Privacy Policy

Preamble

With the following Privacy Policy, we would like to inform you about the types of personal data (hereinafter also referred to as “data”) we process, the purposes for which we process it, and the scope of such processing. This Privacy Policy applies to all processing of personal data carried out by us, both in connection with the provision of our services and, in particular, on our websites, in mobile applications, and on external online platforms, such as our social media profiles (hereinafter collectively referred to as the “online offerings”).

The terms used are not gender-specific.

As of September 22, 2026

Table of Contents

  • Preamble
  • Person responsible
  • Contact the Data Protection Officer
  • Overview of Processing Methods
  • Relevant legal bases
  • Security measures
  • Transfer of Personal Data
  • International Data Transfers
  • General Information on Data Storage and Deletion
  • Rights of the data subjects
  • Provision of Online Services and Web Hosting
  • Use of Cookies
  • Contact and Inquiry Management
  • Newsletters and Electronic Notifications
  • Web Analytics, Monitoring, and Optimization
  • Processing of Data in the Context of Employment Relationships
  • Application Process
  • Changes and Updates
  • Definitions of Terms

Person responsible

Rein Medical GmbH
Monforts Quartier 23
41238 Mönchengladbach
Authorized Representatives: Dr. Markus Keussen, Dr. Peter Kohrs
Email Address: info@reinmedical.com
Phone: +49 2161 / 6984 – 0
Legal Notice: https://reinmedical.com/impressum/

Contact the Data Protection Officer

Rahn Datenschutz GmbH
Sven Rahn
Heinz-Nixdorf-Str. 12
41179 Mönchengladbach
E: datenschutzbeauftragter.reinmedical@rahn-datenschutz.de
T: 02161/2771730

Overview of Processing Methods

The following overview summarizes the types of data processed and the purposes of such processing, and identifies the data subjects.

Types of data processed

  • Inventory data.
  • Employee data.
  • Contact Information.
  • Table of Contents.
  • Usage data.
  • Meta data, communication data, and procedural data.
  • Applicant information.
  • Log data.

Special Categories of Data

  • Health data.

Categories of affected persons

  • Employees.
  • Communication partners.
  • Users.
  • Applicants.

Purposes of Processing

  • Communication.
  • Safety Measures.
  • Direct marketing.
  • Range measurement.
  • Organizational and Administrative Procedures.
  • Application Process.
  • Feedback.
  • Profiles containing user-specific information.
  • Provision of our online services and user-friendliness.
  • Establishment and Administration of Employment Relationships.
  • Information Technology Infrastructure.
  • Business processes and management practices.

Relevant legal bases

Applicable Legal Bases Under the GDPR: The following provides an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country or our country of residence or incorporation. Furthermore, if more specific legal bases apply in individual cases, we will inform you of these in the Privacy Policy.

  • Consent (Art. 6(1), first sentence, subparagraph (a) of the GDPR) — The data subject has given consent to the processing of personal data concerning him or her for a specific purpose or for several specific purposes.
  • Performance of a Contract and Precontractual Inquiries (Art. 6(1), first sentence, subparagraph (b) of the GDPR) — Processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of precontractual measures taken at the data subject’s request.
  • Legal Obligation (Art. 6(1), first sentence, subparagraph (c) of the GDPR) — Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate Interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR) – Processing is necessary to safeguard the legitimate interests of the controller or a third party, provided that the interests, fundamental rights, and fundamental freedoms of the data subject that require the protection of personal data do not take precedence.
  • The recruitment process as a pre-contractual or contractual relationship (Art. 6(1), first sentence, subparagraph (b) of the GDPR) – To the extent that, as part of the application process, special categories of personal data as defined in Article 9(1) of the GDPR (e.g., health data, such as status as a person with a severe disability or ethnic origin) are requested from applicants, so that the controller or the data subject may exercise the rights and fulfill the obligations arising under labor law and the law on social security and social protection, such processing is carried out in accordance with Article 9(2)(b) GDPR; in the case of protecting the vital interests of applicants or other individuals pursuant to Article 9(2)(c) of the GDPR; or for the purposes of preventive healthcare or occupational medicine, for assessing an employee’s fitness for work, for medical diagnosis, care or treatment in the health or social sector, or for the administration of systems and services in the health or social sector pursuant to Article 9(2)(h) of the GDPR. In the event that special categories of data are provided on the basis of voluntary consent, their processing is based on Article 9(2)(a) of the GDPR.
  • Processing of special categories of personal data relating to health, employment, and social security (Art. 9(2)(h) of the GDPR) — The processing is necessary for the purposes of preventive healthcare or occupational medicine, for the assessment of an employee’s fitness for work, for medical diagnosis, care or treatment in the health or social sectors, or for the administration of systems and services in the health or social sectors, based on Union law or the law of a Member State or pursuant to a contract with a healthcare professional.

