DATA PROTECTION PRIVACY POLICY

1. GENERAL

Benefit Partner GmbH, Europaplatz 5, 3100 St. Pölten (hereinafter “Benefit Partner”) is the operator of the website https://www.xeleo.com/ and would therefore like to inform you in the following privacy policy about the extent to which data is collected when you use our website https://www.xeleo.com/ and for what purpose this data is used.

Please read this policy carefully before using the website, as it explains how Benefit Partner collects, processes and stores personal data. In order to provide our services, we may need to process personal data. The protection of your data is our top priority. We therefore process your data exclusively in accordance with the statutory provisions (GDPR, TKG 2003) and do not use the data for any purposes that could cause you harm. We use the data you provide to fulfil and administer the contractual relationship. We protect your data against unauthorised access, loss and alteration using all means at our disposal.

How do we collect your data?

We collect your data, on the one hand, when you provide it to us. This may include, for example, data that you enter into a contact form. Other data is collected automatically or with your consent by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or time of page view). This data is collected automatically as soon as you enter this website. 

Some of the data is collected to ensure the website functions correctly. Other data may be used to analyse your user behaviour. 

What rights do you have regarding your data? 

You have the right, at any time and free of charge, to obtain information about the source, recipients and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data. If you have given your consent to data processing, you may withdraw this consent at any time with effect for the future. Furthermore, you have the right, under certain circumstances, to request the restriction of the processing of your personal data. You also have the right to lodge a complaint with the relevant supervisory authority. 

You may contact us at any time regarding this matter or any other questions you may have about data protection.

Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to completely protect data from access by third parties. 

Analytics tools and third-party tools

When you visit this website, your browsing behaviour may be statistically analysed. This is primarily done using so-called analytics programmes. You can find detailed information on these analytics programmes in the following privacy policy.

Hosting
External Hosting

This website is hosted by an external service provider (host). The personal data collected on this website is stored on the host’s servers. This may primarily include IP addresses, contact enquiries, meta and communication data, contractual data, contact details, names, website visits and other data generated via a website.

The use of the host is for the purpose of fulfilling our contractual obligations towards our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR).

Consent may be withdrawn at any time.

Our hosting provider will only process your data to the extent necessary to fulfil its service obligations and will follow our instructions regarding this data.

We use the following hosting provider:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen

Data processing

We have entered into a data processing agreement (DPA) with the above-mentioned provider. This is a contract required under data protection law, which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

2. DATA PROCESSING

Data categories, purpose of processing, categories of recipients

We process your personal data falling under the following categories:

Name/company name, occupation/job title, date of birth, company registration number, contact person, customer’s business address, contact details (tel. no., fax, email, etc.), bank details, credit card details, order details, VAT number, customer service enquiries. You have provided us with this data voluntarily and we process this data on the basis of your consent for the following purposes:

to establish contact and fulfil the contract, and on the basis of our legitimate interest for the provision of information, additional offers and for analysis.

We disclose your data to the following categories of recipients:

Tax advisors (accounting), IT service providers (database management), banks (contract processing), public authorities and courts (where applicable), insurance companies (where applicable), debt collection agencies (where applicable), and contractual and business partners such as providers of telephone systems, insurance companies, and telephone support partner agencies

Retention period

Unless a more specific retention period is stated in this privacy policy, we will retain your personal data until the purpose for which it is processed no longer applies. If you submit a valid request for erasure or withdraw your consent to data processing, your data will be erased unless we have other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, erasure will take place once these grounds no longer apply.

Note on data transfer to the USA and other third countries

We use, amongst other things, tools from companies based in the USA or other third countries that do not offer a level of data protection comparable to that of the EU. When these tools are active, your personal data may be transferred to these third countries and processed there. We would like to point out that a level of data protection comparable to that of the EU cannot be guaranteed in these countries. For example, US companies are obliged to disclose personal data to security authorities without you, as the data subject, being able to take legal action against this. It cannot therefore be ruled out that US authorities (e.g. intelligence services) may process, analyse and permanently store your data held on US servers for surveillance purposes. We have no influence over these processing activities.

Data storage and security

All personal data stored on a web server as a result of logging is deleted after 14 months.

Data that we receive via the web form or by email in response to an enquiry about a service is deleted from our database after 1 year and 6 months, unless longer retention is required for reasons of verifiability; in such cases, the name, telephone number and email address are anonymised after 1 year and 6 months. In the ‘Mein Büroservice’ customer area, the data is deleted after 1 year and 6 months. Customer support or statutory retention periods may require longer storage. In lead management

Data that you provide to us in the course of contract fulfilment, or data that we process in connection with your order, is stored for as long as required by the statutory period.

The “Mein Büroservice” login details, as well as call information, reports and master data, are deleted upon termination of the contractual relationship, after 3 years and 4 months. Therefore, as soon as the processed data is no longer required for the performance of the contract, it must be deleted. However, after the contract has ended, it may be necessary to store your personal data in order to comply with contractual or legal obligations. Further storage may take place in individual cases where this is required by law.

Data that you provide to us during the application process will be stored for 2 years.

Log data is stored to improve the quality of our service. Log data contains personal data that is transmitted via applications or interfaces. All log data is deleted after 6 months.

Benefit Partner implements technical and organisational security measures to protect your data from unauthorised access as comprehensively as possible. These can be found in the annex to the data processing agreement. The information you provide is then transmitted in encrypted form using the SSL (Secure Socket Layer) protocol to prevent misuse of the data by third parties. You can recognise this by the fact that the padlock icon in your browser’s status bar is closed and the address bar begins with ‘https’.

