Source: https://arcoro.de/en/data-protection/
Timestamp: 2019-04-22 16:02:14+00:00

Document:
We have taken it upon ourselves to support your personal career development with technical and management personnel, to be available to you as a long-term partner throughout the stages of your career.
At the centre of this responsibility is the duty to be forthright with you regarding your personal data that we record, how we use those data, and with whom we share them.
If you use our services, this duty will be based on the following data privacy statement.
We collect and use personal data from our users only if this is needed for our content and services and to provide a functional website. We periodically collect and use our users’ personal data only with their consent. This does not apply if practical circumstances prevent us from obtaining prior consent or we may process the data under statutory provisions.
If the data subject permits us to process personal data, Art. 6 (1) a GDPR serves as the legal basis.
If personal data must be processed to fulfil a contract whose contracting party is the data subject, the legal basis is Art. 6 (1) b GDPR. This also applies to processing operations that are necessary to implement pre-contractual measures.
If personal data must be processed to fulfil a legal obligation to which our company is subject, the legal basis is Art. 6 (1) c GDPR. If vital interests of the data subject or another natural person necessitate the processing of personal data, the legal basis is Art. 6 (1) d GDPR.
If the processing is necessary to safeguard a legitimate interest of our company or a third party, and that legitimate interest is not outweighed by the interests, basic rights and freedoms of the data subject, the legal basis will be Art. 6 (1) f GDPR.
The data subject’s personal data will be deleted or blocked as soon as the purpose of storage no longer applies. We may also store that data if such storage is provided for through the European or national legislature, in the form of directives under European Union law, statutes or other provisions to which the controller is subject. The data will also be deleted or blocked if a storage period prescribed by the standards mentioned expires, unless the data must be stored for longer to conclude or fulfil a contract.
This website uses Google Analytics, a web analysis service of Google Inc., (1600 Amphitheatre Parkway Mountain View, CA 94043, USA; “Google”). This use entails the mode of operation “Universal Analytics”. Data, sessions and interactions across multiple devices can be allocated to a pseudonymous user ID to analyse a particular user’s cross-device activities.
Whenever our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The log files contain IP addresses that allow allocation to a specific user. This can be the case, for example, if the link to the website from which the user arrives at the internet site, or the link to the website to which the user navigates, contains personal data. The data will also be stored in our system’s log files. This data will not be stored together with other personal data of the user.
The legal basis for storing the data and the log files temporarily is Art. 6 (1) f GDPR.
The IP address must be temporarily stored by the system so the webpage can be delivered to the user’s computer. To do so, the user’s IP address must remain stored during the entire session.
It is stored in log files to ensure the webpage’s functionality. The data also help us optimise the webpage and ensure the security of our IT systems. In this context, the data will not be evaluated for marketing purposes.
These purposes also include our legitimate interest in data processing under Art. 6 (1) f GDPR.
The data will be deleted when it is no longer needed to meet the goal for which it was collected. If the data was collected to provide the webpage, the data will be deleted when the session in question is over.
During the registration process, the user’s consent to have their data processed will be obtained using a tick box.
If the user’s consent has been obtained, the legal grounds for processing the data is Art. 6 (1) a GDPR.
The user must register for certain content and services to be kept ready on our webpage.
The identification of and information revealed by the contents serve future consultation based on the services arcoro GmbH offers in the environment of human resources consulting and coaching.
The data will be deleted when it is no longer needed to meet the goal for which it was collected. Personal data from the input mask of the contact form and that which was sent via email will be deleted when the respective conversation with the user has ended. The conversation will end when circumstances reveal that the situation concerned has been finally cleared up.
The additional personal data collected during the sending procedure will be deleted after a time limit of 30 days at the latest, provided you have fulfilled the processing purpose and contact has been established. If the data are still needed for human resources consulting, the data subjects will be informed of this during communication with company employees. Consent to the further processing is obtained separately. If no contact is established, the personal data will be deleted automatically after seven days.
As a user, you have the option of cancelling your registration at any time. You can have the data stored about you altered at any time. To delete or change the data, please email us at info@arcoro.de, or send a letter to the address (arcoro GmbH, Ziegelhäuser Landstr. 39, 69120 Heidelberg, Germany).
To process the data, your consent will be obtained during the sending procedure and this data privacy statement will be referred to.
In the alternative, contact can be made via the email address provided. In this case, the user’s personal data transmitted along with the email will be stored.
In this context, the data will not be forwarded to third parties. The data will be used exclusively to process the conversation.
The legal grounds for processing data transmitted when an email is sent is Art. 6 (1) f GDPR. If the email contact aims to conclude a contract, an additional legal foundation for the processing is Art. 6 (1) b GDPR.
