Source: https://www.iav.com/en/privacy-policy/
Timestamp: 2020-08-15 05:22:41
Document Index: 481324405

Matched Legal Cases: ['Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 16', 'Art. 17', 'Art. 18', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 77']

Privacy Policy | IAV
IAV Privacy Policy
Thank you for visiting our websites. The protection of your personal data (“Data”) is very important to us. This Privacy Policy is designed to give you an overview of which Data we collect and process when you visit our websites and contact us and what rights you have in relation to the processing of your Data.
I.	Who are we and how can you contact us?
On our website we use “HERE Maps”, a service provided by HERE Global B.V. („HERE“), Kennedyplein 222 -226, 5611 ZT Eindhoven, Netherlands.
With HERE Maps you can view maps and change their views. In particular, your IP address and, for example, when using the route function, the specified start and destination are transmitted to HERE via an interface.
Further information on the processing of your data and the use of cookies can be found in the HERE Privacy Policy and in the HERE Cookie Policy.
We are not able to view the data processed by HERE.
HERE processes your data to show you map material and enable you to use the functionalities, among other things.
With the help of the HERE Maps, we are able to show you interactive maps directly on the website, thus allowing you to make easy use of the map function.
We use the HERE Maps on the basis of Art. 6 sec. 1 f GDPR. Our legitimate interest lies in designing the use of our web pages to match demand, i.e. especially convenient and simple.
You can prevent HERE from collecting and processing the Data by deleting the cookies in your browser, completely deactivating the storage of cookies, selectively accepting certain cookies and, if necessary, setting your browser to notify you, if a cookie should be set. Please use the help functions of your browser to find out how to change these settings. This may limit the functionality of our website.
MTCaptcha:
On our website we use „MTCaptcha“, ”, a service provided by MTCaptcha, 1400 Four Embarcadero Center, San Francisco, CA 94111.
MTCaptcha is used to recognize bots while subscribing to the newsletter. For this purpose, visitor behaviour data (e.g. anonymised IP address, length of stay of the website visitor, mouse movements) is recorded and evaluated in order to distinguish people from bots.
We are not able to view the data processed by MTCaptcha.
MTCaptcha uses the data to distinguish bots from human website visitors on our behalf.
By using MTCaptcha we can distinguish human website visitors from bots and thus protect us from abusive automated spying and SPAM.
We use MTCaptcha on the basis of Art. 6 sec. 1 f GDPR. Our legitimate interest lies in preventing abuses as well as SPAM.
You can prevent MTCaptcha from collecting and processing the Data by deleting the cookie in your browser, completely deactivating the storage of cookies, selectively accepting certain cookies and, if necessary, setting your browser to notify you, if a cookie should be set. Please use the help functions of your browser to find out how to change these settings. This may limit the functionality of our website.
On our websites we use the free web analysis software “Matomo”.
Social-Media (Twitter, XING, LinkedIn, Facebook/Instagram)
Facebook/Instagram Opt-Out
The legal basis for this data processing is your consent pursuant to Art. 6 sec. a GDPR. You agree by clicking on the “I agree” button in our cookie banner: “With your consent, we will use the Facebook pixel to subsequently display audience-driven content on the Facebook Ad Network to visitors of our website and to evaluate the success of our ads. We do not know who is visiting our website. [I agree]”
press distribution list: Send an e-mail with the above-mentioned data and your wish to be added to the press distribution list to kevin.schrein@iav.de. If you fill in the online form on our website with the above data, an e-mail will likewise be sent to kevin.schrein@iav.de.
V.	Who receives your Data?
VI.	What rights do you have and how can you exercise these?
Privacy Policy for the use of the whistleblowing portal and the processing in the case management system („CMS“)
The whistleblowing portal and the CMS are used to report cases of misconduct and to record, process and manage these reports.
This Privacy Policy is designed to give you an overview of which personal data (“Data”) we collect and process when you use the whistleblowing portal and what rights you have in relation to the processing of your Data.
operate the whistleblowing portal as well as the CMS for the IAV Group (consulting4Drive GmbH, CPU 24/7 GmbH, IAV Cars GmbH, IAV Fahrzeugsicherheit GmbH & Co. KG., TRE GmbH, IAV Automotive Engineering Inc., IAV S.A.S.U., IAV U.K. Ltd., IAV Automotive Engineering (Shanghai) Co., Ltd., IAV India Private Ltd., IAV do Brasil Ltda., IAV Korea Co., Ltd., IAV Automotive Engineering AB, IAV Co., Ltd.) and are responsible for protecting your Data.
