Source: https://giantswarm.io/privacypolicy/
Timestamp: 2019-04-24 05:48:15+00:00

Document:
At Giant Swarm, we take our data protection and information security responsibilities very seriously. The effective management of all personal data, including its security and confidentiality, lies at the very heart of our business. This is not only conditioned by our legal and regulatory responsibilities, but also fundamentally driven by our commitment to our clients and to meet their expectations of us having in place robust compliance and risk management practices and protocols. In the following, we would like to inform you about the processing of personal data by us in the context of our website and in the course of our business.
In the following section 2, we inform you about the processing of personal data in the context of your visit to our website. Data controller for all processing activities in this context is Giant Swarm, unless stated otherwise.
When visiting our website, your browser will contact our webserver to retrieve the sites you wish to visit. In this context, personal data such as your IP address is transferred by your browser (i.e. by HTTPS requests) to us. This connection data is processed by our webserver to enable access to and the display of our website.
Our webserver automatically saves a record of the pages you visited (so-called logfiles / record of session). We use these logfiles to ensure the security of our website, in particular to prevent unauthorized interference with it, and to enable to exercise our legal rights and obligations in regard to such unauthorized interference.
Furthermore, we analyze session records to optimize our website. However, this analysis takes place in an anonymized way. The results cannot be linked to your person.
Generally the processing activities data in the context of your visit to our website are based on our legitimate interests according to Art. 6 (1) f GDPR to operate an internet website for general information and communication purposes and to optimize our website and to protect it from attacks. If you are visiting our website in order to initiate a business relationship with us, the processing is based on Art. 6 (1) b GDPR.
Exceptionally, we may process personal data in accordance with Art. 6 (1) (c) GDPR to fulfil our legal obligations, in particular vis-à-vis relevant authorities in cases of unauthorised interference.
Our IT team members have access to logfiles and will pass them on to other internal or external recipients including the relevant authorities if necessary to exercise our legal rights in regard to unauthorized interference.
The log data is stored as long as the web servers serving the site are up. Once they are restarted, the log data is erased. This often happens weekly.
All other data is erased immediately after processing the HTTPS request.
We like to keep our audience up-to-date on the latest findings using Kubernetes. The Blog subdomain on giantswarm.io, blog.giantswarm.io is updated monthly to inform our users of Kubernetes technology conclusions.
Documentation posted on the subdomain on giantswarm.io, docs.giantswarm.io is designed to help the user navigate through Kubernetes architecture using our best practices. The docs are updated as new content is written.
Guides and eBooks are an important part of our website, giantswarm.io to inform our users of extensive research and conclusions using the Kubernetes platform. The guides on the subdomain info.giantswarm.io are updated quarterly.
Legal basis for the processing and legitimate interests for the processing The processing is based on Art. 6 (1) (f) GDPR. It serves the legitimate interests of the users to access knowledge on Kubernetes best practices. It also serves our legitimate interests to develop our business and promote client relationships.
We retain personal data only for as long as there is a legitimate reason or other legal ground to do so, and will keep these legal bases under review.
We take the position that we do not control the processing of personal data in the context of social media plug-ins. We do not have any access to the data collected and transferred by the social media plug-in to the social network provider. Any data processing is determined solely by the network service provider.
In the interest of transparency, we would regardless like to inform you about the processing of your personal data in this context.
To improve your user experience, our website includes social media plug-ins of the large social media networks Facebook, Twitter, YouTube. These plug-ins allow you to directly post links to and other content from our websites on the relevant network.
The processing of personal data in this context by us, if any, is based on Art. 6 (1) f GDPR. It serves our legitimate interest of (i) improving our website’s user experience thereby making it more attractive and thus increasing user traffic and (ii) make our content more visible and thereby promote our business.
We do not have access to or not share any personal data in this context.
Cookies allow the website to distinguish you from other users of the site. This helps the originators to optimize websites and also allows certain parts of websites to function correctly. Find out more about cookies and the data processing in this context on www.allaboutcookies.org.
We collect strictly necessary cookie data, such as your unique session ID and the time of your login (time stamp). This data allows us to relate the visitor's unique session to server side data. The cookies act as a reference to the session created. Whenever an activity is performed on our website, our server recognizes your session ID and validates that activity.
Processing of strictly necessary cookies data is based on Art. 6 (1) of GDPR. It serves our legitimate business interests to enable users to visit our web presence and thereby ultimately promote our business.
Strictly necessary cookie data is processed by Giant Swarm. Transfer of personal data to third countries or international organizations Strictly necessary cookie data will not be processed to third countries or international organizations.