National Data Protection Regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. These include, in particular, the Federal Data Protection Act (BDSG). The BDSG contains, in particular, specific provisions regarding the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, data transfers, and automated decision-making in individual cases, including profiling. Furthermore, state data protection laws of the individual federal states may apply.

Applicable Legal Bases Under the Swiss Data Protection Act: We process your personal data in accordance with the Federal Act on Data Protection, or “Swiss DSG” for short. Personal data must be processed lawfully, in good faith, and proportionately (Art. 6, paras. 1 and 2, DSG). It may only be collected for a specific purpose that is recognizable to the data subject and may only be processed in a manner consistent with that purpose (Art. 6(3) DSG). Unlike the GDPR, the Swiss DSG does not, as a general rule, tie the lawfulness of processing by private data controllers to the selection of a specific legal basis from a statutory list. Therefore, there is generally no obligation to specify such a legal basis in the privacy policy for every instance of processing.

Note on the Applicability of the GDPR and the Swiss Data Protection Act (DSG): This privacy notice serves to provide information in accordance with both the Swiss Data Protection Act (DSG) and the General Data Protection Regulation (GDPR). For this reason, please note that, due to their broader geographical scope and clarity, the terms used in the GDPR are employed here. In particular, instead of the terms “processing” of “personal data,” “overriding interest,” and “personal data requiring special protection,” we use the terms “processing” of “personal data,” as well as “legitimate interest” and “special categories of data,” as used in the GDPR. However, the legal meaning of these terms continues to be determined in accordance with the Swiss Data Protection Act (DSG) within the scope of its application.

Security measures

We implement technical and organizational measures appropriate to the circumstances and the purposes of the processing, as well as to the varying likelihoods and severity of threats to the rights and freedoms of natural persons, in accordance with legal requirements and taking into account the state of the art, the costs of implementation, and the nature, scope, circumstances, and purposes of the processing, as well as the varying likelihoods and severity of threats to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access to, input of, and disclosure of the data, ensuring its availability, and maintaining its separation. Furthermore, we have established procedures that ensure the exercise of data subjects’ rights, the deletion of data, and responses to data breaches. Furthermore, we take the protection of personal data into account from the very beginning of the development and selection of hardware, software, and procedures, in accordance with the principle of data protection through technical design and privacy-friendly default settings.

Securing Online Connections Using TLS/SSL Encryption Technology (HTTPS): To protect user data transmitted via our online services from unauthorized access, we rely on TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), thereby protecting the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by the presence of “HTTPS” in the URL. This serves as an indicator to users that their data is being transmitted securely and in an encrypted form.

Transfer of Personal Data

As part of our processing of personal data, it may occur that such data is transferred to or disclosed to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, service providers entrusted with IT tasks or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, enter into appropriate contracts or agreements with the recipients of your data to ensure the protection of your data.

Data Transfer Within the Organization: We may transfer personal data to other departments or units within our organization or grant them access to such data. If the data transfer is for administrative purposes, it is based on our legitimate business and operational interests, or it is carried out if necessary to fulfill our contractual obligations, or if consent has been obtained from the data subjects or if there is a legal basis for doing so.

International Data Transfers

Data Processing in Third Countries: If we transfer data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in connection with the use of third-party services or the disclosure or transfer of data to other individuals, entities, or companies (which can be identified by the provider’s mailing address or if the privacy policy explicitly refers to data transfers to third countries), this is always done in accordance with legal requirements.

For data transfers to the U.S., we primarily rely on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by an adequacy decision of the European Commission dated July 10, 2023. In addition, we have entered into standard contractual clauses with the respective providers that comply with the European Commission’s requirements and establish contractual obligations to protect your data.

This two-tiered safeguard ensures comprehensive protection of your data: The DPF serves as the primary layer of protection, while the Standard Contractual Clauses provide additional security. Should any changes arise within the scope of the DPF, the Standard Contractual Clauses will serve as a reliable fallback option. This ensures that your data remains adequately protected at all times, even in the event of any political or legal changes.

For each service provider, we will inform you whether they are DPF-certified and whether standard contractual clauses are in place. For more information on the DPF and a list of certified companies, visit the U.S. Department of Commerce website at https://www.dataprivacyframework.gov/ (in English).

