1. Contact
The controller in the meaning of General Data Protection Regulation (GDPR) is:
nyris GmbH
Warschauer Str. 58a
13355 Berlin
+49 211 97 63 38 99
Questions regarding data protection can also be addressed directly to our data protection officer:
Attorney David Heimburger
+49 40 22863648
2. Your rights in general
We summarize here the general rights that you have under the GDPR with regard to your personal data processed by us. For an explanation of the legal terms, please refer to the applicable definitions in the GDPR (see Article 4). If anything remains incomprehensible, please do not hesitate to ask us.
- You may revoke any consent you have given us to process or share your data at any time for the future (Article 7(3) GDPR).
- If the legal basis for processing your data is a legitimate interest pursuant to Article 6(1)(f) GDPR, you may lodge an objection to the data processing pursuant to Article 21 GDPR. Insofar as the relevant data processing is direct marketing, you do not have to justify your objection in any way; in all other cases, you would have to provide reasons for your objection that arise from your particular situation.
- If we have stored incorrect information about you, you can request us to correct your data (Article 16 GDPR).
- You can request information from us about which of your data we process (Article 15 GDPR, § 34 BDSG).
- You may request that we delete your data or restrict its processing, provided that your request does not conflict with any higher-ranking retention obligations (Article 17 or 18 GDPR, § 35 BDSG).
- You may request that we provide you with the data you have provided to us yourself in a machine-readable format for disclosure to third parties (Article 20 GDPR).
- You may complain to a supervisory authority for data protection, e.g. the Berlin data protection commissioner, about data protection issues with us.
3. Data processing at our company in general
Any form of processing of personal data requires a legal basis that allows us to do so. The legal basis primarily results from the purpose for which the data is processed. The lawfulness within a legal basis is regularly measured according to the specific scope of the data processing and the measures we have taken to protect your data.
Legal bases for data processing arise from Article 6(1) GDPR and for particularly sensitive data such as health data from Article 9(2) GDPR. These two regulations name the preparation or fulfilment of contractual, legal or also social obligations as the most important legal bases for data processing. In addition, many data processing operations are carried out in our legitimate interest, unless the interests of the data subjects prevail in view of the specific circumstances. If one of the aforementioned types of legal basis is relevant, the processing does not require any further consent from you.
In addition, data processing may be carried out on the basis of consent from you (Article 7 GDPR) or for persons under the age of 16 when using information society services (e.g. websites, online games, social media platforms) by the children or young people in conjunction with the consent of a parent or guardian (Article 8 GDPR).
We would like to expressly point out that none of our offers are aimed at persons under the age of 16.
In part, our obligation to ask for your consent does not, or not solely, result from the GDPR but from the stricter law under the EU ePrivacy Directive of 2002 (often called the "Cookie Directive"). The provisions of this directive apply in Germany via the German Telemedia Act (TMG) and the Unfair Competition Act (UWG). We have taken into account the obligations arising from these laws without explicitly referring to them in the following.
If a data transfer to a state outside the European Economic Area (EEA) takes place, we ensure that data protection is secured in the sense of Articles 44 - 49 GDPR.
4. General information on cookies
Cookies are text files that are stored by your browser on your device when you visit a website. Different information can be stored in a cookie. Sometimes a cookie only stores a yes or no ("true" or "false"), sometimes a string of characters is stored that enables the browser to be uniquely identified when the website is called up again (a so-called cookie ID).
The right to set cookies is not only determined by the GDPR, but also by the EU ePrivacy Directive and Section 15 of the German Telemedia Act (TMG). The ePrivacy Directive distinguishes between cookies that are strictly necessary to provide a information society service (essential cookies) and those that are not. Essential cookies may also be set without consent, but non-essential cookies always require consent - even if this is not required under the GDPR (e.g. there is a legitimate interest as a legal basis).
Before we store non-essential cookies on your terminal device, we ask for your consent in accordance with the requirements of the ePrivacy Directive.
The purpose of each cookie and the legal basis for its use according to the GDPR can be seen from the following description of the single means of data processing.
There are various ways for you to prevent the acceptance of cookies on your device:
- The standard should be that you decide via our consent manager which cookies you accept and which you do not when you call up one of our Internet pages. In some cases, we can only offer you a blanket acceptance or rejection of all cookies or cookie groups.
- In principle, you can set your browser in a way it never accepts cookies. By such a complete exclusion, you will most likely lose functions that are based on cookies and that you would actually like to allow or that do not require consent at all.
- You can access Internet pages in the privacy mode of your browser. The privacy mode also blocks the setting of cookies in your browser memory or automatically deletes all cookies at the end of the session.
- Some browsers or browser plug-ins offer you the possibility to make more differentiated default settings as to which cookies you generally want to accept by default and which you do not.
- A special case: Google offers a browser plug-in that prevents the various cookies from Google from being set. You can find the corresponding plug-in here: https://tools.google.com/dlpage/gaoptout?hl=de
5. Details of data processing
5.1. Visiting our website
5.1.1. Provision of our website
Description: In order for a web server to make our website available to your browser, the server must collect technical data about the device you are using, your browser and your internet access. This is referred to as a log file or weblog. This is the same data that you necessarily leave behind with every internet page that you call up. At the centre is the IP address from which you call up our pages. The web server sends the data you want to see to this internet address.
Data categories: IP address from which our site was accessed; date and time of access; objects on our website accessed in the browser; type and version of Internet browser; type and version of operating system.
Data recipient (if applicable, third country transfer): Our hosting service provider, who is bound to data protection via an order processing agreement, is located in the EEA. In the event of attacks on our pages, data is passed on to forensic experts and investigating authorities commissioned by us. A transfer to third countries does not take place.
Purpose + legal basis: Provision of our website as well as investigations should unlawful access to our websites occur (e.g. a hacker attack). Legal basis is a legitimate interest, as the operation of a website is not possible without the collection of the weblog. In the specific case of an attack on our website, we have a legitimate interest in being able to provide investigators with evidence of how the attack took place.
Storage period: 7 days
5.1.2. Cookie management
Description: For all cookies requiring consent, we ask for your consent before storing them in your browser cache. The decisions you make will in turn be stored in a cookie on your device so that we do not have to ask for your consent again when you visit our website next time. You can revise your decision at any time by deleting the corresponding cookie from your device via your browser settings.
Data categories: Consent status (Yes/No)
Data recipient (if applicable, third country transfer): None
Purpose + legal basis: Legally compliant consent management for cookies. Legal basis is a legitimate interest, as saving the cookie decision only slightly restricts the rights of visitors and at the same time simplifies the use of the pages on repeated visits. This cookie may also be set without your consent according to the ePrivacy Directive, as the cookie choice is to be considered an essential function.
Storage period: Until the corresponding cookie is deleted from your browser cache or until the expiry date of the cookie is reached
5.1.3. Contact form
Description: Our internet pages offer a contact form. You can use it to send us messages, e.g. if you do not have your own e-mail address or do not want to use it for the message to us. Your entries are voluntary. Technically they are forwarded to us as an e-mail (even if you have not entered an e-mail address as sender yourself).