Logging

When you visit our website, the web servers automatically and temporarily store, for system security purposes, the connection data of the requesting computer, the pages you visit on our site, the date and duration of your visit, the identification details of the browser and operating system used, and the website from which you visited us. This means that every access to our website and every retrieval of a file stored on this website is logged. The storage serves internal system-related and statistical purposes.

The following are logged:

the page from which the file was requested,
the name of the file retrieved,
the date and time of the request,
the amount of data transferred,
confirmation of successful retrieval,
a description of the type of web browser used,
the IP address of the requesting computer (encrypted).

All personal data stored on a web server as a result of logging in accordance with Article 6(1)(f) of the GDPR will be deleted after 14 months.

Enquiries via web forms or by email

In addition, in accordance with Article 6(1)(b) of the GDPR, we process and store all personal data that you provide to us in the context of email enquiries or enquiries via web forms, such as

Company
Salutation
Full name, title
Address
Email address
Telephone number

to enable us to contact you as requested, to maintain customer relationships and, where applicable, to send you product information. Further personal data is only collected if you provide it voluntarily, as part of an enquiry or registration, to conclude a contract, or via your browser settings. Should we pass on data to external service providers, technical and organisational measures will be taken to ensure that the transfer takes place in accordance with the statutory provisions on data protection. As already mentioned, these can be found in the annex to the data processing agreement. The data you enter is transmitted via a secure https/SSL connection. Your data will be deleted from our database after 1 year and 6 months. Therefore, as soon as the processed data is no longer required, it must be deleted. However, it may be necessary to store your personal data in order to comply with contractual or legal obligations. Further storage may take place in individual cases where this is required by law.

Application form

The purpose of the electronic processing of applicants’ data is to select a candidate suitable for the vacant position. Applicants can apply directly via the Benefit Partner website and upload up to 5 files, such as a CV and cover letter. The following personal data is provided via the application form in accordance with Article 6(1)(a) of the GDPR:

Full name
Address
Telephone number
Email address
CV
Documents

The data will be deleted after 2 years, unless longer retention is required for reasons of verifiability, record-keeping or statutory retention periods. Therefore, as soon as the processed data is no longer required, it must be deleted. However, it may be necessary to store your personal data in order to comply with contractual or statutory obligations. Data may be retained for a longer period in individual cases where this is required by law.

The stored data will be used exclusively for the application process. You may withdraw your consent at any time. To do so, please send us an email to office@xeleo.com.

‘benefit Customer Area’ login area

In order to use the login area, the following data is stored in accordance with Article 6(1)(b) of the GDPR:

full name
email address

Login details will be deleted 3 years and 4 months after the contractual relationship has ended. Therefore, as soon as the processed data is no longer required for the performance of the contract, it must be deleted. However, once the contract has been concluded, it may be necessary to store your personal data in order to comply with contractual or legal obligations. Further storage may take place in individual cases where this is required by law.

Use of personal data – Master data in the login area

For the purposes of contract fulfilment, the following data relating to the client is collected, stored and processed in accordance with Article 6(1)(b) of the GDPR.

Company name
VAT number
Legal form
Salutation
Full name
Address
Email address
Telephone or mobile number
Data protection contact person
Welcome message
Account details
Company contacts with contact details
Comments

Data will only be transferred to third parties in the course of fulfilling the contract. This data will be stored for as long as required by contractual, legal or statutory obligations.

Collection of personal data on behalf of the client

For the purposes of fulfilling the contract and for documentation, the following data is routinely requested from the caller and processed in accordance with Article 6(1)(b) of the GDPR:

Salutation
Title
Full name
Company name
Address
Contact details
Request for a callback
Telephone number
Email address

In addition, any individual information specifically provided by the caller is recorded and processed. This data is transmitted to the client via email, text message or telephone and is processed or stored in the login area.

From the start of the contract, Benefit Partner collects the data requested and defined by the client until further notice.

The processed data will be deleted after 3 years and 4 months. Therefore, as soon as the processed data is no longer required for the performance of the contract, it must be deleted. However, following the conclusion of the contract, it may be necessary to store your personal data in order to comply with contractual or legal obligations. Further storage may take place in individual cases where this is required by law.

If the client uses the lead management system, additional details relevant for further contact are requested. These include, for example:

Interest in products
Consent to further contact by email
Sending information materials
etc.

Following termination of the contract, the data will be deleted after 3 years and 4 months. Therefore, as soon as the processed data is no longer required for the performance of the contract, it must be deleted. However, after the contract has ended, it may be necessary to store your personal data in order to comply with contractual or legal obligations. Further storage may take place in individual cases where this is required by law.

CTI caller identification

The client has the option of uploading all of their contact details as a CSV file via their login area. The following data is recorded for CTI caller identification:

Full name
Company name
Address
Telephone number
etc.

Unless the client deletes the data themselves, it will be automatically deleted 1 year and 3 months after termination of the contract.

Newsletter

You can subscribe to our newsletter via our website. For this, we require:

First name and surname
Email address

Your data will not be disclosed to third parties in connection with the newsletter distribution.

We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you the newsletter once you have confirmed your subscription via the link contained in a confirmation email sent to you for this purpose. This is to ensure that only you, as the owner of the email address provided, can subscribe to the newsletter. Your confirmation must be provided promptly after receiving the confirmation email; otherwise, your newsletter subscription will be automatically deleted from our database.