Appropriate security measures apply to data transfers to other third countries, in particular standard contractual clauses, explicit consent, or transfers required by law. Information on transfers to third countries and applicable adequacy decisions can be found on the European Commission’s website: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

Disclosure of Personal Data Abroad: In accordance with the Swiss Data Protection Act (DSG), we disclose personal data abroad only if adequate protection for the data subjects is guaranteed (Art. 16 of the Swiss DSG). If the Federal Council has not determined that adequate protection exists (list: https://www.bj.admin.ch/de/schweizerische-anerkennung-von-staaten-die-einen-angemessenen-datenschutz-gewaehrleisten), we implement alternative security measures.

For data transfers to the United States, we primarily rely on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by a Swiss adequacy decision dated September 15, 2024. In addition, we have entered into standard data protection clauses with the respective providers, which have been approved by the Federal Data Protection and Information Commissioner (FDPIC) and establish contractual obligations to protect your data.

This two-tiered safeguard ensures comprehensive protection of your data: The DPF serves as the primary layer of protection, while the Standard Data Protection Clauses provide additional security. Should any changes arise within the scope of the DPF, the Standard Data Protection Clauses will serve as a reliable fallback option. This ensures that your data remains adequately protected at all times, even in the event of any political or legal changes.

For each service provider, we will inform you whether they are certified under the DPF and whether standard data protection clauses are in place. You can find the list of certified companies and additional information about the DPF on the U.S. Department of Commerce website at https://www.dataprivacyframework.gov/ (in English).

Data transfers to other third countries are subject to appropriate safeguards, including international treaties, specific safeguards, standard data protection clauses approved by the EDÖB, or internal corporate data protection policies pre-approved by the EDÖB or a competent data protection authority in another country.

General Information on Data Storage and Deletion

We delete the personal data we process in accordance with legal requirements as soon as the underlying consents are revoked or there is no longer a legal basis for processing. This applies to cases in which the original purpose of processing no longer applies or the data is no longer needed. Exceptions to this rule apply when legal obligations or specific interests require the data to be retained or archived for a longer period.

In particular, data that must be retained for commercial or tax law purposes, or whose retention is necessary for legal proceedings or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information regarding the retention and deletion of data that applies specifically to certain processing operations.

If there are multiple specifications regarding the retention period or deletion deadlines for a particular piece of data, the longest period shall always apply. We process data that is no longer retained for its originally intended purpose—but rather due to legal requirements or other reasons—exclusively for the purposes that justify its retention.

Data Retention and Deletion: The following general time limits apply to data retention and archiving under German law:

  • 10 years – Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, as well as the work instructions and other organizational documents necessary for their understanding (Section 147(1)(1) in conjunction with (3) of the German Fiscal Code (AO), § 257(1)(1) in conjunction with (4) of the German Commercial Code (HGB)).
  • 8 years—accounting documents, such as invoices and expense receipts (Section 147(1)(4) and (4a) in conjunction with (3), first sentence, of the German Tax Code (AO), § 14b(1) of the Value-Added Tax Act (UStG) and § 257(1)(4) in conjunction with (4) of the Commercial Code (HGB)).
  • 6 years — Other business records: received business or commercial correspondence, copies of sent business or commercial correspondence, and other documents to the extent they are relevant for tax purposes, e.g., hourly wage slips, payroll statements, cost calculation documents, price tags, as well as payroll records, provided they are not already accounting vouchers, and cash register receipts (Section 147(1)(2), 3, 5 in conjunction with para. 3 of the German Fiscal Code (AO), § 257(1)(2) and (3) in conjunction with para. 4 of the German Commercial Code (HGB)).
  • 3 years—Data necessary to address potential warranty and damage claims or similar contractual claims and rights, as well as to process related inquiries, based on past business experience and standard industry practices, are stored for the duration of the standard statutory limitation period of three years (Sections 195, 199 of the German Civil Code (BGB)).

Data Retention and Deletion: The following general time limits apply to data retention and archiving under Swiss law:

  • 10 years – Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, accounting documents, and invoices, as well as all necessary work instructions and other organizational documents (Art. 958f of the Swiss Code of Obligations (CO)).
  • 10 years—Data necessary for considering potential claims for damages or similar contractual claims and rights, as well as for processing related inquiries, based on past business experience and standard industry practices, will be stored for the statutory limitation period of ten years, unless a shorter period of five years applies, which is relevant in certain cases (Art. 127, 130 OR). After five years, claims for rent, lease payments, and interest on capital, as well as other periodic payments arising from the delivery of food, for meals, and for tavern debts, and from craftsmanship, retail sales of goods, medical services, professional services provided by attorneys, legal agents, solicitors, and notaries, and from the employment relationship of employees (Art. 128 CO).