Once you send your message, the data processing is equivalent to sending an e-mail to our central contact address. While you are on the website and enter your details in the form, the data processing corresponds to calling up any of our pages.
Categories of data: See the processing operations "Provision of a website" and "E-mail communication".
Data recipients (transfer to third countries, if applicable): See the processing operations "Provision of a website" and "E-mail communication".
Purpose + legal basis: Provision of a contact form as an additional way to contact us. Depending on the content of your contact, the legal basis are steps at the request of the data subject prior to entering into a contract or a legitimate interest.
Storage period: See the processing operations "Provision of a website" and "E-mail communication".
5.1.4. Web Fonts
Description: To enable an individual design of our internet pages, we use so-called web fonts. Your browser loads these fonts from the internet to display our pages if the fonts have not yet been loaded in your browser's cache from a previous visit to a page with this font.
In some cases, we use fonts from external Google servers (Google Fonts). Google enables an outstandingly fast provision of the font files and guarantees the provision of the currently optimal font set.
For the font download from the Google font servers (gstatic.com), your IP address must be transmitted to Google, as otherwise a transmission of the data package is not possible. Google does not receive any further data from you in connection with this processing.
For full information on how Google uses the data it collects, please see Google's privacy policy (https://policies.google.com/privacy).
Data categories: IP address from which your device accesses the internet, time stamp
Data recipient (if applicable, third country transfer): Google LLC, for us as a European organisation contactable via Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. The data collected within the service of Google Fonts is transferred to Google servers in the USA and processed there. Insofar as data is transferred to third countries, compliance with the EU level of data protection is ensured by concluding EU standard data protection clauses.
Purpose + legal basis: Provision of Google Fonts in a fast and up-to-date form. The legal basis is a legitimate interest, as only the IP address of your device is transmitted as part of this processing, without any further references to your use of the internet.
Storage period: Google is responsible for the storage period. It is not possible for us to delete data, as we do not collect any data from you through the use of Google Fonts.
5.1.5. Analysis of website usage (Google Analytics)
Description: We use the web analytics service Google Analytics. On our behalf, Google creates statistical reports about the activities on our website, the regional origin of the visitors and technical key data of the devices with which our pages are visited.
We use Analytics with the extension "anonymizeIP" so that the IP addresses are only processed in abbreviated form to reduce the possibility of a personal reference. Through IP anonymisation, the end of your IP address is replaced by zeros by Google within the European Union before the data is transferred to the USA. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there.
Google Analytics collects data from your device or internet browser, which you send to a web server by default when you visit websites. If you have consented to the setting of a Google cookie, Google records the cookie ID stored in the cookie. In addition, Google recognises supplementary information about your device, such as software or fonts already installed, and uses this to create a digital fingerprint.
The cookie ID or the digital fingerprint give us the possibility to determine the quota of returning visitors or to be able to trace usage paths within our internet pages.
The Analytics cookies are named _ga (to recognise returning visitors), _gid (to be able to form statistical groups) and _gat (to reduce data matching with advanced Google functions).
For full information on how Google uses the data it collects, please see Google's privacy policy (https://policies.google.com/privacy) and Google's information on cookies (https://policies.google.com/technologies/cookies).
We have linked our Analytics account with our marketing account at Google and thus enable Google to play out ads for us in a more targeted manner. In addition, this enables us to better understand which advertising measure has had which success. See the processing "Google Ads" and the corresponding note on our joint responsibility with Google within the meaning of Article 26 GDPR.
Data categories: IP address via which the device goes online; location or country linked to the IP address as well as internet service provider for internet access; date and time of access; objects on our website that are called up (clicked on) in the browser; type and version of the internet browser; type and version of the operating system; information on the screen resolution and other technical parameters of the device used; websites from which the user has accessed our website; websites that the user calls up from our website; Google ID stored in the cookie.
Data recipient (if applicable, third country transfer): Google LLC, for us as a European organisation contactable via Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. Google is obligated to us to observe data protection via an data processing agreement in accordance with Article 28 GDPR. The information collected by the cookies is transferred to Google servers in the USA and stored there. Insofar as data is transferred to third countries, compliance with the EU level of data protection is ensured by concluding EU standard data protection clauses.
Purpose + legal basis: The purpose of this usage analysis is to enable us to further improve our internet offering based on the analysis findings. The legal basis in particular for linking the Analytics data with the advertising functions of Google is your consent, which you have given via our Cookie Manager.
Storage period: 14 months (Reason: This storage period allows us to export annual reports).
5.1.6. Analysis of website usage (Matomo)
Description: We use the web analytics service Matomo. On our behalf, Matomo creates statistical reports about the activities on our website, the regional origin of the visitors and technical key data of the devices with which our pages are visited.
We have set Matomo so that IP addresses are only processed in abbreviated form in order to limit direct personal references. Through IP anonymisation, the end of your IP address is replaced by zeros directly after collection.
We have set Matomo to store cookies in your browser when you access our website, in order to be able to assign your activities on our website to a user. This gives us the possibility to determine the quota of returning visitors or to be able to trace usage paths within our internet pages. The cookie does not tell us who you are. The cookie assigns you to a cookie ID as a pseudonym.
We do not share the data from Matomo with any third parties. In particular, we do not merge the data with data from advertising networks or use it in any other way for marketing purposes.
You can recognise the analytics cookies from Matomo by the abbreviation pk in the name (Matomo used to be called Piwik).
Further information on Matomo can be found at https://matomo.org/matomo-cloud-privacy-policy/.
Data categories: IP address via which the device goes online; location or country linked to the IP address as well as internet service provider for internet access; date and time of access; objects on our website that are called up (clicked on) in the browser; type and version of the internet browser; type and version of the operating system; internet pages that were clicked on before and next; Matomo ID stored in the cookie.
Data recipient (third country transfer if applicable): InnoCraft Ltd, 7 Waterloo Quay PO625, 6140 Wellington, New Zealand. InnoCraft (the operator of Matomo Cloud) is obligated to us to observe data protection via a data processing agreement in accordance with Article 28 GDPR. The information collected by the cookies is transferred to servers in the EEA and stored there, so that technically no third country transfer takes place. Legally, the third country transfer to InnoCraft as a New Zealand company is protected by the EU Commission's adequacy decision for New Zealand.
Purpose + legal basis: The purpose of this usage analysis is to enable us to further improve our internet offering based on the analysis findings.
The legal basis is a legitimate interest, which results from the fact that the personal reference of the collected data is greatly reduced, e.g. by anonymising the IP addresses, that the data is not combined by us with other data collections. Irrespective of this, we ask for your consent to the setting of Matomo cookies via our cookie manager in view of the requirements of the ePrivacy Directive.
Storage period: 14 months (Reason: This storage period allows us to export annual reports).
5.1.7. Analysis of website usage (LinkedIn)
Description: Our internet pages set cookies from LinkedIn. By doing so, we provide LinkedIn with data about your use of our site. This enables LinkedIn to provide ads for us within LinkedIn that are more targeted.