The processing of your first name, surname and email address for the purpose of sending the newsletter is based, in accordance with Article 6(1)(a) of the GDPR, on the declaration of consent you voluntarily provide below:

Your first name, surname and email address will be stored for as long as you remain subscribed to the newsletter. Once you have unsubscribed from the newsletter, your email address will be deleted. Data may be retained for a longer period in individual cases where this is required by law.

The processing of data relating to your behaviour when viewing the newsletter is based, in accordance with Article 6(1)(a) of the GDPR, on the declaration of consent you voluntarily provide below:

I hereby voluntarily give my consent to the processing of data relating to my behaviour when viewing the newsletter, in particular click behaviour and the opening of specific content, for the purpose of optimising and evaluating the content provided in the newsletter.

You may withdraw this consent at any time with effect for the future by unsubscribing from the newsletter via the link provided in the newsletter. Upon withdrawal, the data stored about you will also be deleted.

As soon as the purpose of the data processing has been fulfilled, the personal data relating to your behaviour when viewing the newsletter will be deleted.

Rapidmail

This website uses Rapidmail to send newsletters. The provider is rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg i.Br., Germany.

Rapidmail is a service that can be used, among other things, to organise and analyse the sending of newsletters. The data you enter for the purpose of subscribing to the newsletter is stored on Rapidmail’s servers in Germany.

Data analysis by Rapidmail

For analysis purposes, emails sent via Rapidmail contain a so-called tracking pixel, which connects to Rapidmail’s servers when the email is opened. This enables us to determine whether a newsletter message has been opened.

Furthermore, with the help of Rapidmail, we can determine whether links in the newsletter message have been clicked and, if so, which ones. All links in the email are so-called tracking links, which allow your clicks to be counted. If you do not wish to be subject to analysis by Rapidmail, you must unsubscribe from the newsletter. We provide a corresponding link for this purpose in every newsletter message.

For further details on Rapidmail’s analytics functions, please refer to the following link: https://de.rapidmail.wiki/kategorien/statistiken/.

Legal basis

Data processing is carried out on the basis of your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw this consent at any time. The lawfulness of any data processing operations already carried out remains unaffected by this withdrawal.

Retention period

The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us or by the newsletter service provider until you unsubscribe from the newsletter. Once you have unsubscribed, this data will be deleted from the newsletter distribution list. Data stored by us for other purposes remains unaffected by this.

After you unsubscribe from the newsletter distribution list, your email address may be stored on a blacklist by us or by the newsletter service provider, where this is necessary to prevent future mailings. The data from the blacklist is used solely for this purpose and is not combined with other data. This serves both your interest and our interest in complying with the legal requirements for sending newsletters, which constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Storage in the blacklist is not limited in time. You may object to this storage where your interests outweigh our legitimate interest.

For further details, please refer to Rapidmail’s data security information at: https://www.rapidmail.de/datensicherheit.

Data processing agreement

We have entered into a data processing agreement (DPA) with the aforementioned provider. This is a contract required under data protection law, which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Our website uses so-called ‘cookies’. Cookies are small text files and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or your web browser deletes them automatically.

In some cases, cookies from third-party companies may also be stored on your device when you visit our website (third-party cookies). These enable us or you to use certain services provided by the third-party company, such as cookies for processing payment services.

Cookies serve various purposes. Many cookies are technically necessary, as certain website functions would not work without them, such as the shopping basket function or the display of videos. Other cookies are used to analyse user behaviour or to display advertising.

Cookies that are required to carry out the electronic communication process, to provide certain functions you have requested, such as the shopping basket function, or to optimise the website, such as cookies for measuring website traffic, are stored on the basis of Article 6(1)(f) of the GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to ensure the technically error-free and optimised provision of its services.

Where consent has been requested for the storage of cookies and similar identification technologies, processing takes place exclusively on the basis of this consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG. Consent may be withdrawn at any time.

You can configure your browser so that you are notified when cookies are set and can allow cookies only on a case-by-case basis, block the acceptance of cookies in specific cases or generally, and enable the automatic deletion of cookies when you close your browser. If cookies are disabled, the functionality of this website may be restricted.

Where cookies from third parties or for analytical purposes are used, we will inform you of this separately in this privacy policy and, where necessary, request your consent.

Server log files

The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. This includes:

Browser type and browser version
Operating system used
Referrer URL
Hostname of the accessing computer
Time of the server request
IP address

This data is not combined with other data sources.

The collection of this data is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in the technically error-free display and optimisation of its website; for this purpose, server log files must be collected.

Contact form

If you send us enquiries via the contact form, the information you provide in the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing your enquiry and in the event of any follow-up questions. We will not disclose this data without your consent.

The processing of this data is based on Article 6(1)(b) of the GDPR, if your enquiry relates to the performance of a contract or is necessary in order to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us in accordance with Article 6(1)(f) of the GDPR, or on your consent in accordance with Article 6(1)(a) of the GDPR, where such consent has been requested. Consent may be withdrawn at any time.

The data you enter in the contact form will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies, for example once your enquiry has been fully processed. Mandatory legal provisions, in particular retention periods, remain unaffected.

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, your enquiry, including all personal data arising from it, such as your name and enquiry, will be stored and processed by us for the purpose of dealing with your request. We will not disclose this data without your consent.

The data you send to us via contact enquiries will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your enquiry has been dealt with). Mandatory legal provisions – in particular statutory retention periods – remain unaffected.

3. Social media

Data processing by social networks

We maintain publicly accessible profiles on social networks. You can find details of the specific social networks we use below.