Disabling these cookies will encumber the Sites' performance, and may make services and features unavailable.
GiantSwarmPrivacy: Type: Permanent, Expiry after: 30 days; Purpose: Stores the visitor‘s accept/decline decision expressed in the context of the third party cookie/plugin consent banner mentioned earlier.
GiantSwarmSession: Type: Permanent, Expiry after: 30 days; Purpose: Recognize the user and re-use session-based data, such as the email address entered into a form.
Legitimate goal to provide a functional website.
for purposes of statistical analysis and optimization of our website. This helps us tailor our website to our users’ needs by, for example, placing the most sought after pages where they are most easily found. It also allows us to gauge how attractive our website is, how many of our users are regulars and how we can improve the reach of our website, e.g. by optimizing search engine ranking.
(together referred to as cookie supplier) collect and store on our behalf certain usage data (e.g. which sites you navigate to, how long you spend on these sites, how often you return to our website) attributed to an anonymous identifier. This usage data is then used to generate non-personalized analyses of website usage for us.
Show Details: When you visit a page on our website that uses Google Analytics or HubSpot, some information on this “pageview hit” (incl. the URL of the site visited by you as well as your IP address, information on the operating system, browser and language setting used by you and potentially some information stored in the cookies described below) will be transmitted to our cookie suppliers server by code embedded in the respective site. The IP address is only used for technical purposes of transmission and anonymized by deleting the last digits immediately after reception. The other usage data will be attributed to an anonymous / pseudonymous identifier that is automatically generated and stored in a cookie on your device (cf. below). This identifier cannot and will not be traced back to you. Its sole purpose is to allow us to analyze typical website usage by obtaining information on relevant usage cycles.
Processing of usage data is based on Art. 6 (1) f GDPR. It serves our legitimate business interests to optimize our web presence and improve its reach, usability and content and thereby ultimately promote our business.
Usage data is processed by our cookie supplier as a data processor on our behalf on the basis of a data processing agreement between the cookie supplier and us. Analyses of website traffic provided by our cookie suppliers are used by our internal departments, in particular the IT and business development departments, for the abovementioned purposes.
Usage data may be processed by our cookie suppliers on servers in the United States of America. An adequate level of data protection is ensured, as Google LLC HubSpot are certified under the so-called EU-US Privacy Shield.
You may prevent processing of personal data by activating the “do-not-track”-option of your browser.
To prevent processing by Google Analytics, you can install the Google Analytics opt-out browser add-on. This add-on is compatible with all major browsers and can be downloaded and installed via the Google Analytics opt-out page.
Cookie Name: _utmb _utmc. Type: Permanent. Expiry after: 30 minutes. Purpose: These cookies work together to calculate how long a visit takes._utmb takes a timestamp of the exact moment when a visitor enters a site, while_utmc takes a timestamp of the exact moment when a visitor leaves a site. _utmb expires at the end of the session. _utmc waits 30 minutes, and then expires. _utmc waits 30 minutes for another page view to happen, and if it doesn't, it expires.
Cookie Name: _utmz. Type: Permanent. Expiry after: 6 months. Purpose: This tracks where visitors came from. What search engine was used. What links were clicked on. What keywords were used. Where they were in the world when they accessed the website.
Cookie Name: _utmv. Type: Permanent. Expiry after: 2 years after last visit. Purpose: This cookie stores custom variables for each visitor and allows us to use segmentation to better understand our visitors.
Cookie Name: _ga. Type: Permanent. Expiry after: 2 years after last visit. Purpose: This cookie is used to distinguish between site visitors.
Cookie Name: __hs_do_not_track. Type: Permanent. Expiry after: 2 years after last visit. Purpose: This cookie can be set to prevent the tracking code from sending any information to HubSpot.
Cookie Name: __hs_testcookie. Type: Permanent. Expiry after: Session. Purpose: This cookie is used to test whether the visitor has support for cookies enabled.
Cookie Name: hs_lang_switcher_choice. Type: Permanent. Expiry after: Session. Purpose: This cookie is used to consistently redirect visitors to the language version of a page in the language they’ve selected on this top-level private domain in the past.
Cookie Name: <id>_key. Type: Permanent. Expiry after: 30 minutes. Purpose: When visiting a password-protected page, this cookie is set so future visits to the page from the same browser do not require login. The cookie name is unique for each password-protected page.