The corresponding data is only transferred to LinkedIn if you agree to the setting of the corresponding cookies. The names of the LinkedIn cookies are, for example: UserMatchHistory, bcookie, bscookie, lang, lidc, lissc
For comprehensive information about the use of data collected by LinkedIn, please see LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy?_l=de_DE
Data categories: IP address via which the device goes online; location or country linked to the IP address as well as internet service provider for internet access; date and time of access; objects on our website that are called up (clicked on) in the browser; type and version of the internet browser; type and version of the operating system; websites from which the user has accessed our website; websites that the user calls up from our website; LinkedIn ID stored in the cookie.
Data recipient (if applicable, third country transfer): LinkedIn Corp., contactable for us as a European organisation via LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn is obligated to us to observe data protection via a data processing agreement in accordance with Article 28 GDPR. Insofar as data is transferred to third countries, compliance with the EU level of data protection is ensured through the conclusion of EU standard data protection clauses.
Purpose + legal basis: The purpose of passing on data to LinkedIn is to be able to provide ads on LinkedIn that are as target group-specific as possible. The legal basis is your consent, which you have given via our cookie manager.
Storage period: The storage period is the responsibility of LinkedIn. It is not necessary for us to delete your data, as we do not collect any data from you through the use of LinkedIn cookies.
5.1.8. Prospect analysis
Description: We are a service provider for business customers (B2B). We therefore assume that the majority of visitors to our website are interested in our company as potential business partners. Accordingly, we analyse which companies the visitors to our website come from with the service of Leadfeeder. Leadfeeder provides us with general and publicly available contact data on these companies so that we can contact them if necessary.
Leadfeeder analyses the IP address of the device you use to access our pages. Should Leadfeeder be able to assign this address to a company via corresponding public directories for IP addresses, we will receive this information. We do not learn which person from the IP address range visited our pages, we only learn that the pages were accessed from the company.
In order to be able to recognise returning visitors as such, we use the Leadfeeder cookie (_lfa). Details on data protection at Leadfeeder can be found at: https://www.leadfeeder.com/privacy/
Data categories: IP address, time stamp, cookie ID in the leadfeeder cookie
Data recipient (if applicable, third country transfer): Our service provider for prospect analysis, which is committed to data protection by a data processing agreement. The processor is based in the EU, but uses subprocessors in third countries. Insofar as data is transferred to third countries, compliance with the EU level of data protection is ensured by concluding EU standard data protection clauses.
Purpose + legal basis: B2B prospect analysis. The legal basis is a legitimate interest, as we only access your IP address or the leadfeeder cookie ID on the one hand and otherwise only general and publicly accessible company information. In addition, we act in a B2B relationship.
Storage period: We delete the information provided by Leadfeeder when we have contacted you as a potential customer or have classified you as a non-relevant contact.
5.2 Marketing communication
5.2.1. Newsletter subscription
Description: You can subscribe to our e-mail newsletter. To do so, you only need to provide an e-mail address. Further details such as your name are voluntary and are used so that we can personalise the sending of the e-mails with a direct salutation.
If you register for the newsletter, you will receive a one-time e-mail from us to the e-mail address you provided, in which we ask you to confirm your registration. This is to prevent you from being registered for our newsletter by someone who does not or should not have access to this address. This two-step procedure is called double opt-in for double consent.
By subscribing to our newsletter, you consent, both under data protection law and competition law, to us sending you e-mails on the topics described on the subscription page.
Sie können Ihre Anmeldung und damit Ihre Einwilligung jederzeit für die Zukunft widerrufen. Das ist über den entsprechenden Link am Ende jedes von uns verschickten Newsletters möglich.
We record the use of our newsletter via so-called counting pixels and campaign URLs for the internet links in the newsletter. The tracking pixel calls up our newsletter server when you open the e-mail. The call-up of the internet links in the newsletter is recorded via the campaign assignment in our web analysis.
Data categories: E-mail address, documentation of e-mail verification (double opt-in), time of your registration; name (voluntary), company/institution (voluntary), contact data (voluntary); usage data (opening the e-mail + clicking on internet links)
Data recipient (if applicable, third country transfer): Our service provider for newsletter dispatch, who is obligated to data protection via an data processing agreement. The service provider is located in the USA. Insofar as data is transferred to third countries, compliance with the EU level of data protection is ensured through the conclusion of EU standard data protection clauses.
Purpose + legal basis: Providing an e-mail newsletter and optimising our newsletter content. Legal basis is your consent.
Storage period: After revocation of your consent, your data will be deleted immediately.
5.2.2. Telemarketing (B2B)
Description: Insofar as a potential business customer (B2B) has given their presumed consent for us to make promotional calls, we will also offer you our services by telephone call (telemarketing). In the case of business customers, we assume corresponding presumed consent if you have contacted us and provided us with your telephone number, e.g. in the context of a whitepaper download or a newsletter registration.
The details of the calls follow the processing "Customer database (CRM)" and "Telephone calls".
Data categories: Name, telephone number, company/organisation, existence of marketing consent, order whitepaper, time of contacting
Data recipient (if applicable, third country transfer): None
Purpose + legal basis: Personal presentation of the service portfolio and its conditions in a telephone conversation with potential customers whose consent for a call has been expressly or presumably given. The legal basis is presumed consent within the meaning of § 7 paragraph 2 no. 2 UWG.
Storage period: See processing operations "Customer database (CRM)" and "Telephone calls"
5.2.3. Google My Business
Description: We operate a company profile on Google My Business ("GMB"). We publish information about ourselves via GMB, which is used to present our company in various Google services. This applies in particular to the presentation of our company in the results display for Google Search and in Google Maps. Google provides us with statistical data on the use of our information published on GMB. In addition, you can contact us directly via GMB - e.g. call our telephone number directly - or publish comments on our company profile. When you contact us or comment on our profile, Google provides us with information about you, such as the Google username you were logged in with during your interaction with GMB.
By linking GMB with our Google Analytics account, we make it easier for Google to recognise interested parties who have already visited our websites.
We have no possibility to influence the data processing at Google. The provision of GMB as well as Google Search and Google Maps are the responsibility of Google. Legally, we as the operator of the GMB profile are considered jointly responsible for these data processing operations, so that we have concluded a joint responsibility agreement with Google in this regard (see: https://privacy.google.com/businesses/controllerterms/). The contract divides the responsibility between Google and us in such a way that we are responsible for the establishment of a relationship between your data and our GMB profile and Google is responsible for the further processing of the data. You should exercise all your rights in relation to Google's processing of your data directly with Google. You should contact us regarding the processing of your data in direct communication with us. Legally, you are free to contact both Google and us at any time with any concerns you may have and the recipient will forward your request to the appropriate party as appropriate.
For details of data processing at Google, please refer to Google's privacy policy (https://policies.google.com/privacy).
We use the personal data we receive from you via GMB to respond to your enquiries or to respond to your comments.