Social networks such as Facebook, Twitter, etc. can generally analyse your user behaviour in detail when you visit their website or a website featuring integrated social media content (e.g. ‘Like’ buttons or advertising banners). Visiting our social media pages triggers numerous data processing operations relevant to data protection. Specifically:

If you are logged into your social media account and visit our social media presence, the operator of the social media portal may associate this visit with your user account. However, your personal data may also be collected even if you are not logged in or do not have an account with the relevant social media portal. In this case, data is collected, for example, via cookies stored on your device or by recording your IP address.

Using the data collected in this way, the operators of the social media platforms can create user profiles that record your preferences and interests. In this way, interest-based advertising may be displayed to you both on and off the respective social media platform. If you have an account with the relevant social network, interest-based advertising may be displayed on all devices on which you are logged in or have previously been logged in.

Please also note that we cannot track all data processing activities on social media platforms. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media platforms. For further details, please refer to the terms of use and privacy policies of the respective social media platforms.

Legal basis

Our social media presence is intended to ensure the most comprehensive online presence possible. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. The analysis processes initiated by the social networks may be based on different legal grounds, which must be specified by the operators of the social networks (e.g. consent within the meaning of Article 6(1)(a) of the GDPR).

Data controller and exercising your rights

When you visit one of our social media pages (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered by that visit. You may, in principle, exercise your rights (right of access, rectification, erasure, restriction of processing, data portability and the right to lodge a complaint) both against us and against the operator of the relevant social media portal (e.g. against Facebook).

Please note that, despite our joint responsibility with the social media platform operators, we do not have full control over the data processing activities carried out by the social media platforms. Our options are largely determined by the corporate policy of the respective provider.

Retention period

Data collected directly by us via our social media presence will be deleted from our systems as soon as you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory legal provisions – in particular retention periods – remain unaffected.

We have no influence over the retention period of your data stored by the operators of social networks for their own purposes. For further details, please contact the operators of the social networks directly (e.g. in their privacy policy, see below).

Social networks in detail

This website uses elements from the LinkedIn network. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. 

Every time you access a page on this website that contains LinkedIn elements, a connection is established with LinkedIn’s servers. LinkedIn is informed that you have visited this website using your IP address. If you click on the LinkedIn ‘Recommend’ button whilst logged into your LinkedIn account, LinkedIn is able to associate your visit to this website with you and your user account. Please note that, as the provider of these pages, we have no knowledge of the content of the data transmitted or of its use by LinkedIn. 

Where consent has been obtained, the use of the aforementioned service is based on Article 6(1)(a) of the GDPR and Section 25 of the TTDSG. Consent may be withdrawn at any time. Where no consent has been obtained, the use of the service is based on our legitimate interest in achieving the widest possible visibility on social media. 

Data transfers to the USA are based on the EU Commission’s Standard Contractual Clauses. Details can be found here: https://www.linkedin.com/help/linkedin/answer/62538/datenubertragung-aus-der-eu-dem-ewr-und-der-schweiz?lang=de

Further information on this can be found in LinkedIn’s privacy policy at: https://www.linkedin.com/legal/privacy-policy. 

XING

This website uses elements from the XING network. The provider is New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany. 

Every time one of our pages containing XING elements is accessed, a connection is established with XING’s servers. To the best of our knowledge, no personal data is stored in the process. In particular, no IP addresses are stored and no usage behaviour is analysed. 

Where consent has been obtained, the use of the aforementioned service is based on Article 6(1)(a) of the GDPR and Section 25 of the TTDSG. Consent may be withdrawn at any time. Where no consent has been obtained, the service is used on the basis of our legitimate interest in achieving the widest possible visibility on social media. 

Further information on data protection and the XING Share button can be found in XING’s privacy policy at: https://www.xing.com/app/share?op=data_protection. 

Facebook

We have a profile on Facebook. The provider of this service is Facebook Ireland Limited, 4

Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. According to

Facebook, the data collected is also transferred to the USA and other third countries.

We have entered into a joint processing agreement (Controller Addendum) with Facebook. This agreement sets out which data processing operations we and Facebook are responsible for when you visit our Facebook page. You can view this agreement via the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

You can adjust your advertising settings yourself in your user account. To do so, click on the following link and log in: https://www.facebook.com/settings?tab=ads.

Data transfers to the USA are based on the EU Commission’s Standard Contractual Clauses. Further details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

For further details, please refer to Facebook’s privacy policy: https://www.facebook.com/about/privacy/.

Instagram

We have a profile on Instagram. The provider is Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses. Further details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://help.instagram.com/519522125107875 and https://de-de.facebook.com/help/566994660333381.

For details on how Instagram handles your personal data, please refer to Instagram’s privacy policy: https://help.instagram.com/519522125107875.

4. Analytics tools and advertising

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that enables us to integrate tracking or analytics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies or carry out independent analyses. It serves solely to manage and deploy the tools integrated via it. However, Google Tag Manager records your IP address, which may also be transferred to Google’s parent company in the United States.

The use of Google Tag Manager is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in the quick and straightforward integration and management of various tools on its website. Where consent has been sought, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent may be withdrawn at any time.

Google Analytics

This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, time spent on the site, operating systems used and the user’s origin. This data is associated with the user’s respective device. No association is made with a device ID.

Furthermore, Google Analytics enables us, among other things, to record your mouse and scroll movements and clicks. Google Analytics also uses various modelling approaches to supplement the collected data sets and employs machine learning technologies in its data analysis.