Rights of the data subjects

Rights of Data Subjects Under the GDPR: As a data subject, you have various rights under the GDPR, which arise in particular from Articles 15 through 21 of the GDPR:

  • Right to Object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing.
  • Right to Withdraw Consent: You have the right to withdraw any consent you have given at any time.
  • Right of Access: You have the right to request confirmation as to whether your personal data is being processed, as well as access to that data, additional information, and a copy of the data in accordance with legal requirements.
  • Right to Rectification: In accordance with legal requirements, you have the right to request that data concerning you be completed or that inaccurate data concerning you be corrected.
  • Right to Erasure and Restriction of Processing: In accordance with legal requirements, you have the right to request that data concerning you be erased without delay or, alternatively, to request a restriction on the processing of such data in accordance with legal requirements.
  • Right to Data Portability: You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, in accordance with legal requirements, or to request that it be transferred to another data controller.
  • Complaint to a Supervisory Authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR. In particular, you may file a complaint with a supervisory authority in the Member State of your habitual residence, your place of work, or the location of the alleged infringement.

Rights of data subjects under the Swiss Data Protection Act (DSG):

As a data subject, you have the following rights in accordance with the provisions of the Swiss Data Protection Act (DSG):

  • Right of Access: You have the right to request confirmation as to whether personal data concerning you is being processed, and to receive the information necessary to enable you to exercise your rights under this law and to ensure transparent data processing.
  • Right to Data Disclosure or Transfer: You have the right to request that we provide you with the personal data you have disclosed to us in a commonly used electronic format.
  • Right to Rectification: You have the right to request the correction of inaccurate personal data concerning you.
  • Right to Object, Deletion, and Destruction: You have the right to object to the processing of your data and to request that your personal data be deleted or destroyed.

Provision of Online Services and Web Hosting

We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to deliver the content and features of our online services to the user’s browser or device.

  • Types of Data Processed: Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved). Log data (e.g., log files regarding logins, data retrieval, or access times).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing and legitimate interests: Providing our online services and ensuring user-friendliness; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)). Security measures.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.”
  • Legal Basis: Legitimate Interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Collection of Access Data and Log Files: Access to our online service is logged in the form of so-called “server log files.” Server log files may include the address and name of the web pages and files accessed, the date and time of the request, the amount of data transferred, a notification of a successful request, the browser type and version, the user’s operating system, the referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. The server log files may be used, on the one hand, for security purposes—for example, to prevent server overload (particularly in the case of malicious attacks, known as DDoS attacks)—and, on the other hand, to ensure server capacity and stability;

Legal Basis: Legitimate Interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR).

Data Deletion: Log file information is stored for a maximum of 30 days and is then deleted or anonymized. Data that must be retained for evidentiary purposes is exempt from deletion until the respective incident has been fully resolved.

Use of Cookies

The term “cookies” refers to functions that store and retrieve information on users’ devices. Cookies may also be used for various purposes, such as ensuring the functionality, security, and convenience of online services, as well as analyzing visitor traffic. We use cookies in accordance with legal requirements. To this end, we obtain users’ consent in advance when necessary. If consent is not required, we rely on our legitimate interests. This applies when the storage and retrieval of information is essential to provide explicitly requested content and features. This includes, for example, saving settings and ensuring the functionality and security of our online services. Consent may be revoked at any time. We provide clear information about the scope of our use and which cookies are used.

Notes on the Legal Basis for Data Protection: Whether we process personal data using cookies depends on consent. If consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage Duration: With regard to storage duration, the following types of cookies are distinguished:

  • Temporary cookies (also known as session cookies): Temporary cookies are deleted at the latest after a user leaves a website and closes their device (e.g., browser or mobile app).
  • Persistent cookies: Persistent cookies remain stored even after the device is turned off. This allows, for example, the user’s login status to be saved and preferred content to be displayed immediately when the user visits a website again. Similarly, user data collected through cookies may be used to measure website reach. Unless we provide users with explicit information regarding the type and retention period of cookies (e.g., when obtaining consent), they should assume that these cookies are persistent and may be stored for up to two years.

General Information on Withdrawal of Consent and Objection (Opt-out): Users may withdraw the consents they have provided at any time and may also object to the processing of their data in accordance with legal requirements, including through their browser’s privacy settings.