Data categories: For the categories of data processed by Google, please see Google's privacy policy. We process your name or username provided to Google, your contact requests and comments you post on GMB.
Data recipient (if applicable, third country transfer): Google LLC, for us as a European organisation contactable via Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. Google is committed to data protection via a shared responsibility agreement. Insofar as data is transferred to third countries, compliance with the EU level of data protection is ensured through the conclusion of EU standard data protection clauses.
Purpose + legal basis: Answering your enquiries and responding to your comments on Google My Business. The legal basis for the processing by us is a legitimate interest, as you yourself have visited our GMB profile in a Google service and entered into an exchange with us there.
Storage period: Google is responsible for the storage period. It is not necessary for us to delete your data, as we do not store any of your data independently through the use of GMB.
5.2.4. Google Ads
Description: We place ads via Google Ads. In order to optimise our marketing activities, Google Ads accesses personal data that is available to Google via cookies and its various analytics services for internet browsers, apps and the Android and Chrome OS operating systems provided by Google. We ourselves do not have access to the personal data on which the playout of our ads is based. We only select general parameters for the target group to which our ads are to be made available. In this respect, we do not process any personal data.
By linking our Google Ads account with our Google Analytics account, we make it easier for Google to recognise interested parties who have already visited our websites.
Our internet pages set cookies from Google's advertising services. The cookie names are e.g.: NID, SID, IDE, DSID, FLC, AID, TAID, exchange_uid, test_cookie, _gads, _gac, _gcl.
The linking of the accounts and the setting of Google's advertising cookies constitutes a processing of personal data. In this respect, a joint control within the meaning of Article 26 GDPR arises with regard to the personal data, for which we have concluded a corresponding contract with Google (https://privacy.google.com/businesses/controllerterms/).
The contract allocates responsibility between Google and us so that we are responsible for collecting the analytics data and Google is responsible for using the data for advertising purposes. As a result, you should exercise all your rights with respect to the use of your data within Google Analytics with us and exercise all your rights with respect to the use of your data for the provision of targeted ads directly with Google.
For details of data processing at Google, please refer to Google's privacy policy (https://policies.google.com/privacy).
Data categories: For the categories of data processed by Google, see Google's privacy policy and our information on our use of Google Analytics; targeting by demographic, regional, technical or economic factors and, most importantly, by areas of interest.
Data recipient (if applicable, third country transfer): Google LLC, for us as a European organisation contactable via Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. Google is committed to data protection via a joint controllership agreement. Insofar as data is transferred to third countries, compliance with the EU level of data protection is ensured through the conclusion of EU standard data protection clauses.
Purpose + legal basis: Target group-specific publication of advertisements. Legal basis is consent, as Google's tracking technology may only be started after your corresponding consent.
Storage period: The storage period is the responsibility of Google. It is not necessary for us to delete your data, as we do not collect any data from you through the use of Google Ads.
5.2.5. LinkedIn Ads
Description: We display ads on LinkedIn. We ourselves do not have access to the personal data on which the display of our ads is based. We only select general parameters for the target group to which our ads are to be made accessible. In this respect, we do not process any personal data.
Since our website sets cookies from LinkedIn, we make it easier for LinkedIn to recognise interested parties who have visited our pages. See the processing "Analysis of user behaviour (LinkedIn)".
In addition, we enable LinkedIn to make our ads available to people who have a similar usage profile to typical visitors to our pages (so-called lookalike campaigns).
All processing of personal data mentioned here is the sole responsibility of LinkedIn.
For details of data processing at LinkedIn, please refer to LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy
Data categories: Usage data from LinkedIn's various services; target group formation, e.g. according to regions or areas of interest.
Data recipient (if applicable, third country transfer): LinkedIn Corp., in Europe addressable via LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Insofar as data is transferred to third countries, compliance with the EU level of data protection is ensured by concluding EU standard data protection clauses.
Purpose + legal basis: Target group-specific publication of advertisements. Legal basis is consent, as LinkedIn's tracking technology may only be started after your corresponding consent.
Storage period: The storage period is the responsibility of LinkedIn. It is not necessary for us to delete your data, as we do not collect any data from you through the use of LinkedIn Ads.
5.3. Our Social Media Profile
5.3.1. Facebook and Instagram
Description: We operate company profiles (also called fan pages) on Facebook and Instagram. Such a fan page enables us to present our organisation on Facebook or Instagram, to get in touch with you on this social media platform and to refer to our services and offers via advertisements on these platforms.
Facebook provides us with analytics data about the use of our fan page (called Page Insights). This gives us an impression of how successful the individual communication measures are.
The privacy policy of Facebook applies to the details of data processing at Facebook: https://www.facebook.com/about/privacy
In accordance with a ruling of the European Court of Justice, the use of this analytics data is carried out in a joint controllership with Facebook pursuant to Article 26 GDPR. Facebook has provided a joint controllership agreement accordingly (https://www.facebook.com/legal/terms/page_controller_addendum). In the agreement, Facebook has assumed sole responsibility for all data processing issues. If you wish to exercise your rights under the GDPR with regard to the data processed in Page Insights, you should contact Facebook directly via your Facebook account. However, in accordance with the legal rules on joint control, you are also free to contact us with your concern. We would then pass your concern on to Facebook.
Data categories: Facebook username; comments, likes and page views within Facebook or Instagram, and time of action.
Data recipient (if applicable, third country transfer): Facebook Inc., for us as a European organisation addressable via Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Insofar as data is transferred to third countries, compliance with the EU level of data protection is ensured by concluding EU standard data protection clauses.
Purpose + legal basis: Analysis of user behaviour on our fan page or our Instagram profile. The legal basis is the consent you gave as part of your Facebook registration.
Storage period: The storage period is the responsibility of Facebook. It is not necessary for us to delete data, as we do not collect any data from you through the use of Page Insights.
5.3.2. Twitter
Description: We operate a company profile on Twitter. Such a Twitter profile enables us to present our organisation on Twitter, to get in touch with you on this social media platform and to refer to our services and offers via advertisements on these platforms.
Twitter provides us with analysis data regarding the use of our profile page (Twitter Analytics). This gives us an impression of how successful each of our communication measures is.
The privacy policy of Twitter applies to the details of data processing at Twitter: https://twitter.com/de/privacy
Data categories: Twitter username; comments, likes and page views within Twitter and time of action.
Data recipient (if applicable, third country transfer): Twitter Inc., contactable for us as a European organisation regarding Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Insofar as data is transferred to third countries, compliance with the EU level of data protection is ensured by concluding EU standard data protection clauses.
Purpose + legal basis: Analysis of user behaviour on our Twitter profile. The legal basis is the consent you have given as part of your Twitter registration.
Storage period: The storage period is the responsibility of Twitter. It is not necessary for us to delete your data, as we do not collect any data from you through the use of Twitter Analytics.
5.3.3. LinkedIn
Description: We operate a company profile on LinkedIn. Such a LinkedIn profile enables us to present our organisation on LinkedIn, to get in touch with you on this social media platform and to refer to our services and offers via advertisements on these platforms.