If you have any questions regarding the processing of data, regarding your rights or this Privacy Policy, please do not hesitate to contact our Group Data Protection Officer. He can be reached by post at:
II.	Which Data are processed when using the whistleblower portal and in the CMS?
Via the whistleblowing portal, misconducts can be reported to us by phone or web message. These reports are recorded, processed and managed in the CMS.
If, as a reporter, you have decided not to make an anonymous report and provide us with your name and contact details, we process this information.
persons about whom reports are received, including
If we receive Data in the context of a report, we process the information provided to us. As a rule, this will be your name, company affiliation, conduct and, if applicable, contact details.
The recording of reports as well as their processing and administration serve to uncover misconducts. The whistleblowing portal provides us with information regarding potential violations of applicable laws, our codes of conduct or ethical principles and allows us to efficiently process and manage these reports in the CMS and to retain the information for possible administrative or criminal investigations.
The data processing described above is based on the legal obligation to maintain an anonymous whistleblowing portal (Art. 6 Sec. 1 c GDPR in conjunction with the Whistleblower Directive) and on legitimate interests (Art. 6 Sec. 1 f GDPR), namely the detection and prevention of misconduct.
We store the data only as long as we need it for the purposes described above. After completion of the handling, the records are soon deleted or anonymized, unless storage is necessary for purposes of legal defence/ enforcement or criminal prosecution.
III.	Log-Files
When visiting the whistleblowing portal’s website, the following data is automatically transmitted by your browser:
•	Information about the browser type and the version used,
•	Websites from which the system reaches the whistleblowing portal (referrer URL).
The temporary storage of the IP address by the system is necessary in order to enable the user’s electronic device to receive the requested Data. For this purpose, the IP address of the user must be stored for the duration of the session. Other Data is stored in log files to ensure the functionality of the whistleblowing portal’s website. The Data is also used to help us prevent malfunctions and misuse of our systems, to ensure the long-term functionality and security of the whistleblowing portal and information technology systems, and to provide prosecuting authorities with the information necessary for prosecution in the event of a cyber attack
The Data will be erased if they are no longer necessary to achieve the purposes. Log files are erased after two weeks at the latest, unless a longer storage period is necessary to comply with contractual or legal obligations. Data, the further storage of which is needed for evidence purposes, are excluded from erasure until the respective incident has been finally clarified.
When you visit the whistleblowing portal’s website, we set so-called cookies. These are small text files that are stored on your device. Cookies typically contain a distinctive string of characters, the so-called cookieID, which identify your browser when revisiting the website.
We use session cookies to better ensure communication within a session.
The session cookies serve to better ensure communication.
We use cookies on the basis of legitimate interests (Art. 6 sec. 1 f GDPR). Our legitimate interest lies in achieving the purposes described above.
Session cookies are automatically removed two hours after closing the browser.
V.	Who receives your Data and to which countries is your Data transferred
Departments within IAV Group
Within IAV, access to your Data shall only be provided to those departments / persons who require this for the purposes described, so called authorized users. Authorizations are granted according to the need-to-know principle. In the case of reports that concern one of our subsidiaries, the employees responsible for compliance at the respective subsidiary are generally involved in the processing of the report. In this process, data is transferred to the country in which the subsidiary is located. In the case of some of the subsidiaries, this involves a data transfer to a country outside the EU/EEA, a so-called third country (USA, China, India, Brazil, South Korea, Japan). Insofar as the existence of a level of data protection comparable to that in the EU has not already been confirmed for these countries by an adequacy decision of the EU Commission, we contractually secure the existence of such a level of data protection at the respective subsidiary by means of the EU standard contractual clauses.
We transmit your Data to service providers who support us in the operation of the whistleblowing portal and the CMS, especially the hosting.
You can exercise your rights through the contact routes mentioned above under I.
Last revision: Mai 2020
are responsible for protecting your Data. If you have any questions regarding the processing of Data, regarding your rights or this Privacy Policy, please do not hesitate to contact our Group Data Protection Officer. He can be reached by post at:
– Professional contact and organisational data: e.g. name, first name, title, academic degree, gender, name of the company you work for, department, e-mail address, postal address, telephone number;
– IT usage data: e.g. user ID, roles and rights, login times, computer name, IP address, user-specific settings, change documentation, log data;
In order to issue visitor passes and access authorisations, identify visitors and authorised persons, administer visitors, issue entry and/or parking authorisations for visitor vehicles, we process, in particular, professional contact and organisational data, IT usage data, photos and other data relating to the resource handed over.