  • Types of data processed: metadata, communication data, and transaction data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Legal basis: Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR). Consent (Art. 6(1), first sentence, subparagraph (a) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Processing of Cookie Data Based on Consent: We use a consent management solution that obtains users’ consent to the use of cookies or to the procedures and providers specified within the consent management solution. This process is used to obtain, log, manage, and revoke consents, particularly with regard to the use of cookies and similar technologies that are used to store, read, and process information on users’ devices. As part of this process, users’ consent is obtained for the use of cookies and the associated processing of information, including the specific processing activities and providers mentioned in the consent management process. Users also have the option to manage and revoke their consents. The consent declarations are stored to avoid repeated requests and to maintain proof of consent in accordance with legal requirements. Storage takes place on the server and/or in a cookie (a so-called “opt-in cookie”) or via comparable technologies to enable the consent to be assigned to a specific user or their device. Unless specific information regarding the providers of consent management services is available, the following general guidelines apply: Consent is stored for up to two years. A pseudonymous user identifier is created and stored along with the time of consent, details regarding the scope of consent (e.g., relevant categories of cookies and/or service providers), and information about the browser, the system, and the end device used; Legal basis: Consent (Art. 6(1), sentence 1, letter a) of the GDPR).
  • Cookiebot: Storage and management of consent (consent to cookies and data processing), logging of user decisions, display of notices regarding data protection and cookies, enabling users to revoke or modify their consent; Service Provider: Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark; Website: https://www.cookiebot.com/de; Privacy Policy: https://www.cookiebot.com/de/privacy-policy/; Data Processing Agreement: Provided by the service provider; Additional information: Stored data (on the service provider’s server): The user’s IP address in anonymized form (the last three digits are set to 0), the date and time of consent, browser information, the URL from which consent was submitted, an anonymous, random, and encrypted key value, and the user’s consent status.

Contact and Inquiry Management

When you contact us (e.g., by mail, contact form, email, phone, or social media), as well as in the context of existing user and business relationships, we process the information provided by the individuals making the inquiry to the extent necessary to respond to their inquiries and take any requested actions.

  • Types of data processed: Contact information (e.g., mailing and email addresses or phone numbers); content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, and individuals involved).
  • Affected individuals: Communication partners.
  • Purposes of processing and legitimate interests: Communication; organizational and administrative procedures; feedback (e.g., collecting feedback via an online form). Providing our online services and ensuring user-friendliness.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.”
  • Legal Basis: Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR). Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, subparagraph (b) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Contact Form: When you contact us via our contact form, by email, or through other communication channels, we process the personal data you provide to us in order to respond to and handle your inquiry. This generally includes information such as your name, contact information, and, if applicable, any additional information provided to us that is necessary for proper processing. We use this data exclusively for the stated purpose of establishing contact and communicating with you; Legal Bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR), Legitimate Interests (Art. 6(1), first sentence, lit. f) GDPR).

Newsletters and Electronic Notifications

We send newsletters, emails, and other electronic notifications (hereinafter “newsletters”) exclusively with the recipients’ consent or on a legal basis. If the newsletter’s content is described as part of the sign-up process, that content is decisive for the users’ consent. To subscribe to our newsletter, providing your email address is usually sufficient. However, in order to offer you a personalized service, we may ask you to provide your name so we can address you personally in the newsletter, or to provide additional information if it is necessary for the purpose of the newsletter.

Deletion and Restriction of Processing: We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them, in order to be able to prove that consent was previously given. The processing of this data is limited to the purpose of potentially defending against claims. An individual request for erasure may be made at any time, provided that the prior existence of consent is confirmed at the same time. In the event of obligations to permanently honor objections, we reserve the right to store the email address solely for this purpose in a blocklist.

The registration process is logged based on our legitimate interests for the purpose of verifying that it was carried out properly. To the extent that we engage a service provider to send emails, this is done based on our legitimate interests in an efficient and secure email delivery system.

Contents:

Information about us, our services, promotions, and special offers.

  • Types of data processed: Personal information (e.g., full name, home address, contact information, customer number, etc.); Contact information (e.g., mailing and email addresses or phone numbers); metadata, communication, and process data (e.g., IP addresses, timestamps, identification numbers, individuals involved). Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features).
  • Special categories of personal data: Health data.
  • Affected individuals: Communication partners.
  • Purposes of processing and legitimate interests: Direct marketing (e.g., via email or mail).
  • Legal basis: Consent (Art. 6(1), first sentence, subparagraph (a) of the GDPR). Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR).
  • Opt-Out Option: You can unsubscribe from our newsletter at any time—that is, revoke your consent or opt out of receiving future issues. You will find a link to unsubscribe from the newsletter at the end of each newsletter, or you can use one of the contact options listed above—preferably email—to do so.