LinkedIn provides us with analytics data regarding the use of our profile page. This gives us an impression of how successful each of our communication measures is.
The privacy policy of LinkedIn applies to the details of data processing at LinkedIn: https://www.linkedin.com/legal/privacy-policy
Data categories: LinkedIn username; comments, likes and page views within LinkedIn; and time of action.
Data recipient (if applicable, third country transfer): LinkedIn Corp., contactable for us as a European organisation regarding LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. If data is transferred to third countries, compliance with the EU level of data protection is ensured by concluding EU standard data protection clauses.
Purpose + legal basis: Analysis of user behaviour on our LinkedIn profile. The legal basis is the consent you have given as part of your LinkedIn registration.
Storage period: The storage period is the responsibility of LinkedIn. It is not necessary for us to delete your data, as we do not collect any data from you through the use of Linkedin Analytics.
5.3.4. YouTube
Description: We run a corporate channel on YouTube. Such a YouTube channel enables us to present our organisation on YouTube, to get in touch with you on this social media platform and to draw your attention to our services.
YouTube provides us with analytics data regarding the use of our channel. This gives us an impression of how successful each of our communication measures is.
For details of data processing at YouTube, please refer to Google's privacy policy: https://policies.google.com/privacy
Data categories: YouTube username; comments, likes and page views within YouTube; and time of action.
Data recipient (if applicable, third country transfer): Google LLC, contactable for us as a European organisation via Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. Google is committed to data protection via a joint controllership agreement. Insofar as data is transferred to third countries, compliance with the EU level of data protection is ensured through the conclusion of EU standard data protection clauses.
Purpose + legal basis: Analysis of usage behaviour on our YouTube channel. The legal basis is the consent you gave when calling up YouTube.
Storage period: Google is responsible for the storage period. It is not necessary for us to delete data, as we do not collect any data from you through the use of YouTube.
5.4. Direct communication with us
5.4.1. E-mail communication
Description: When you send us an e-mail, it arrives in at least one of our e-mail inboxes. The content of your e-mail and the metadata accompanying it (sender, time of sending, etc.) are stored on the e-mail servers of our hosting provider. In addition, after retrieval from the server, they may be stored in the e-mail applications on the devices that have access to the mailbox (computers, smartphones, tablets). The same applies to e-mails that we send to you.
The specific processing of personal data in an e-mail depends on the thematic content of the e-mail. It is obvious that we include your data in our contact directory for customers, business partners and other contacts.
Data categories: Name, e-mail address; time of delivery or dispatch; other metadata that typically arise in e-mail communication; other personal information in the content of the e-mail such as further contact data in e-mail signatures, enquiries, orders, offers or complaints by e-mail.
Data recipient (if applicable, third country transfer): Our service provider for hosting the e-mail inboxes, who is bound to data protection by a data processing agreement, is located in the EEA. The service provider is part of an international group of companies with headquarters in the USA and further subprocessors in various third countries. The resulting data transfer outside the EEA is secured by the conclusion of EU standard data protection clauses.
Purpose + legal basis: Communication by e-mail. Depending on the content of the correspondence, the legal basis is the preparation or fulfilment of a contract or a legitimate interest in answering your e-mail.
Storage period: Depends on the content of the correspondence; for example, commercial law requires business letters to be stored for six years, but other documentation obligations may also result in longer storage periods.
5.4.2. Phone calls
Description: When we make a phone call to each other, our cloud-based telephone system in connection with our softphones or our mobile phones records your number and the time of the call. This data in the call lists is continuously deleted from subsequent calls.
If the content of the conversation suggests this, we will create a conversation note and document it in the appropriate place (e.g. in the customer database or for applicants and employees in the personnel area). It is conceivable that we will include your data in our contact directory for further communication.
Audio recordings of conversations only take place in exceptional cases and after we have obtained your express consent to do so.
Data categories: Telephone number; time of the call; content of the call, if applicable.
Data recipients (if applicable, transfer to third countries): Telecommunications providers who are subject to telecommunications secrecy and the service provider for our cloud telephone system, who is bound to data protection by a data processing agreement and is located in the EEA. Data transfer outside the EEA does not take place in this respect.
Purpose + legal basis: Communication by telephone call. Depending on the content of the conversation, the legal basis is preparation or fulfilment of a contract or a legitimate interest in exchanging information with you.
Storage period: Depending on the content of the conversation. Individual conversation notes may be subject to the six-year retention requirement for business letters under commercial law.
5.4.3. Letter post
Description: If you send us a letter, we regularly reply to it with a letter that we create on the computer and save as a file. We often scan your letter in order to archive it as part of digital office management. The specific processing of personal data in our correspondence depends on the thematic content of the letters and the resulting retention obligations. It is conceivable that we will include your data in our contact directory for further communication.
Data categories: Name + address; personal details in the content of the letters, such as further contact details in your letterhead, enquiries, orders, offers, complaints or other topics.
Data recipient (if applicable, third country transfer): Postal service provider. A transfer to third countries only takes place if the item is sent to an address outside the European Economic Area. In these cases, data protection is guaranteed by international agreements on postal secrecy.
Purpose + legal basis: Communication by letter. Legal basis is, depending on the content of the correspondence, preparation or fulfilment of a contract or a legitimate interest in communicating with you.
Storage period: Depending on the content of the correspondence; in principle, commercial law requires business letters to be stored for six years.
5.4.4. Video conference (Zoom)
Description: If you take part in a video conference with us to which we have (technically) invited you, the responsibility for the data processing through this communication lies with us. We use the provider Zoom for video conferences. When we invite you to a conference, we send you a Zoom URL related to the specific conference together with the date.
To join a video conference, you must use either the Zoom app for mobile devices or desktop/laptop. It is also possible to participate by telephone. For this purpose, in addition to the invitation URL, you will also be provided with the corresponding data for a telephone dial-in.
As a participant, you do not need to create a user account with Zoom. When you dial into the conference, you will be asked to give yourself a participant name for the conference so that you can, for example, be assigned a name when speaking in the chat during the conference. You can also use fantasy names here.
The Zoom app asks for your consent to access your microphone and camera. You can give any of these permissions, but you don't have to if you want to follow a conference without active participation, for example.
In addition to audio and video, the conference app offers you supplementary functions: an accompanying chat for exchanges in text form, requests to speak with the help of symbolic icons, profile maintenance (profile picture, additional contact data), artificial background image.
Conferences can be recorded. If a conference is to be recorded, we inform all participants in advance and only start the recording when all participants have given their consent to the recording. Audio recordings can be transcribed into a text file.
Unless there is an expressly agreed recording, the conference is not stored in any way. After the conference has ended, the contents of an unrecorded conference can no longer be accessed. In this respect, this corresponds to telephone conversations that were not recorded.
It is technically possible for any participant to make screenshots or a recording of the conference in whole or in part using means outside the Zoom app. Such behaviour without corresponding agreement with all participants constitutes a data protection violation by the acting person and, if it is not one of our employees, is outside our responsibility. Surreptitious recording of the spoken word may constitute a criminal offence under § 201 German Criminal Code (StGB). We reserve the right to take legal action of any kind against persons who use their participation in a video conference to engage in conduct that is hostile to data protection.