Google Analytics uses technologies that enable the user to be recognised for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google regarding the use of this website is generally transmitted to a Google server in the USA and stored there.

The use of this service is based on your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG. You may withdraw your consent at any time.

Data transfers to the USA are based on the EU Commission’s Standard Contractual Clauses. Further details can be found here:

https://privacy.google.com/businesses/controllerterms/mccs/.

IP anonymisation

We have enabled the IP anonymisation feature on this website. This means that your IP address is truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services relating to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google. 

Browser plug-in

You can prevent the collection and processing of your data by Google by downloading and installing the browser plug-in available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

Further information on how Google Analytics handles user data can be found in Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

Google Signals

We use Google Signals. When you visit our website, Google Analytics collects, amongst other things, your location, search history and YouTube history, as well as demographic data (visitor data). This data may be used for personalised advertising via Google Signals. If you have a Google account, the visitor data from Google Signals will be linked to your Google account and used for personalised advertising. The data is also used to compile anonymised statistics on our users’ behaviour.

Demographic Features in Google Analytics

This website uses the ‘demographic features’ function of Google Analytics to display relevant adverts to website visitors within the Google advertising network. This enables the creation of reports containing information on the age, gender and interests of site visitors. This data is derived from Google’s interest-based advertising and from visitor data provided by third parties. This data cannot be attributed to any specific individual. You can disable this feature at any time via the ad settings in your Google Account, or generally prevent Google Analytics from collecting your data as described in the section ‘Objecting to data collection’.

Data processing on behalf of the Controller

We have entered into a data processing agreement with Google and fully comply with the strict requirements of the Austrian data protection authorities when using Google Analytics.

Google Analytics E-Commerce Tracking

This website uses the ‘E-commerce Tracking’ feature of Google Analytics. E-commerce measurement enables the website operator to analyse the purchasing behaviour of website visitors in order to improve their online marketing campaigns. This involves collecting information such as orders placed, average order values, delivery costs and the time taken from viewing a product to purchasing it. This data may be aggregated by Google under a transaction ID assigned to the respective user or their device.

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising programme provided by Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display adverts in the Google search engine or on third-party websites when a user enters specific search terms into Google (keyword targeting). Furthermore, targeted adverts can be displayed based on user data held by Google (e.g. location data and interests) (audience targeting). As the website operator, we can evaluate this data quantitatively, for example by analysing which search terms led to our adverts being displayed and how many adverts resulted in corresponding clicks.

The use of this service is based on your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG. Consent may be withdrawn at any time.

Data transfers to the USA are based on the EU Commission’s Standard Contractual Clauses. Further details can be found here:
https://policies.google.com/privacy/frameworks und https://privacy.google.com/businesses/controllerterms/mccs/.

Google Remarketing

This website uses the features of Google Analytics Remarketing. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Remarketing analyses your user behaviour on our website (e.g. clicking on specific products) in order to categorise you into specific advertising target groups and subsequently display relevant advertising messages to you when you visit other online sites (remarketing or retargeting).

Furthermore, the advertising target groups created using Google Remarketing can be linked to Google’s cross-device functions. In this way, interest-based, personalised advertising messages – which have been tailored to you based on your previous usage and browsing behaviour on one device (e.g. a mobile phone) – can also be displayed on another of your devices (e.g. a tablet or PC).

If you have a Google account, you can opt out of personalised advertising via the following link:  https://www.google.com/settings/ads/onweb/.

Use of this service is based on your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG. You may withdraw your consent at any time.

Further information and Google’s privacy policy can be found at: https://policies.google.com/technologies/ads?hl=de.

Target group creation using customer matching

For target group creation, we use, amongst other things, Google Remarketing’s customer matching feature. In doing so, we transfer certain customer data (e.g. email addresses) from our customer lists to Google. If the customers in question are Google users and are logged into their Google account, relevant advertising messages will be displayed to them within the Google network (e.g. on YouTube, Gmail or in the search engine).

Google Conversion Tracking

This website uses Google Conversion Tracking. The provider is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google Conversion Tracking, we and Google can determine whether the user has carried out certain actions. For example, we can analyse which buttons on our website are clicked and how often, and which products have been viewed or purchased particularly frequently. This information is used to compile conversion statistics. We are informed of the total number of users who have clicked on our adverts and the actions they have taken. We do not receive any information that would allow us to personally identify the user. Google itself uses cookies or similar recognition technologies for identification purposes.

The use of this service is based on your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG. You may withdraw your consent at any time.

Further information on Google Conversion Tracking can be found in Google’s Privacy Policy:
https://policies.google.com/privacy?hl=de.

Facebook Pixel

This website uses Facebook’s visitor action pixels to measure conversions. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the data collected is also transferred to the USA and other third countries.

This allows the behaviour of website visitors to be tracked after they have been redirected to the provider’s website by clicking on a Facebook advert. This enables the effectiveness of Facebook adverts to be analysed for statistical and market research purposes, and future advertising campaigns to be optimised.

The data collected is anonymous to us as the operators of this website; we cannot draw any conclusions about the identity of users. However, the data is stored and processed by Facebook, meaning that a link to the respective user profile is possible and Facebook can use the data for its own advertising purposes, in accordance with Facebook’s Data Use Policy. This enables Facebook to display advertisements on Facebook pages as well as outside of Facebook. As the website operator, we have no influence over this use of the data.

Use of this service is based on your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG. You may withdraw your consent at any time.

