concerning you which you provided to us and to demand its transmission to other controllers.
Furthermore, pursuant to Art. 77 GDPR, you have the right to lodge a complaint with the competent supervisory authority.
You have the right, pursuant to Art. 7(3) GDPR, to withdraw any consent you have given, with effect for the future.
Pursuant to Art. 21 GDPR, you have the right to object at any time to the processing of personal data concerning you. Objection may be raised in particular against data being processed for direct marketing purposes.
If users do not want cookies to be stored on their computer, they are asked to deactivate the relevant option in their browser’s system settings. Stored cookies can be deleted in the browser’s system settings. Non-acceptance of cookies may lead to restrictions in the functions of this online offer.
Under German law, data is stored for 10 years in accordance with Articles 147 para. 1 of the German tax code, the AO, 257 (1) nos. 1 and 4, para. 4 of the German commercial code, the HGB (books, records, management reports, accounting documents, trading books, documents relevant for taxation, etc.) and 6 years in accordance with Art. 257 (1) no. 2 and 3, para. 4 HGB (commercial papers).
The hosting services we employ provide the following: infrastructure and platform services, computing capacity, memory and database services, security services and technical maintenance services, which we employ for the purpose of operating this online offer.
In so doing, we or our hosting provider process customer data, contact data, content data, contract data, usage data, metadata and communication data of customers, interested parties and visitors to this online offer on the basis of our legitimate interests in the efficient and secure provision of this online offer pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR (conclusion of processing contract).
We, or our hosting provider, collect the following data on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR regarding each access to the server on which this service is located (server log files). The name of the accessed website, the file, the date and time of access, transferred data volume, notification of successful access, browser type and version, the user's operating system, the referrer URL (previously visited page), the IP address and the requesting provider are all examples of access data.
Log file information is stored for up to 7 days for security reasons (e.g. to investigate misuse or fraud) and then deleted. Data which must be kept longer for evidentiary purposes is excluded from deletion until the respective incident has been definitively clarified.
We process data in connection with administrative tasks and the organisation of our company, financial accounting and compliance with legal obligations, such as archiving. In so doing, we process the same data that we process while performing our contractual services. The processing is based on Art. 6(1)(c) GDPR, Art. 6(1)(f) GDPR. Data subjects of the processing are customers, prospective customers, business partners and website visitors. The purpose of and our interest in the processing lies in administration, financial accounting, office organisation, archiving of data, i.e. tasks that serve the upkeep of our business activities, the fulfilment of our tasks and the provision of our services. The deletion of the data in terms of contractual services and contractual communication is in accordance with the information provided for these processing activities.
We disclose or transmit data to tax authorities, consultants such as tax consultants or auditors, and other fee collectors and payment service providers.
Furthermore, we store data concerning suppliers, organisers and other business partners on the basis of our business interests, e.g. for the purpose of entering into contact at a later date. We store this data, most of which is company-related, long-term.
We process the data of applicants only for the purpose and in the context of the application process in accordance with the legal requirements. The applicant’s data is processed to fulfil our (pre)contractual obligations during the application procedure pursuant to Art. 6(1)(b) GDPR Art. 6(1)(f) GDPR, where data processing is necessary for us, e.g. during legal proceedings (in Germany, Art. 26 of the data protection act BDSG applies in addition).
A prerequisite of the application procedure is that applicants provide us with their data. The required applicants’ data is marked as such if we offer an online form. Otherwise it can be derived from the job descriptions, and in principle it includes personal data, postal and contact addresses and the documents accompanying the application, such as cover letter, curriculum vitae and certificates. Moreover, applicants may voluntarily provide us with additional information.
Insofar as special categories of personal data as defined in Art. 9(1) GDPR are voluntarily communicated during the application procedure, they are also processed in accordance with Art. 9(2)(b) GDPR (e.g. health data, such as degree of disability or ethnic origin). Insofar as special categories of personal data as defined in Art. 9(1) GDPR are voluntarily communicated during the application procedure, they are also processed in accordance with Art. 9(2)(b) GDPR (e.g. health data, such as degree of disability or ethnic origin).
If provided by us, applicants can send us their applications via an online form on our website. The data will be encrypted and transmitted to us in accordance with state-of-the art technology.
Applicants may also send us their applications by e-mail. Please note, however, that e-mails are not generally sent in an encrypted form and that the applicants themselves must ensure that they are encrypted. We cannot therefore accept any responsibility for the transfer of the application from sender to our server and would recommend that you use an online form or send the application by post, because applicants can still send us their application by post instead of using the online application form or e-mail.
If the application is successful, the data provided by the applicant can be further processed by us for the purpose of employment. Otherwise, if an application for a job offer is not successful, the applicant's data will be deleted. The data of an applicant will also be deleted if the application is withdrawn, which the applicant is entitled to do at any time.
The deletion will take place, if the applicant has a justified right of withdrawal, after a period of six months, so that we can answer any follow-up questions to the application and meet our obligations to provide supporting evidence under the Equal Treatment Act. Bills for the reimbursement of any travel expenses will be archived in accordance with the tax regulations.
When contacting us (e.g. by contact form, e-mail, telephone or through social media), the user's data is processed pursuant to Art. 6(1)(b) GDPR in order for us to handle the contact enquiry and its execution. The user's data may be stored in a customer relationship management system ("CRM system") or comparable enquiry system.
We delete the enquiries if they are no longer needed. We review the necessity every two years; the statutory archiving obligations also apply.
Google is certified under the Privacy Shield Agreement, which provides a guarantee to comply with European privacy legislation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active ).
Google will use this information on our behalf to evaluate the use of our online services by users, to compile reports on the activities within this online service and to provide us with other services associated with the use of this online service and the Internet. In this case, pseudonymous usage profiles of the users can be created from the processed data.
The IP address submitted by the user's browser will not be merged with other data provided by Google. Users can prevent the storage of cookies by setting their browser software accordingly; Users may also prevent the collection by Google of the data generated by the cookie and related to their use of the online offer and the processing of such data by Google by downloading and installing the browser plug-in available at the following link: tools.google.com/dlpage/gaoptout.
We maintain online sites on social networks and platforms in order to communicate with customers, interested parties and users who are active there and to inform them about our services. When the relevant networks and platforms are accessed, the terms and conditions and data processing guidelines of the corresponding operators apply.
Within our online offer, we use content or service offers of third-party providers on the basis of our legitimate interests, i.e. interest in the analysis, optimisation and economic operation of our online offer pursuant to Art. 6(1)(f) GDPR to integrate their content and services such as e.g. videos or fonts (referred to collectively hereinafter as “Content").
This always presupposes that the third-party providers of this content are aware of the IP address of the users, as they would not be able to send the content to their browsers without the IP address. The IP address is hence required for this content to be displayed. We endeavour to use only such content whose respective providers use the IP address for the delivery of the content only. Third-party providers may also use pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. By means of the "pixel tags" information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information may also be stored in cookies on the user's device and include technical information about the browser and operating system, linked websites, visit time and other information about the use of our online offer, and may also be linked to such information from other sources.

References: Art. 6
 Art. 28
 Art. 44
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 20
 Art. 77
 Art. 7
 Art. 21
 Art. 257
 Art. 6
 Art. 28
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 26
 Art. 9
 Art. 9
 Art. 9
 Art. 9
 Art. 6
 Art. 6