As the host (moderator) of the conference, we have the technical means to mute/blackout you, change your user name and perform other moderator functions without your involvement. We only use such possibilities if there is a need to do so.
As far as data processing is concerned that is not directly related to the specific conference, the responsibility does not lie with us but directly with Zoom. This applies, for example, to the download of the Zoom app or the use of your own Zoom user account. By downloading the Zoom app onto your device, you establish an independent legal relationship between yourself and Zoom.
The data transfer between your device and the Zoom server requires that Zoom takes note of the IP address by which you are online during the video conference. The servers also collect all types of data that regularly occur when using telemedia services.
Information on data protection at Zoom can be found here: https://zoom.us/docs/de-de/privacy-and-legal.html and https://zoom.us/privacy
Data categories: User name, participation times, video or audio signal, video or audio recording (only with consent), audio transcript (only after recording), actions in the chat, status request to speak, profile data (profile picture, contact data, background picture), telephone number (if participating by telephone); further data categories such as IP address or e-mail address are processed by Zoom under its own control.
Data recipient (if applicable, third country transfer): Zoom Video Communications Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA, is committed to data protection as a processor. Data transfer outside the EEA is secured by the conclusion of EU standard data protection clauses.
Purpose + legal basis: Use of a video conference. Depending on the content of the conversation, the legal basis is preparation or fulfilment of a contract or a legitimate interest in communicating with you. For recordings, consent is the legal basis.
Storage period: If there is no recording, all data is deleted when the conference ends. If the conference was recorded, the recording is deleted as soon as the last purpose for which the recording was made has been achieved.
5.4.5. Appointment
Description: If you want to make an appointment with us, you can do so by using the provider Calendly. In our e-mail signatures, behind the Calendly icon, you will find a link to the public calendars of individual team members of us at Calendly.
Select a free time slot and start the appointment request with your name and e-mail address as well as a topic of conversation, if applicable, which Calendly transmits to us. Details on data protection at Calendly can be found at: https://calendly.com/de/pages/privacy.
You will receive feedback from us as soon as possible, regularly in connection with a specific appointment invitation from our internal calendars, which you can accept with your calendar application.
Data categories: E-mail address, name, proposed appointment, topic of conversation; IP address, time of website visit (for Calendly)
Data recipient (if applicable, third country transfer): Our service provider for hosting the internal calendars is located in the EEA and is bound to data protection by a data processing agreement. The processor is part of an international group of companies with headquarters in the USA and further subprocessors in various third countries.
Our service provider for the transfer of the appointment request, which is committed to data protection by a data processing agreement, is located in the USA.
The resulting data transfer outside the EEA is secured by the conclusion of EU standard data protection clauses.
Purpose + legal basis: Simplification of the appointment coordination. The legal basis is a legitimate interest, as you independently call up our calendars at Calendly and provide your data for the appointment request via this service.
Storage period: For the storage period of your data at Calendly, we refer to the privacy policy of Calendly. We regularly store appointment data for six years, as we understand business appointments as business letters in the sense of commercial law.
5.4.6. Contact directory + business cards
Description: If we are likely to be in contact with you again in the future, we will store your contact details in our contact directory so that we can recognise you as a known contact when you call or e-mail us, or so that we can continue to contact you. If you hand over your business card to us, we will transfer your data to our contact directory.
Data categories: Name, contact details (address, telephone, fax, e-mail), your company, your company's field of business, your job title, your area of responsibility, place, time and circumstance of contact and, if applicable, special notes on your availability or the business topics addressed.
Data recipient (if applicable, third country transfer): Our service provider for the hosting of the contact directories, which is committed to data protection by a data processing agreement, is located in the EEA. The service provider is part of an international group of companies with headquarters in the USA and further subprocessors in various third countries. The resulting data transfer outside the EEA is secured by the conclusion of EU standard data protection clauses.
Purpose + legal basis: Maintaining contacts. Legal basis is a legitimate interest, as you have voluntarily given us your business card or contact details.
Storage period: We store your data until you ask us to delete it - unless a business relationship has arisen between us in the meantime, from which independent storage obligations arise for us with regard to your contact data.
5.5. Customers
5.5.1. User Account (Virtual Search Administration)
Description: We provide our customers with a user account regarding the search index for their instance of the nyris virtual search.
Data categories: Login data (name, organisation, booked nyris instance, e-mail address, password), activity history (IP address, timestamp, browser actions, settings made in the nyris instance).
Data recipient (if applicable, third country transfer): Our service provider for the hosting of the user database, which is committed to data protection by a data processing agreement, is located in the EEA. The service provider is part of an international group of companies with headquarters in the USA and further subcontractors in various third countries. The resulting data transfer outside the EEA is secured by the conclusion of EU standard data protection clauses.
Purpose + legal basis: The operation of your user account serves the fulfilment of our corresponding user agreement. The legal basis is accordingly the fulfilment of our contractual obligations towards you. The logging of user activities serves the purpose of traceability in cases of misuse and thus contributes to the legally required data security.
Storage period: Your user data remains active until you or we close your user account and delete the associated data.
5.5.2. Customer database (CRM)
Description: We maintain your data in our customer database in the sense of a Customer Relation Management (CRM). In the CRM, we manage the history of your customer relationship with us.
Data categories: Contact details (name, e-mail address, telephone number, address), appointments, commissioned services, support requests, activity history, marketing consents.
Data recipient (if applicable, third country transfer): Our service provider for the operation of the CRM, who is bound to data protection by a data processing agreement, is located in the EEA. There is no data transfer outside the EEA.
Purpose + legal basis: Use of a CRM system that enables us to provide holistic support to our customers, from contacting them regarding the conclusion of a contract to customer support. The legal basis is a legitimate interest, as the use of the CRM increases the level of service.
Storage period: We store your customer account for up to six years after the conclusion of the last customer contact. In this respect, we thereby fulfil the retention obligation for business letters from commercial law.
5.5.3. Customer support
Description: When you visit our support page (https://nyris.zendesk.com/hc/en-us), we direct you to web pages hosted by Zendesk. On our Zendesk page, you can submit support requests that will be processed by our team as a ticket.
Details about Zendesk's privacy policy can be found at: https://www.zendesk.com/company/customers-partners/privacy-policy/
Data categories: E-mail address, if applicable, name, subject and description of your support request, status of your ticket, feedback on your request; for Zendesk: IP address and time stamp
Data recipient (if applicable, third country transfer): Our service provider for support management, which is committed to data protection by a data processing agreement, is located in the USA. The resulting data transfer outside the EEA is secured by the conclusion of EU standard data protection clauses.
Purpose + legal basis: Management of support requests. The legal basis is either contract performance or legitimate interest, as the data processing is done to respond to your request.
Storage period: We store the ticket data like business letters within the meaning of commercial law for six years. For the storage period of your weblog data at Zendesk, we refer to the privacy policy of Zendesk.