The transfer of data to the USA is based on the EU Commission’s Standard Contractual Clauses. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

Insofar as personal data is collected on our website using the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are jointly responsible for this data processing (Article 26 of the GDPR). This joint responsibility is limited exclusively to the collection of the data and its transfer to Facebook. The processing carried out by Facebook following the transfer is not part of the joint responsibility. The obligations incumbent upon us jointly have been set out in a joint processing agreement. The text of the agreement can be found at: https://www.facebook.com/legal/controller_addendum.

Under this agreement, we are responsible for providing data protection information regarding the use of the Facebook tool and for ensuring that the tool is implemented on our website in a manner that complies with data protection law. Facebook is responsible for the data security of Facebook products. You may exercise your data subject rights (e.g. requests for access) regarding the data processed by Facebook directly with Facebook. If you exercise your data subject rights with us, we are obliged to forward these to Facebook.

You can find further information on the protection of your privacy in Facebook’s privacy policy: https://de-de.facebook.com/about/privacy/.

You can also disable the ‘Custom Audiences’ remarketing feature in the ad settings section at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. To do this, you must be logged in to Facebook.

If you do not have a Facebook account, you can disable behaviour-based advertising from Facebook on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/.

Facebook Custom Audiences

We use Facebook Custom Audiences. This service is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

When you visit or use our websites and apps, make use of our free or paid services, submit data to us, or interact with our company’s Facebook content, we collect your personal data in the process. If you give us your consent to use Facebook Custom Audiences, we will transfer this data to Facebook, enabling Facebook to display relevant adverts to you. Furthermore, your data may be used to define target groups (Lookalike Audiences).

Facebook processes this data as our data processor. Further details can be found in Facebook’s Terms of Service:

https://www.facebook.com/legal/terms/customaudience.

The use of this service is based on your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG. You may withdraw your consent at any time.

The transfer of data to the USA is based on the EU Commission’s Standard Contractual Clauses. Further details can be found here:
https://www.facebook.com/legal/terms/customaudience and https://www.facebook.com/legal/terms/dataprocessing.

LinkedIn Insight Tag

This website uses the LinkedIn Insight Tag. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

Data processing via the LinkedIn Insight Tag

The LinkedIn Insight Tag enables us to obtain information about visitors to our website. If a website visitor is registered with LinkedIn, we can analyse, amongst other things, their key professional details (e.g. career level, company size, country, location, industry and job title) and thus better tailor our site to the respective target groups. Furthermore, with the help of LinkedIn Insight Tags, we can measure whether visitors to our web pages make a purchase or take any other action (conversion tracking). Conversion tracking can also be carried out across devices (e.g. from a PC to a tablet). LinkedIn Insight Tag also offers a retargeting function, which enables us to display targeted advertising to our website visitors outside the website; according to LinkedIn, this does not involve the identification of the advertising recipient.

LinkedIn itself also collects so-called log files (URL, referrer URL, IP address, device and browser properties, and time of access). IP addresses are truncated or (where used to reach LinkedIn members across devices) hashed (pseudonymised). The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymised data is then deleted within 180 days.

As the website operator, we are unable to link the data collected by LinkedIn to specific individuals. LinkedIn will store the personal data collected from website visitors on its servers in the USA and use it for its own advertising purposes. For further details, please refer to LinkedIn’s privacy policy at https://www.linkedin.com/legal/privacy-policy#choices-oblig.

Legal basis

Where consent has been obtained, the use of the aforementioned service is based exclusively on Article 6(1)(a) of the GDPR and Section 25 of the TTDSG. Consent may be withdrawn at any time. Where no consent has been obtained, the use of this service is based on Article 6(1)(f) of the GDPR; the website operator has a legitimate interest in effective advertising measures, including those on social media.

Data transfers to the USA are based on the EU Commission’s Standard Contractual Clauses. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

Objecting to the use of the LinkedIn Insight Tag

You can object to the analysis of usage behaviour and targeted advertising by LinkedIn via the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Furthermore, LinkedIn members can control the use of their personal data for advertising purposes in their account settings. To prevent LinkedIn from linking data collected on our website to your LinkedIn account, you must log out of your LinkedIn account before visiting our website.

Data processing agreement

We have entered into a data processing agreement with the provider mentioned above. This is a contract required under data protection law, which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

5. Plugins and Tools

YouTube with enhanced privacy mode

This website embeds YouTube videos. The operator of the site is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

We use YouTube in enhanced privacy mode. According to YouTube, this mode ensures that YouTube does not store any information about visitors to this website before they watch the video. However, the enhanced privacy mode does not necessarily prevent data from being shared with YouTube partners. For example, YouTube establishes a connection to the Google DoubleClick network regardless of whether you watch a video or not.

As soon as you play a YouTube video on this website, a connection is established with YouTube’s servers. In doing so, the YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you allow YouTube to link your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.

Furthermore, after you start a video, YouTube may store various cookies on your device or use similar recognition technologies (e.g. device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, amongst other things, to collect video statistics, improve user-friendliness and prevent fraud.

Where applicable, further data processing operations may be triggered after a YouTube video has been played, over which we have no control.

The use of YouTube is in the interest of presenting our online services in an appealing manner. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Where consent has been sought, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent may be withdrawn at any time.

Further information on data protection at YouTube can be found in their privacy policy at: https://policies.google.com/privacy?hl=de.

Google Web Fonts (locally hosted)

This website uses so-called web fonts provided by Google to ensure a consistent display of fonts. The Google Fonts are installed locally. No connection is made to Google’s servers.

Further information on Google Web Fonts can be found at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Font Awesome (locally hosted)

This site uses Font Awesome to ensure consistent font display. Font Awesome is installed locally. No connection is made to servers operated by Fonticons, Inc.