4. Safeguarding and defending our rights and disclosure in the context of administrative/judicial measures
For the exercise and assertion of rights and claims, disclosure within the framework of national, European or non-European administrative/judicial measures for the purposes of gathering evidence, criminal prosecution, for the execution of internal investigations, within the framework of legal defence, preparation of the assertion of claims and assertion of civil law claims, processing of enquiries of data subjects in accordance with the GDPR, we process, in particular, professional contact and organisational data, data on professional conditions, IT usage data, online data, photos, information on work resources received and allocation plans, vehicle data and other Data which can contribute to clarifying the facts of the case.
– Prevailing legitimate interests (Art. 6 sec. 1 f GDPR): Our legitimate interest lies in the optimisation of our business processes and the long-term loyalty of our business partners.
Under certain circumstances, your Data must also be retained for a longer period of time, e.g. if, in connection with an administrative or judicial procedure, a prohibition of data dele-tion is ordered for the duration of the procedure or in case of documents concerning, for example, the construction phase of our products must be retained for a longer period of time due to product liability reasons.
In addition, we transmit your Data to national, European or non-European authorities (e.g. tax office, police, public prosecutor’s office, social insurance carriers) or courts within the scope of their respective responsibilities, if we are obliged to do so by law or by order.
Also, in these cases we transfer your Data only in so far as this is necessary for the respective purposes.
We try to avoid transferring your Data to a third country, i.e. a country outside the Europe-an Union or the European Economic Area.
However, if a transfer should occur because, for example, a service provider or project partner has its head office in a third country, we will only transfer the Data if an adequate level of data protection in the third country is ensured in accordance with an adequacy decision of the European Commission or if appropriate safeguards (such as data protection agreements including the standard contractual clauses of the European Commission or the participation in the EU-US Privacy Shield) can guarantee an adequate protection of Data.
For instance, our contracts with processors usually contain the conclusion of the standard contractual clauses of the European Commission when the processor is established in a third country. A copy of these guarantees will be provided on request. Please use the con-tact routes mentioned in this privacy policy.
A. A.	Withdrawal of consent
You can withdraw any consent you have granted to the processing of your Data at any time and with effect for the future. Please note that the with-drawal will have no impact on the legality of the previous data processing and that it does not extend to such data processing for which statutory authorisation exists and which can therefore be performed without your consent.
You can demand the correction of incorrect Data as well as the completion of in-complete Data according to Art. 16 GDPR.
You can demand the erasure of your Data. Please note that the erasure does not include Data required for the execution and processing of contracts and to assert, exercise and defend against legal claims as well as Data for which statutory, super-visory or contractual retention obligations exist, Art. 17 GDPR.
You can under certain circumstances demand the restriction of the processing, e.g. if you believe that your Data is incorrect, if the processing is illegal or you have raised a complaint about the data processing. This will mean that without your con-sent your Data may only be processed in a very restricted way, e.g. to assert, exer-cise or defend against legal claims or to protect the rights of other natural or legal entities, Art. 18 GDPR.
Candidates and applicants of IAV
You have the opportunity to create a candidate profile via our career’s portal, apply for open positions at IAV and request information on vacancies and career topics at IAV.
This Privacy Policy is designed to give you an overview of which personal data (“Data”) we collect and process when you visit our websites and contact us and what rights you have in relation to the processing of your Data.
II.	Which Data is processed and why?
• the user´s operating system
• date and time of access, date and time of the last access
• websites from which the user’s system accesses the career portal (referrer URL)
The temporary storage of the IP address by the system is necessary in order to enable the user’s electronic device to receive the requested Data. For this purpose, the IP address of the user must be stored for the duration of the session. Other Data is stored in log files to ensure the functionality of the website. The Data is also used to optimize the content of our website, to help us prevent malfunctions and misuse of our systems, to ensure the long-term functionality and security of our website and information technology systems, and to provide prosecuting authorities with the information necessary for prosecution in the event of a cyber-attack. We also need the log files so that you can register and login to our career portal and to determine how long you have not used our career portal.
The Data will be erased if they are no longer necessary to achieve the purposes. Log files are erased after 6 month at the latest.