5.5.4. Invoicing
Description: To the extent that our customers are self-employed or part of a partnership, we process personal data from you when we send you our invoices. We create our invoices (billing) with a cloud application.
Data categories: Name, address, date, customer and invoice number, invoice amount and invoice content
Data recipient (if applicable, third country transfer): Our service provider for the operation of the invoicing application, who is bound to data protection by a data processing agreement, is located in the EEA. There is no data transfer outside the EEA.
Purpose + legal basis: Invoicing. The legal basis for invoicing is contract performance.
Storage period: Accounting documents must be kept for 10 years in accordance with tax law.
5.6. Use of our apps
5.6.1. Download of apps
If you want to use our app on your mobile device, you need to download it from an app store suitable for your device's operating system. For iOS devices this is Apple's AppStore, for Android devices either Google's PlayStore or another platform for Android apps.
All data processing in connection with the download of our app takes place between you and the respective app store. We do not receive any personal data, only statistical compilations regarding the number of downloads. For all information about the respective data processing, please refer to the corresponding privacy policies of Apple, Google or the download platform you use.
5.6.2. Functions in the app
Description: With our app Image Collector you can access your user account and load photos into your search index. The functions in the app are basically the same as on our website, but are optimised for use on mobile devices. Special app-related data processing does not take place. Reference can be made to the processing "User account (administration of visual search)".
You can test how nyris visual search can work with our app Everybag. You need to give the app access to your smartphone camera and take a photo of an object. This photo is transmitted to our test search index. As a search result, you will be shown products that match or resemble the product in your shot. If you tap on a hit, the product is called up in your Internet browser at a web shop that is independent of us.
Your IP address is deleted from our servers immediately after the search hits are delivered. Image areas that could represent faces are anonymised by pixelation before further processing of the image.
Data categories: For Image Collector see the processing "User account (visual search administration)".
For Everybag: IP address of the smartphone; if applicable, image content that allows personal identification.
Data recipient (if applicable, third country transfer): For Image Collector see the processing "User account (visual search administration)".
Purpose + legal basis: For Image Collector see the processing "User account (visual search administration)".
For Everybag: Provision of a visual search. Legal basis is contract fulfilment, as you send your images to us to perform the visual search.
Storage period: For Image Collector see the processing "User account (visual search administration)".
For Everybag: Your IP address is deleted immediately after the search hits are delivered. Image content that could be a face is anonymised immediately.
5.6.3. Analysis of user behaviour (Google Firebase)
Description: We track the use of our app with Google Analytics for Firebase, Google's analytics service for apps on mobile devices. Google creates statistical reports on our behalf regarding the activities in our app and technical parameters of the devices on which our app is used.
Google is able to identify your device and thus regularly your person. To do this, Google primarily accesses the advertising ID provided by the operating system of your device. You can generally prevent access to the advertising ID in the settings of your device (for iOS: > Privacy > Advertising > Restrict ad tracking; for Android: > Account > Google > Ads). For iOS devices, as of iOS 14.5, prior consent is mandatory before an app can access the advertising ID. In addition, you can decide whether you consent to the collection of your usage behaviour when you use our app for the first time. Even later, you can make this decision again in the privacy settings of our app at any time with effect for the future.
For comprehensive information regarding the use of data collected by Google, please refer to Google's privacy policy (https://policies.google.com/privacy) and Google's information on Firebase (https://firebase.google.com/support/privacy).
Data categories: IP address used to bring the device online; location or country associated with the IP address and internet service provider used to access the internet; date and time of access; elements and functions in our app used; type and version of app installed; type and version of operating system; manufacturer and model of device, size of screen, MAC address of device, advertising ID of device; information about app crashes; type and bandwidth of internet access used.
Data recipient (if applicable, third country transfer): Google LLC, contactable for us as a European organisation via Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. Google is bound to data protection by a data processing agreement according to Article 28 GDPR. Insofar as data is transferred to third countries, compliance with the EU level of data protection is ensured through the conclusion of EU standard data protection clauses.
Storage period: 14 months (Reason: This storage period allows us to export annual reports).
5.7. Suppliers and service providers
5.7.1. Business relationship
Description: From our suppliers and service providers who are self-employed or partnerships, or our contacts at such organisations, we process personal data as a customer in order to be able to communicate with you regarding the processing of the order.
In addition to the content-related communication, your data is typically processed in the separately described processing operations for "communicating with us" (see there).
Data categories: Contact, contract and billing data
Data recipients (if applicable, third country transfer): Tax advisors, auditors, lawyers in their function as professional secrecy holders.
Our service provider for hosting e-mail inboxes, contacts and calendars is located in the EEA and is bound to data protection by a data processing agreement. The service provider is part of an international group of companies with headquarters in the USA and further subprocessors in various third countries. The resulting data transfer outside the EEA is secured by the conclusion of EU standard data protection clauses.
Purpose + legal basis: Proper management. Legal bases are both contract fulfilment and legal obligations and legitimate interests.
Retention period: In accordance with tax law, invoice data must be retained for 10 years; contract data must be retained for different periods depending on the type of contract. For copyrights, such periods extend up to 70 years following the death of the author.
5.8. Staffing
5.8.1. Applications
Description: If you apply for a job with us, we will process your application documents until the end of the application process solely for the purpose of deciding about your employment. We restrict access to your documents to those persons whom we reasonably involve in the decision regarding your recruitment. If you are hired, your application documents will be transferred to your personnel file. If recruitment does not take place, we will either ask for your consent to include you in our pool of candidates or return or destroy your documents as soon as there is no longer any reason to expect an objection to our decision under anti-discrimination law.
Data categories: Name + contact details (e-mail, telephone, address), photo, profile URL in professional networks (e.g. Xing); details in the letter of application, in the CV, in certificates and references, educational certificates and professional qualifications, notes on job interviews (by telephone and in person), results from recruitment tests, if applicable.
Data recipient (if applicable, transfer to a third country): Our service provider for an applicant database, who is bound to data protection by a data processing agreement. The service provider is located in the EEA; there is no data transfer outside the EEA.
Purpose + legal basis: Decision-making basis for filling a position. The legal basis is the preparation of the fulfilment of a contract (employment contract) and subsequently a legitimate interest in the defence of objections against negative decisions.
Storage period: 6 months after the end of the original application process
5.8.2. Candidate pool
Description: If we are unable to offer you a suitable position at the moment, but would like to consider you again in the selection process for future vacancies, we ask for your consent to keep your application documents beyond the conclusion of the current application process. If we are unable to get back to you for more than two years, we will ask for your consent to keep your documents for a further period, or we will return them to you or delete them.
Data categories: Name + contact details (e-mail, telephone, address), photo, profile URL in professional networks (e.g. Xing); details in the letter of application, in the CV, in certificates and references, educational certificates and professional qualifications, notes on job interviews (by telephone and in person), results from recruitment tests, if applicable.
Data recipient (if applicable, transfer to a third country): Our service provider for an applicant database, who is bound to data protection by a data processing agreement. The service provider is located in the EEA; there is no data transfer outside the EEA.