Additional information on processing procedures, methods, and services:

  • Rapidmail: Sending emails to recipient lists (lists of email addresses), managing and maintaining these lists, creating and designing email templates, analyzing delivery and open rates (how often an email was opened or clicked); Service Provider: Positive Group Deutschland GmbH, Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau, Germany; Legal Basis: Legitimate Interests (Art. 6(1)(f) GDPR); Website: https://www.rapidmail.de; Privacy Policy: https://www.rapidmail.de/datenschutz. Data Processing Agreement: https://www.rapidmail.de/hilfe/datenschutzvertrag-nach-eu-dsgvo-abschliessen.

Web Analytics, Monitoring, and Optimization

Web analytics (also referred to as “audience measurement”) is used to analyze visitor traffic to our online platform and may include pseudonymized data on visitor behavior, interests, or demographic information—such as age or gender. With the help of audience measurement, we can, for example, determine at what times our online platform or its features and content are used most frequently, or encourage repeat visits. It also allows us to identify which areas require optimization.

In addition to web analytics, we can also use testing methods to, for example, test and optimize different versions of our online offering or its components.

Unless otherwise specified below, profiles—that is, data aggregated for a specific usage session—may be created for these purposes, and information may be stored in a browser or on a device and then retrieved. The data collected includes, in particular, websites visited and the elements used there, as well as technical information such as the browser used, the computer system used, and details regarding usage times. If users have consented to the collection of their location data by us or by the providers of the services we use, the processing of location data is also possible.

In addition, users’ IP addresses are stored. However, we use an IP masking method (i.e., pseudonymization by truncating the IP address) to protect users. In general, no personally identifiable user data (such as email addresses or names) is stored in the context of web analytics, A/B testing, and optimization; instead, pseudonyms are used. This means that neither we nor the providers of the software we use know the actual identity of the users; we only know the information stored in their profiles for the purpose of the respective processes.

Notes on Legal Bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed based on our legitimate interests (i.e., our interest in providing efficient, cost-effective, and user-friendly services). In this context, we would also like to draw your attention to the information regarding the use of cookies in this Privacy Policy.

  • Types of Data Processed: Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing and legitimate interests: Audience measurement (e.g., traffic statistics, identification of returning visitors); profiles containing user-related information (creation of user profiles); provision of our online services and user-friendliness.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.” Cookies may be stored for up to 2 years (Unless otherwise specified, cookies and similar storage methods may be stored on users’ devices for a period of two years.).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal basis: Consent (Art. 6(1), first sentence, subparagraph (a) of the GDPR). Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Google Analytics: We use Google Analytics to measure and analyze the use of our online service based on a pseudonymous user identification number. This identification number does not contain any personally identifiable information, such as names or email addresses. It is used to associate analytical information with a device in order to determine which content users have accessed during one or more sessions, which search terms they used, whether they revisited that content, or how they interacted with our online service. The time of use and its duration are also stored, as well as the sources from which users were referred to our online service and technical aspects of their devices and browsers. In doing so, pseudonymous user profiles are created using information from the use of various devices, and cookies may be used for this purpose. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides rough geographic location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based equivalents). For EU data traffic, IP address data is used exclusively for this derivation of geolocation data before being immediately deleted. It is not logged, is not accessible, and is not used for any other purposes. When Google Analytics collects measurement data, all IP queries are performed on EU-based servers before the traffic is forwarded to Analytics servers for processing; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymization of the IP address); Privacy policy: https://business.safety.google/privacy/; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for transfers to third countries: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms); Opt-out option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for displaying ads: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/ (types of processing and the data processed).
  • Google Tag Manager: We use Google Tag Manager, a software tool from Google that allows us to centrally manage so-called website tags via a user interface. Tags are small pieces of code on our website that are used to track and analyze visitor activity. This technology helps us improve our website and the content we offer on it. Google Tag Manager itself does not create user profiles, does not store cookies containing user profiles, and does not perform any independent analyses. Its function is limited to simplifying and streamlining the integration and management of the tools and services we use on our website. Nevertheless, when using Google Tag Manager, users’ IP addresses are transmitted to Google, which is necessary for technical reasons to implement the services we use. Cookies may also be set in the process. However, this data processing only takes place when services are integrated via Tag Manager. For more detailed information about these services and their data processing, please refer to the relevant sections of this Privacy Policy; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Basis: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://business.safety.google/privacy/; Data Processing Agreement: https://business.safety.google/adsprocessorterms. Basis for transfers to third countries: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms).

Processing of Data in the Context of Employment Relationships

In the context of employment relationships, personal data is processed for the purpose of effectively establishing, administering, and terminating such relationships. This data processing supports various operational and administrative functions necessary for managing employee relationships.