Further information on Font Awesome can be found in the Font Awesome privacy policy at: https://fontawesome.com/privacy.

Google Maps

This site uses the Google Maps mapping service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

In order to use the features of Google Maps, it is necessary to store your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this website has no influence over this data transfer. When Google Maps is enabled, Google may use Google Web Fonts to ensure consistent font display.

When you access Google Maps, your browser loads the required web fonts into its cache to display text and fonts correctly.

The use of Google Maps is in the interest of presenting our online services in an appealing manner and ensuring that the locations specified on our website can be easily found. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Where consent has been sought, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent may be withdrawn at any time.

Data transfers to the USA are based on the EU Commission’s Standard Contractual Clauses. Further details can be found here:

https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

Further information on the handling of user data can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Social Plug-Ins

Facebook, Google+, Twitter, Instagram, Xing, LinkedIn

Our website uses so-called social plugins (“plugins”) from the social networks Facebook and Google+, Xing, LinkedIn, and the microblogging services Twitter and Instagram. These services are provided by Facebook Inc., Google Inc., Xing SE, LinkedIn Corporation, Twitter Inc. and Instagram LLC (“providers”).

Facebook is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). An overview of Facebook’s plugins and their appearance can be found here: https://developers.facebook.com/docs/plugins Google+ is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). An overview of Google’s plugins and their appearance can be found here: https://developers.google.com/+/web/ Xing is operated by XING SE, Dammtorstraße 30, 20354 Hamburg, Germany. An overview of Xing’s plugins can be found here: https://dev.xing.com/plugins LinkedIn is operated by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. An overview of LinkedIn’s plugins can be found here: https://legal.linkedin.com/plugin-terms-of-use Twitter is operated by Twitter Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, USA (“Twitter”). An overview of the Twitter buttons and their appearance can be found here: https://about.twitter.com/en_us/company/brand-resources.html Instagram is operated by Instagram LLC, 1601 Willow Road, Menlo Park, CA 94025, USA (“Instagram”). An overview of the Instagram buttons and their appearance can be found here: http://blog.instagram.com/post/36222022872/introducing-instagram-badges

Activating the respective social plugin is a two-step process. To activate a social plugin, you must first click on the link on our website. This initially activates the social plugin and your browser establishes a connection to the respective provider’s servers. With a second click, you can then interact with the social plugin and, for example, submit your recommendation. The content of the plugin is transmitted directly from the relevant provider to your browser and integrated into the page. By integrating the plugins, the providers receive information that your browser has accessed the relevant page of our website, even if you do not have a profile or are not currently logged in. This information (including your IP address) is transmitted directly from your browser to a server belonging to the relevant provider in the USA and stored there.

If you are logged in to one of these services, the providers can directly associate your visit to our website with your profile on Facebook, Google+, Twitter, Xing, LinkedIn or Instagram. If you interact with the plugins – for example, by clicking the ‘Like’, ‘+1’, ‘Tweet’ or ‘Instagram’ button – the relevant information is also transmitted directly to a server operated by the respective provider and stored there. The information is also published on the social network, on your Twitter or Instagram account, and displayed there to your contacts.

For details of the purpose and scope of data collection, as well as the further processing and use of the data by the providers, and your rights in this regard and the settings available to protect your privacy, please refer to the providers’ privacy policies.

Facebook’s privacy policy: http://www.facebook.com/policy.php Google’s privacy policy: http://www.google.com/intl/de/+/policy/+1button.html Twitter’s privacy policy: https://twitter.com/privacy Xing’s privacy policy: https://www.xing.com/privacy  LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.

Instagram’s privacy policy: https://help.instagram.com/155833707900388/

If you do not wish Google, Facebook, Twitter, Xing, LinkedIn or Instagram to directly link the data collected via our website to your profile on the respective service, you must log out of the relevant service before visiting our website. You can also completely prevent the plugins from loading by using add-ons for your browser, e.g. the script blocker ‘NoScript’ (http://noscript.net/).

Legal basis

Data transfers to the USA are based on the EU Commission’s Standard Contractual Clauses. Further details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs. 

Objecting to the use of the LinkedIn Insight Tag 

You can object to the analysis of usage behaviour and targeted advertising by LinkedIn via the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. 

Data Processing

We have entered into a Data Processing Agreement (DPA) with the provider mentioned above. This is a contract required under data protection law, which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR. 

6. Audio and video conferences

Data Processing

We use online conferencing tools, amongst other means, to communicate with our customers. The specific tools we use are listed below. When you communicate with us via video or audio conference over the internet, your personal data is collected and processed by us and by the provider of the relevant conferencing tool.

The conferencing tools collect all data that you provide or use in order to utilise the tools (email address and/or your telephone number). Furthermore, the conferencing tools process the duration of the conference, the start and end times of your participation in the conference, the number of participants and other

‘contextual information’ relating to the communication process (metadata).

Furthermore, the tool provider processes all technical data required to facilitate online communication. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speakers, and the type of connection.

Where content is exchanged, uploaded or otherwise made available within the tool, this is also stored on the tool provider’s servers. Such content includes, in particular, cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared whilst using the service.

Please note that we do not have full control over the data processing operations carried out by the tools used. Our options depend largely on the corporate policy of the respective provider. Further information on data processing by the conferencing tools can be found in the privacy policies of the respective tools, which we have listed below this text.