When you visit our career portal, we set so-called cookies. These are small text files that are stored on your device. Cookies typically contain a distinctive string of characters, the so-called cookieID, which identify your browser when revisiting the website.
name rmk0, rmk1
type of cookie session cookies
description Cookies that communicate your encrypted e-mail address and your encrypted user ID to our server so that you can register and log in to our career portal. These cookies are technically necessary.
type of cookie session cookie
description Cookie, which ensures that your user session is maintained. This cookie is technically necessary.
The purpose of the cookies is to enable you to register and log in to our career portal and to guarantee certain functionalities of the career portal.
We use cookies on the basis of legitimate interests (Art. 6 sec. 1 f GDPR). Our legitimate interest lies in ensuring the functioning of the career portal and their user-friendly operability.
You have total control over the use of cookies and can delete cookies in your browser, you can deactivate the storage of cookies completely, accept only certain cookies selectively and possibly set up your browser in a way that it notifies you when a cookie is to be set. To learn how to change these settings, please use the help feature of your browser.
Please note that registration, login and use of our career portal is not possible if you do not accept the technically necessary cookies.
C.	User account
To apply for jobs at IAV, you require a user account in our Careers Portal.
When you create a user account in our careers portal, we record your e-mail address, password, first and last name and the country where you live. We also record whether you have agreed to our terms of use.
Fields marked with an asterisk are required fields. If you do not fill in these fields, you will not be able to create an account.
We also create a candidate ID.
We record your name and e-mail address in order to be able to assign the user account to a specific person. We record the country in which you live so that we can provide you with our career portal in a suitable language. Using the candidate ID, we can assign you internally and record when you last logged in so that we can delete your user account after the deadline.
The legal basis for the data processing is Sec. 26 BDSG (Federal Data Protection Act) in conjunction with Art. 6 sec. 1 b GDPR.
We store your Data as long as your user account exists in our career portal. You have the possibility to delete your user account at any time. In this case we will delete your Data. If you do not use your user account for a period of 18 months, it will be automatically deleted. We will inform you by e-mail about the imminent deletion. If you are hired by IAV, your external user account will be transferred to an internal user account.
D.	Candidate Profile
You can create a candidate profile in our career portal. In the candidate profile, we record the additional Data requested there. This includes your basic Data (e.g., contact Data for academic titles, nationality), your qualifications (e.g., highest level of education, university, place of study), language skills (e.g., language and level), information about mobility (willingness to travel, relocate, driver’s license), and your preferred place of work. You can also upload your resume in the candidate profile.
You must create a candidate profile if you want to apply for a job at IAV. Fields that are marked with an asterisk are mandatory fields. You cannot apply if these fields are not filled out.
You can also create a candidate profile if you do not want to apply for a specific job.
Candidates who have created a candidate profile are part of the IAV Candidate Pool, which means that we use your Data to check whether certain vacancies are of interest to you. If you have consented to us informing you of vacancies at IAV, we will write to you by e-mail and draw your attention to these vacancies (see II F).
We collect your Data to check whether vacancies at IAV might be of interest to you and so that you can apply for a job with us.
The legal basis for the data processing is Sec. 26 BDSG (Federal Data Protection Act) in conjunction with Art. 6 sec. 1 b GDPR. We process voluntary information on the basis of Sec. 26 para. 1 BDSG in conjunction with Art. 6 1 f GDPR.
We store your Data as long as your user account exists in our career portal. You can change or delete individual details and documents in the candidate profile at any time or delete your user account altogether. If you do not use your user account for a period of 18 months, your user account will be automatically deleted. We will inform you by e-mail about the imminent deletion. When you are hired by IAV, your external candidate profile is transferred to an internal candidate profile.
If you would like to apply for a position, we need the mandatory information from your candidate profile, your CV, your cover letter, your job references and your salary expectations. We also process Data and documents that you voluntarily provide in your candidate profile or in the documents you submit. We record the positions for which you are applying and the course of the application process, in particular whether and when you have been invited for an interview, the feedback on your application and interview from the advertised positions, HR staff and internal participants in the recruitment process, and the correspondence we have had with you.
We use your Data for the purpose of processing your application and to carry out the application procedure.
If no employment relationship is established, we will store your application documents for a maximum of 6 months from the date of notification of rejection, after which your Data will be anonymised and your application documents deleted. If you withdraw your application, your Data will be made anonymous and your application documents deleted. If you are hired, your Data will be transferred to the Human Resources system and used there for the purposes of the employment relationship, and your application documents will be deleted from the application system.