Data processing encompasses various aspects, ranging from the initiation of a contract to its termination. This includes the organization and administration of daily working hours, the management of access rights and permissions, as well as the handling of employee development initiatives and performance reviews. The processing also serves the purpose of payroll accounting and the administration of wage and salary payments, which are critical aspects of contract execution.

In addition, data processing takes into account the legitimate interests of the employer responsible, such as ensuring workplace safety or collecting performance data to evaluate and optimize operational processes. Furthermore, data processing includes the disclosure of employee data as part of external communication and publication processes, where this is necessary for operational or legal purposes.

This data is always processed in accordance with the applicable legal framework, with the goal of creating and maintaining a fair and efficient work environment. This also includes ensuring the privacy of the affected employees and anonymizing or deleting data once the purpose of processing has been fulfilled or in accordance with statutory retention periods.

  • Types of Data Processed: Employee data (information about employees and other individuals in an employment relationship).
  • Affected individuals: Employees (e.g., staff members, job applicants, temporary workers, and other personnel).
  • Purposes of processing and legitimate interests: Establishment and administration of employment relationships (processing of employee data in connection with the establishment and administration of employment relationships). Business processes and operational procedures.
  • Legal Basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, subparagraph (b) of the GDPR); Legal obligation (Art. 6(1), first sentence, subparagraph (c) of the GDPR); Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR). Processing of special categories of personal data relating to health, employment, and social security (Art. 9(2), subparagraph (h) of the GDPR).

Application Process

The application process requires applicants to provide us with the information necessary for their evaluation and selection. The information required is specified in the job description or, in the case of online forms, in the instructions provided there.

Generally, the required information includes personal details such as your name, address, and contact information, as well as proof of the qualifications necessary for the position. Upon request, we are also happy to provide additional details regarding what information is needed.

If available, applicants are welcome to submit their applications via our online form, which is encrypted using state-of-the-art technology. Alternatively, you may also send your application to us by email. However, we would like to point out that emails are generally not encrypted when sent over the Internet. Although emails are usually encrypted during transmission, this encryption does not occur on the servers from which they are sent and received. Therefore, we cannot assume any responsibility for the security of your application while it is being transmitted between you and our server.

For the purposes of searching for candidates, submitting applications, and selecting candidates, we may use applicant tracking and recruitment software, as well as third-party platforms and services, in compliance with legal requirements.

Applicants are welcome to contact us regarding how to submit their application or to send it to us by mail.

Processing of Special Categories of Data: To the extent that, as part of the application process, special categories of personal data (Art. 9(1) GDPR, e.g., health data, such as severe disability status or ethnic origin) are requested from applicants or provided by them, such data is processed so that the controller or the data subject may exercise the rights and fulfill the obligations arising under labor law and the law on social security and social protection, in the case of the protection of the vital interests of applicants or other individuals, or for the purposes of preventive healthcare or occupational medicine, for the assessment of an employee’s fitness for work, for medical diagnosis, for care or treatment in the health or social sector, or for the administration of systems and services in the health or social sector.

Deletion of Data: The data provided by applicants may be further processed by us for the purposes of the employment relationship in the event of a successful application. Otherwise, if the application for a job opening is unsuccessful, the applicants’ data will be deleted. Applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Subject to a valid revocation by the applicant, the data will be deleted no later than six months after the application is submitted, so that we can answer any follow-up questions regarding the application and fulfill our obligations to provide evidence under the regulations on equal treatment of applicants. Invoices for any travel expense reimbursements are archived in accordance with tax regulations.

Inclusion in a Candidate Pool: Inclusion in a candidate pool, if offered, is based on consent. Applicants are informed that their consent to be included in the talent pool is voluntary, has no impact on the current application process, and that they may withdraw their consent at any time with future effect.

  • Types of data processed: Master data (e.g., full name, home address, contact information, customer number, etc.); contact information (e.g., mailing and email addresses or phone numbers); Content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation). Applicant data (e.g., personal details, mailing and contact addresses, documents submitted with the application, and the information contained therein, such as cover letters, resumes, certificates, and other information regarding a specific position or voluntarily provided by applicants about themselves or their qualifications).
  • Individuals affected: Job applicants.
  • Purposes of processing and legitimate interests: Hiring process (justification and any subsequent implementation, as well as possible future termination of the employment relationship).
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.”
  • Legal Basis: The application process as a pre-contractual or contractual relationship (Art. 6(1), first sentence, subparagraph (b) of the GDPR).