Purpose + legal basis: Decision-making basis for future staffing. Legal basis is consent.
Storage period: 2 years since last contact or last consent
5.9. General infrastructure
5.9.1. Visitor Wi-Fi
Description: We provide visitors with access to our Wi-Fi network and thus the internet. When logging on to the access point for the Wi-Fi network, the unique identifier of your device and the usage times are recorded.
For all services that you call up while using our network on the internet, the IP address of our network is logged. Insofar as there are investigations into activities that originated from our IP address, we are partially obliged to make the usage documentation available in the so-called log file of our access points.
Data categories: MAC address of the device, usage times
Recipients of data (if applicable, transfer to third countries): Normally no recipients; in the case of investigations, competent authorities and, under certain circumstances, private holders of a right to information or forensic experts commissioned by us.
Purpose + legal basis: Log files such as this are used to enable and strengthen IT security in our company. The legal basis is a legitimate interest, as we only access the Wi-Fi log file when a security analysis is required. It is only possible for us to allocate the Wi-Fi data to specific devices and thus their owners with considerable effort and regularly only with the help of police investigations.
Storage period: Our Wi-Fi log file is deleted regularly.
5.9.2. Financial accounting
Description: All payments are recorded in the financial accounting. The person of the payer or payee is documented. In the case of legal entities, this sometimes also includes the names and contact details of contact persons for the transaction. In some cases, the reason for payment also provides information regarding persons or the activity of a person (e.g. salary/fee payments, travel bookings, expense reimbursements).
Data categories: Name, customer or supplier number, bank details or credit card details, reason for payment, travel details (time, destination, accommodation, means of transport, costs), hospitality (date, place/hospitality establishment, persons hosted, reason for hospitality, costs), details of other expenses (purchases, gifts).
Data recipient (if applicable, third country transfer): Our service provider for the accounting database, who is bound to data protection by a data processing agreement, is located in the EEA. Our tax advisor, who is bound by law to data protection as a professional secrecy holder. A third country transfer does not take place.
Purpose + legal basis: Administration of all payment transactions. Legal basis is contract performance or legal obligation (tax and commercial law).
Storage period: We keep the data in the financial accounting for 10 years.
5.9.3. Payment transfers
Description: Payments via a bank or credit card account from us are documented accordingly in the account statements.
Data categories: Name, bank details, payment date, payment amount, reason for payment (booking text)
Data recipient (if applicable, third country transfer): Our account-holding financial institutions, which are legally bound to data protection by banking secrecy and banking supervision. A third country transfer does not take place.
Purpose + legal basis: Cashless payment transactions; legal basis is contract performance.
Storage period: We keep account statements for 10 years.
5.9.4. File storage (metadata)
Description: In addition to data collection in individual databases (described above), we store documents on our storage media. This typically includes Office documents, PDF files, images, films, layouts and ultimately any type of file whose use is appropriate in the context of our business processes.
Data protection issues regarding the content of the files depend on the relevant processing purposes in each case. In parallel, the storage of the files and the metadata regularly attached to them (primarily the creator signature) results in independent processing. Office documents in particular contain personal metadata when they are worked on jointly (collaboration) and the comment and note functions as well as the change mode are used for this purpose.
Data categories: Any type of data, but here focus on metadata: signature of file creator, signatures of file editors (also in comments + notes); time of creation, editing or storage.
Data recipient (if applicable, third country transfer): Our service provider for the hosting of cloud storage and online software for file processing, which is bound to data protection by a data processing agreement, is located in the EEA. The service provider is part of an international group of companies with headquarters in the USA and further subcontractors in various third countries. The resulting data transfer outside the EEA is secured by the conclusion of EU standard data protection clauses.
Another service provider for hosting cloud storage, which is bound to data protection by a data processing agreement, is located in Switzerland. The resulting data transfer outside the EEA is protected by an adequacy decision of the EU Commission.
Purpose + legal basis: File storage in an online data centre. Legal basis is a legitimate interest, as the processing is carried out by processors.
Storage duration: Depending on the storage time for the individual file
5.9.5. Disposal of data carriers and documents
Description: The deletion or destruction of data also constitutes data processing. Paper documents with personal data requiring appropriate protection are shredded by us or disposed of regarding the sealed bins of a professional document shredder. The quality level of the shredder used and the level of document destruction agreed with the service provider corresponds to the risk or confidentiality classification of the documents to be destroyed.
Storage media (hard drives, e.g. from servers, computers, smartphones, tablets, USB sticks, memory cards) on which personal data worthy of protection was previously stored will, if they are no longer to be used to store this data, be securely erased by our IT administration by multiple, at least triple, complete overwriting or handed over to a professional storage media destroyer. The level of erasure or destruction will be commensurate with the risk or confidentiality rating of the data previously stored on the media.
Data categories: Any type of data
Data recipient (if applicable, third country transfer): Service providers for the professional destruction of paper documents and storage media who are bound to data protection compliance by data processing agreements. A third country transfer does not take place.
Purpose + legal basis: Risk-compliant destruction or deletion of personal data. The legal basis is the legal obligation to minimise and delete data by virtue of GDPR.
Storage duration: Storage beyond deletion/destruction does not take place.
5.9.6. Legal prosecution
Description: In the event that we get into a legal dispute with you, we will pass on data about you and the circumstances of the dispute to lawyers and, if necessary, to the courts.
Data categories: Name, contact details, details of the subject matter of the dispute
Data recipients (if applicable, transfer to third countries): lawyers, courts, bailiffs. All recipients are obliged to confidentiality as a state institution or as a professional secrecy holder. A transfer to a third country does not take place.
Purpose + legal basis: Legal prosecution. The legal basis is the legitimate interest in seeking legal assistance from lawyers and, if necessary, courts, if required.
Storage period: The named recipients process your data according to their own specifications to the extent necessary to fulfil the respective task. We store the data relating to a legal dispute until the final conclusion of the dispute, including all relevant limitation and objection periods. Should a repetition of a comparable dispute with you or other data subjects be conceivable, we will store at least the documents that are decisive for the proceedings - if necessary in anonymised form - for a correspondingly longer period of time.
5.9.7. Data protection management
Description: If you assert your data protection rights against us, we document the associated communication and processes in our data protection management application.
Data categories: Name, contact details, data protection request details
Data recipients (third country transfer, if applicable): Our data protection officer, who is legally bound to confidentiality, is located in the EEA. Our service provider for the cloud application for data protection management, which is bound to data protection by a data processing agreement, is located in the EEA. A third country transfer does not take place so.
Purpose + legal basis: Data protection management. Legal basis is the legal accountability from the GDPR.
Storage period: We store the data relating to a legal dispute until the final conclusion of the dispute, including all relevant limitation and objection periods. Should a repetition of a comparable dispute with you or other data subjects be conceivable, we will store at least the documents that are decisive for the proceedings - if necessary in anonymised form - for a correspondingly longer period of time.
Last update: February 2022