Cookie Name: __hstc. Type: Permanent. Expiry after: 2 years after last visit. Purpose: The main cookie for tracking visitors. It contains the domain, utk (see below), initial timestamp (first visit), last timestamp (last visit), current timestamp (this visit), and session number (increments for each subsequent session).
Cookie Name: hubspotutk. Type: Permanent. Expiry after: 10 years after last visit. Purpose: This cookie is used for to keep track of a visitor's identity. This cookie is passed to HubSpot on form submission and used when de-duplicating contacts.
Cookie Name: hssc. Type: Permanent. Expiry after: 30 minutes. Purpose: This cookie keeps track of sessions. This is used to determine if we should increment the session number and timestamps in the hstc cookie. It contains the domain, viewCount (increments each pageView in a session), and session start timestamp.
Cookie Name: __hssrc. Type: Permanent. Expiry after: Session. Purpose: Whenever HubSpot changes the session cookie, this cookie is also set. We set it to 1 and use it to determine if the visitor has restarted their browser. If this cookie does not exist when we manage cookies, we assume it is a new session.
You have the right to withdraw your consent to us storing these cookies on your device and accessing them from time to time by activating the “do-not-track”-option of your browser.
Data processing activities in the context of global business development initiatives are generally controlled by Giant Swarm.
Data processing activities in the context of local business development initiatives are ordinarily controlled by the respective Giant Swarm entity.
If different Giant Swarm entities exceptionally act as joint controllers, Giant Swarm is designated as a single point of contact for data subjects under the GDPR.
This data is either provided directly by the relevant data subject or by other business contacts and sources (e.g., public directories or public registers).
The processing is based on our legitimate interest according to Art. 6 (1) f GDPR to pursue our business interests of marketing and business development, or, as the case may be, in order to take steps at the request of the data subject prior to entering into a contract according to Art. 6 (1) b GDPR.
In the conduct of our business, we share certain business development data within Giant Swarm.
On a case-by-case basis, in accordance with accepted market practice, we may also share certain business development data with our business partners (e.g. Amazon Web Services or Microsoft Partner Network) and certain other parties that assist us with our business development activities in the ordinary course of our business (e.g. marketing services providers).
As a global Enterprise Computing Service, we also share business development data within Giant Swarm. We do not transfer personal data to third countries or international organizations.
We retain personal data only for as long as there is a legitimate reason or other legal ground to do so, and will keep these legal bases under review. If there is no longer a legal ground for the data to be retained, we will erase personal data securely, or in some cases anonymize it.
Where we collect business development data directly from you, you continue to retain full discretion if, how, and what you disclose to us. There are no negative consequences if you do not provide us business development data.
Generally, data processing activities in the context of newsletters and update services (e.g., RSS newsfeed, social media news feeds) are controlled by Giant Swarm.
Data processing in the context of newsletters or other update services is ordinarily controlled by the respective Giant Swarm entity. If different Giant Swarm entities exceptionally act as joint controllers, Giant Swarm is designated as a single point of contact for data subjects under the GDPR.
If you have signed up or otherwise agreed to receive newsletters or other update services, we will process your contact data (e.g. name, e-mail) to render those services.
In order to further optimize the user experience and in particular tailor the information provided to you, we process information on your specified preferences, if any, and in some instances, follow your consumption of material (user statistics). All newsletter activities and other update services serve marketing purposes and business development.
The processing is based on our legitimate interests according to Art. 6 (1) f GDPR to pursue our business interests of marketing and business development, or, as the case may be, for the performance of a contract according to Art. 6 (1) b GDPR. If there is no legitimate interest or contractual necessity to process your personal data, we will ask you for your explicit consent under Art. 6 (1) a GDPR.
In the conduct of our business, we share certain business development data within Giant Swarm. We also share certain business development data with our business partners (e.g., Amazon Web Services and the Microsoft Partner Network) in accordance with accepted market practice.
Generally, data processing activities in the context of our career portal are controlled by Giant Swarm. Further processing activities regarding the assessment of your application are controlled by the relevant Giant Swarm entity the application is aimed at. If different Giant Swarm entities exceptionally act as joint controllers, Giant Swarm is designated as a single point of contact for data subjects under the GDPR.
We keep our Breezy HR portal up to date with the newest positions available at Giant Swarm. As soon as we are advertising a position, you will find our current job opportunities on this page. You can browse through them without registration. Our general privacy notice for the use of our website applies (cf. 2.1.).
The first step to hand in an online application is to choose either to login through LinkedIn or fill out the information on the https://giantswarm.breezy.hr/ page. At this point we only ask you for your basic contact data, e.g. name and e-mail address.