F.	Request for further information
You can click when creating the user account or later in your user account that you want to receive notifications of new job postings. If you do so, we will send you information on job vacancies at IAV to the e-mail address you provide. You can also click to indicate that you wish to keep informed about career opportunities and events at IAV. In this case, we will send you information on general career opportunities at IAV and on career events (e.g. trade fairs, career days) by e-mail.
We process your Data to send you the requested information.
The legal basis for the data processing is Sec. 26 BDSG (Federal Data Protection Act) in conjunction with Art. 6 sec. 1 a GDPR.
You can revoke your consent at any time with effect for the future by unchecking the box “Keep informed about career opportunities and events” or “Receive notifications of new job postings” in the “Search options and privacy” section of your user account or by clicking on the unsubscribe link in the e-mails. If you withdraw your consent, we will no longer send you the information.
Within IAV, access to your Data shall only be provided to those departments / persons who require this for the purposes described, especially these are the bodies issuing the advertisements, the responsible HR employees and persons involved in the approval process.
We will transmit your Data to our service providers, e.g. in the fields of the operation of the career portal
For the operation of the career portal
• For the operation of the career portal
• Advice, legal advice,
• Distribution and advertising,
• Operation and maintenance of our website,
B.	Other rights of data subjects
C.	Contact routes
D.	Right to appeal to the competent data protection supervisory authority
If you, for example, consider that the processing of your Data is illegal or that your rights described above are not granted to you to the required extent, you have the right to file a complaint according to Art. 77 GDPR to the competent data protection supervisory authority.
Privacy Policy for the Use of Our Facebook and Instagram Pages
If you have any questions regarding the processing of data on Facebook / Instagram by Facebook (as described in II. A. and II. B.) and your relevant rights, please contact Facebook’s Data Protection Officer by means of the Facebook Data Policy or Instagram Data Privacy.
II. Data processing in connection with your visit to our Facebook / Instagram page
•	activities and interactions (for example clicks, page views, commenting, sharing), „Likes“ as well as the range of our Facebook page, our advertising activities, our posts and our events,
•	number and usage times of our subscribers and visitors, as well as statistical information about age, gender and location,
•	video statistics,
•	received and sent messages.
•	views of a page, post or video on a page,
•	subscribing to or unsubscribing from a page,
•	tagging a page or a post as „liked“ or „unliked“,
•	recommending a page in a post or comment,
•	commenting on or sharing or reacting otherwise to a page post (including the type of reaction),
•	hiding a page post or reporting it as spam,
•	clicking a link from another Facebook / Instagram page or from outside of Facebook / Instagram that redirects to the page,
•	moving the mouse over the name or the profile picture of a page to see a preview of the page contents,
•	clicking on the website, phone number, „plan route“ button or a different button on a page,
•	the information about whether the page visit or interaction happened from a computer or a mobile device.
•	Which ads people click on.
•	Which pages people engage with.
•	Activities that people engage in on Facebook and Instagram related to things such as their device usage and travel preferences.
•	The mobile device people use and the speed of their network connection.
•	Demographics such as age, gender and location.
When you visit our pages, Facebook will collect and process the Data previously described, as well as other different Data provided by you, through cookies and other tracking technologies, for example to provide advertisers with statistics and analyses, market research, customization of features and contents. Facebook shares these Data with other companies of the Facebook group and third parties and transmits Data to third countries outside of the European Union, such as the United States.
Privacy Policy for the use of our YouTube channel
II. Data processing in connection with your visit to our YouTube channel
•	the viewing time (in minutes / percentage, average viewing time, views),
•	the interactions (e.g. “like me” ratings, comments, shared content, subscribers),
•	to playlists (e.g., playlist exit rate, average time in playlist),
•	to use the info cards (e.g. click on info card, teaser),
•	to use the end screen function (e.g. displayed end screen elements, clicks on end screen elements),
•	to YouTube Premium (e.g. viewing time, views),
•	to our videos (published videos, added videos).
•	regions and TOP-10 countries,
•	demographic aspects (gender of viewers, age of viewers),
•	Access sources (e.g. external, video suggestions, YouTube search, end screen functions),
•	viewing locations (YouTube viewing page embedded in external web pages or apps, YouTube channel page, YouTube others),
•	by device (e.g. computer, mobile phone, TV) and operating system (e.g. Android, ios, Linux),
•	Livestreaming,
•	“Where was it shared?” (e.g. Facebook, WhatsApp, Twitter).