Changes and Updates

We ask that you review the content of our Privacy Policy on a regular basis. We will update the Privacy Policy as soon as changes to our data processing practices make it necessary. We will notify you as soon as the changes require action on your part (e.g., consent) or any other individual notification.

If we provide addresses and contact information for companies and organizations in this Privacy Policy, please note that these addresses may change over time, and we ask that you verify the information before contacting them.

Definitions of Terms

This section provides an overview of the terms used in this Privacy Policy. To the extent that these terms are defined by law, their legal definitions apply. The explanations below, however, are intended primarily to aid understanding.

  • Employees: The term “employees” refers to individuals who are in an employment relationship, whether as staff members, employees, or in similar positions. An employment relationship is a legal relationship between an employer and an employee that is established by an employment contract or agreement. It includes the employer’s obligation to pay the employee compensation in exchange for the employee’s work. The employment relationship comprises various phases, including the establishment phase, during which the employment contract is entered into; the performance phase, during which the employee performs their work; and the termination phase, when the employment relationship ends, whether through termination, a mutual termination agreement, or otherwise. Employee data refers to all information relating to these individuals in the context of their employment. This includes aspects such as personal identification information, identification numbers, salary and bank account information, work hours, vacation entitlements, health data, and performance evaluations.
  • Master Data: Master data includes essential information necessary for the identification and management of contractual partners, user accounts, profiles, and similar assignments. This data may include, among other things, personal and demographic information such as names, contact information (addresses, phone numbers, email addresses), dates of birth, and specific identifiers (user IDs). Master data forms the basis for any formal interaction between individuals and services, institutions, or systems by enabling unique mapping and communication.
  • Content Data: Content data encompasses information generated during the creation, editing, and publication of all types of content. This category of data may include text, images, videos, audio files, and other multimedia content published on various platforms and media. Content data is not limited to the actual content itself, but also includes metadata that provides information about the content, such as tags, descriptions, author information, and publication dates.
  • Contact Information: Contact information is essential data that enables communication with individuals or organizations. It includes, among other things, phone numbers, mailing addresses, and email addresses, as well as communication channels such as social media handles and instant messaging identifiers.
  • Meta, communication, and operational data: Meta, communication, and operational data are categories that contain information about how data is processed, transmitted, and managed. Metadata, also known as “data about data,” includes information that describes the context, origin, and structure of other data. It may include details such as file size, creation date, the author of a document, and revision histories. Communication data captures the exchange of information between users via various channels, such as email correspondence, call logs, social media messages, and chat histories, including the individuals involved, timestamps, and transmission methods. Process data describes the processes and procedures within systems or organizations, including workflow documentation, transaction and activity logs, and audit logs used to track and verify operations.
  • Usage Data: Usage data refers to information that tracks how users interact with digital products, services, or platforms. This data encompasses a wide range of information that reveals how users use applications, which features they prefer, how long they stay on specific pages, and the paths they take when navigating through an application. Usage data may also include frequency of use, activity timestamps, IP addresses, device information, and location data. It is particularly valuable for analyzing user behavior, optimizing user experiences, personalizing content, and improving products or services. Furthermore, usage data plays a crucial role in identifying trends, preferences, and potential problem areas within digital offerings
  • Personal Data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier (e.g., a cookie) or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
  • Profiles containing user-related information: The processing of “profiles containing user-related information,” or “profiles” for short, encompasses any type of automated processing of personal data that involves using such personal data to identify certain personal characteristics relating to a natural person (depending on the type of profiling, this may include various information regarding demographics, behavior, and interests, such as interaction with websites and their content, etc.), or to predict them (e.g., interests in specific content or products, click behavior on a website, or location). Cookies and web beacons are frequently used for profiling purposes.
  • Log data: Log data consists of information about events or activities that have been logged in a system or network. This data typically includes information such as timestamps, IP addresses, user actions, error messages, and other details regarding the use or operation of a system. Log data is often used to analyze system issues, monitor security, or generate performance reports.
  • Audience Measurement: Audience measurement (also known as web analytics) is used to analyze visitor traffic to an online service and may include the behavior or interests of visitors regarding specific information, such as website content. With the help of reach analysis, operators of online services can, for example, determine at what times users visit their websites and what content interests them. This enables them, for example, to better tailor the content of their websites to the needs of their visitors. For the purposes of reach analysis, pseudonymous cookies and web beacons are frequently used to identify returning visitors and thus obtain more accurate analyses of how an online service is used.
  • Data Controller: The term “data controller” refers to the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and encompasses virtually any interaction with data, whether it involves collection, analysis, storage, transmission, or deletion.