To complete and hand in an application, we ask you to provide us with various “applicant data”, e.g.
Generally, all applicant data is directly obtained from you.
The processing is generally based on Art. 6 (1) b GDPR in order to take steps at the request of you as the data subject prior to entering into a contract.
Internally, your personal data will only be processed by the Giant Swarm entity or office which posted the job offer and by the relevant personnel department.
Your application and any other information that you provide to us will be held on systems operated on our behalf by Breezy HR, inc. (40 24th St.2nd Floor Pittsburgh, PA 15222), and will be stored in the United States of America and Germany.
Breezy HR, inc. is under contract with Giant Swarm to ensure that your information is protected to standards required by us in accordance with applicable Data Protection Legislation and is only processed in accordance with our instructions.
When you apply to a position for one of the Giant Swarm entities, your application will be forwarded accordingly. We have in place standard contractual clauses according to Art. 46 (1) lit. c GDPR that cover all transfers within Giant Swarm.
We retain personal data only for as long as there is a genuine business reason or other legal ground to do so.
Your basic contact data will be erased if you contact Giant Swarm and ask for your data to be deleted. If you wish to delete or correct your information from Breezy HR, inc., please visit the Account screen. If you do not have an account, please contact privacy@breezyhr.com.
Your applicant data will be stored for a period of time sufficient to enable us to review your application, and as long as necessary for general human resource management purposes.
If your application is not successful or if you withdraw your application, your application data will be erased after twelve months.
If you give us your specific consent, we store your application information in our recruitment system for a period of 24 months counting from your last visit.
If your application is successful, any data provided through this recruitment system may be further processed for performance of your employment contract, esp. for keeping your personnel files.
Applicants should note that they have the right to access, modify or erase any information concerning their personal profile in compliance with applicable Data Protection Legislation (cf. 6.).
There are no negative consequences if you do not provide us the above mentioned personal data. However, only if all necessary blanks of the application form in our career portal are filled out completely, the application can be handed in. Without providing your personal data it will not be possible to progress the application and the application will be cancelled.
If you use the contact options on our website, the respective data processing is controlled by Giant Swarm (cf. 2.1). Single Giant Swarm entities may be controller if you contact them directly.
We offer you the possibility to contact us via e-mail our contact form or the outreach form on the website. We will process your personal data (such as your name, address, telephone number) to respond to you request and save them for potential further inquiries. Also the content of the communication will be processed by us for the purpose of responding to your request.
The processing of your data in the context of communication, e.g. via the contact form or by e-mail, is based on Art. 6 (1) b GDPR in case you are contacting us in order to initiate or perform a business relationship with us.
If the communication is not linked to an existing or initiated contractual relationship, the processing is based on legitimate interests according to Art. 6 (1) f GDPR. Our legitimate interest is to conduct business correspondence or, for example, to respond to data protection requests.
We share the above-mentioned personal data, in particular contact data, within those Giant Swarm entities your request is aimed at.
We share the above-mentioned personal data, in particular contact data, with those Giant Swarm entities in third countries your request is aimed at. We have in place standard contractual clauses according to Art. 46 (1) lit. c GDPR that cover all transfers within Giant Swarm.
You are not obliged to provide us with your personal data. However, we need the relevant data to contact you and respond to your request or communication.
We have a legal obligation to ensure that your information is kept accurate and up to date. Please assist us to comply with this obligation by ensuring that you inform us of any changes to your information. Your personal data is collected and processed for specified, explicit and legitimate purposes. The processing of the data will not take place in a manner incompatible with these purposes.
As a data subject you have several rights, as defined within the GDPR. These are listed below together with a brief, non-exhaustive explanation.
You have the right to obtain a confirmation as to whether or not we process your personal data, and if we do, request access to your data.
If you consider that we should stop processing some or all of your personal data, you have the right to request its deletion. However, there may well be reasons why an immediate deletion may not be possible (for example where retention is required to meet legal or regulatory obligations).
If we no longer need the data for the purposes of its processing, but you need it for the establishment, exercise or defense of legal claims.
If you object to our processing of your data based on our legitimate interests under Art. 6(1) (f) GDPR, or where the processing is based on Art. 6(1) (e) GDPR.
If your personal data is processed on the basis of your consent (Art. 6 (1) (a) or Art. 9 (2) (a) GDPR), you have the right to withdraw your consent at any time. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 46
 Art. 6
 Art. 6
 Art. 46
 Art. 6
 Art. 6
 Art. 9