Processing the personal data from the input mask serves the exclusive purpose of helping us process the contact that is made. Making contact through email also constitutes the required legitimate interest in processing that data.
The other personal data processed during the sending procedure serve to prevent misuse of the contact form and ensure the security of our IT systems.
The user may at any time revoke their consent to have their personal data processed. If the user contacts us through email, they can object at any time to having their personal data stored. In such a case, the conversation cannot be continued.
If they do object, all personal data that was stored when contact was established will be deleted.
You can demand that the controller confirm whether we are processing personal data concerning you.
(8) the existence of automated decision-making, including profiling under Art. 22 (1) and 4 GDPR and—at least in these cases—meaningful information about the logic involved, as well as the implications and sought-after effects such processing would have for the data subject.
You have the right to demand whether the personal data concerning you are transmitted to a third country or international organisation. In this context, you may demand to be informed about the appropriate guarantees under Art. 46 GDPR in connection with such transmission.
If the processed personal data that concerns you is incorrect or incomplete, you have the right against the controller to have it corrected, deleted, or both. The controller must undertake such correction without undue delay.
(4) If you have filed an objection against the processing under Art. 21 (1) GDPR and it has not yet been established whether the legitimate reasons of the controller outweigh your reasons.
If the processing of the personal data concerning you has been restricted, those data—regardless of their storage—may be processed only (1) with your consent, (2) to assert, exercise or defend against legal claims, (3) to protect the rights of another natural person or legal entity, or (4) for reasons of an important public interest of the EU or a member state.
If the processing has been restricted according to the aforementioned conditions, the controller will inform you before that restriction is lifted.
(2) You withdraw your consent on which the processing is based under Art. 6 (1) a or Art. 9 (2) a GDPR, and there is no other legal basis for the processing.
(3) You object to the processing under Art. 21 (1) GDPR and there are no overriding legitimate reasons for the processing, or you object to the processing under Art. 21 (2) GDPR.
(4) The personal data concerning you was illegally processed.
(5) The personal data concerning you must be erased to fulfil a legal obligation under EU or member state law to which the controller is subject.
(6) The personal data concerning you was collected in regard to information society services offered pursuant to Art. 8 (1) GDPR.
If the controller has publicised the personal data and is obligated under Art. 17 (1) GDPR to erase that data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
(5) to assert, exercise or defend against legal claims.
If you have asserted your right to rectification, erasure or restriction of the processing toward the controller, that controller is obligated to communicate such correction or deletion of the data or restriction of its processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or would entail a disproportionate effort.
(2) the processing occurs with the help of automated procedures.
In exercising this right, you may also effect that the personal data concerning you are transmitted directly from one controller to another, insofar as this is technically feasible. Doing so must not impair the rights and freedoms of others.
The right to data portability does not apply if personal data must be processed to carry out a task in the public interest or in the exercise of public authority vested in the controller.
You have the right to object at any time, for reasons arising from your particular situation, if personal data concerning you are processed based on Art. 6 (1) e or f GDPR. This also applies to profiling based on these provisions.
The controller will cease processing the personal data concerning you unless the controller can verify compulsory legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing is done to assert, exercise or defend against legal claims.
If the personal data concerning you are processed for direct marketing purposes, you may object to that processing at any time. This also applies to any profiling connected to such direct marketing.
In connection with the use of information society services, you may exercise your right to object using an automatic procedure in which technical specifications are used (regardless of Directive 2002/58/EC).
You have the right to withdraw your declaration of consent under data protection laws at any time. Withdrawing consent will not affect the legality of any processing performed on the basis of that consent before that consent was withdrawn.
However, these decisions may not be based on special categories of personal data under Art. 9 (1) GDPR unless Art. 9 (2) a or g GDPR apply and reasonable measures have been taken to protect your rights, freedoms and legitimate interests.
Regarding the cases mentioned in (1) and (3), the controller shall take reasonable measures to guard your rights, freedoms and legitimate interests, which must include at least the right to obtain human intervention on the part of the controller, to present your own point of view, and to contest the decision.
If you believe that the processing of the personal data concerning you breaches the GDPR, you have the right to complain to a supervisory authority—especially in the member state of your abode, your workplace, or the place of the suspected breach—without prejudice to other administrative rights or judicial remedies.
The supervisory authority to which the complaint is submitted shall inform the complainant about the status and results of that complaint, including the possibility for judicial remedy under Art. 78 GDPR.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 22
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 8
 Art. 17
 Art. 6
 Art. 9
 Art. 9
 Art. 78