Purpose and legal basis

The conferencing tools are used to communicate with prospective or existing contractual partners or to offer specific services to our customers (Article 6(1)(b) of the GDPR). Furthermore, the use of these tools serves to generally simplify and speed up communication with us or our company (legitimate interest within the meaning of Article 6(1)(f) of the GDPR). Where consent has been sought, the use of the relevant tools is based on this consent; consent may be withdrawn at any time with future effect.

Retention period

Data collected directly by us via the video and conferencing tools will be deleted from our systems as soon as you request us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory statutory retention periods remain unaffected.

We have no control over how long your data is stored by the operators of the conferencing tools for their own purposes. For further details, please contact the operators of the conferencing tools directly.

Conferencing tools used

We use the following conferencing tools:

Microsoft Teams

We use Microsoft Teams. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. For details on data processing, please refer to the Microsoft Teams privacy policy: https://privacy.microsoft.com/de-de/privacystatement.

Data processing on behalf of the controller

7. Our own services

Handling of applicant data

We offer you the opportunity to apply for a job with us (e.g. by email, post or via the online application form). Below, we provide information on the scope, purpose and use of your personal data collected as part of the application process. We assure you that the collection, processing and use of your data are carried out in accordance with applicable data protection law and all other statutory provisions, and that your data will be treated as strictly confidential.

Scope and purpose of data collection

When you submit an application to us, we process your associated personal data (e.g. contact and communication details, application documents, notes taken during interviews, etc.) to the extent necessary to decide whether to enter into an employment relationship. The legal basis for this is Section 26 of the German Federal Data Protection Act (BDSG) (initiation of an employment relationship), Article 6(1)(b) of the General Data Protection Regulation (GDPR) (general pre-contractual measures) and – provided you have given your consent – Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time. Your personal data will be disclosed within our company exclusively to those persons involved in processing your application.

If your application is successful, the data you have submitted will be stored in our data processing systems on the basis of Section 26 of the BDSG and Article 6(1)(b) of the GDPR for the purpose of carrying out the employment relationship.

Data retention period

If we are unable to make you a job offer, if you decline a job offer or if you withdraw your application, we reserve the right to retain the data you have provided for up to 2 years from the end of the application process (rejection or withdrawal of the application) on the basis of our legitimate interests (Article 6(1)(f) of the GDPR). The data will then be deleted and the physical application documents destroyed. The retention of data serves, in particular, as evidence in the event of a legal dispute. If it becomes apparent that the data will be required after the expiry of the six-month period (e.g. due to an impending or pending legal dispute), the data will not be deleted until the purpose for its continued retention no longer applies.

Data may also be retained for a longer period if you have given your consent (Article 6(1)(a) of the GDPR) or if statutory retention obligations prevent the data from being deleted.

Inclusion in the candidate pool

If we do not make you a job offer, there may be the option of adding you to our candidate pool. If you are included, all documents and details from your application will be transferred to the candidate pool so that we can contact you should suitable vacancies arise.

Inclusion in the candidate pool is based solely on your explicit consent (Article 6(1)(a) of the GDPR). Giving your consent is voluntary and is not linked to the current application process. The data subject may withdraw their consent at any time. In this case, the data will be irrevocably deleted from the candidate pool, provided there are no legal grounds for retention.

The data in the candidate pool will be irrevocably deleted no later than two years after consent is given.

8. Your rights

You are generally entitled to the rights of access, rectification, restriction of processing, erasure, data portability and withdrawal of consent.

Data subjects, e.g. callers who do not have a direct customer relationship with Benefit Partner, should first contact the client. The client is the party that has commissioned Benefit Partner to carry out the data processing. If the client submits a request for access to data to Benefit Partner, Benefit Partner will charge the controller €120 per hour for the time spent handling this request. The data will be transferred to the client within the statutory time limit.

Right of access

In accordance with Article 15 of the GDPR, Benefit Büroservice GmbH must provide information to any data subject who requests confirmation as to whether their personal data is being processed. Where necessary, the data subject may be required to prove their identity in an appropriate manner.

Rectification and erasure

In accordance with Article 16 of the GDPR, you, as a data subject, have the right to request the rectification of any inaccurate personal data concerning you without undue delay, or, taking into account the purposes of the data processing, to request that incomplete personal data be completed.

In accordance with Article 17 of the GDPR, you may request the erasure of your personal data stored by us, provided that the processing is not necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

Restriction

In accordance with Article 18 of the GDPR, you may request the restriction of the processing of your personal data where you contest the accuracy of the data, the processing is unlawful, we no longer require the data and you object to its erasure because you need it to establish, exercise or defend legal claims. You are also entitled to the right under Article 18 of the GDPR if you have objected to the processing in accordance with Article 21 of the GDPR.

Data portability

Under Article 20 of the GDPR, you have the right to data portability. This is the right to request the unimpeded and unrestricted transfer of personal data collected to a third party.

In accordance with Article 7(3) of the GDPR, you may withdraw your consent at any time by notifying us. As a result, we may no longer continue the data processing based on this consent in future.

If you believe that the processing of your data contravenes data protection law or that your data protection rights have otherwise been infringed, you are welcome to contact the supervisory authority. In Austria, this is the Data Protection Authority. However, you are also welcome to contact us, Benefit Partner GmbH, at any time at office@xeleo.com. Should the erasure be precluded by statutory, contractual or tax-related or commercial retention obligations, or by other legally established grounds, your data may only be blocked rather than erased.

If you have any questions, comments or other enquiries regarding this privacy policy, please contact us at the address given in the legal notice: office@xeleo.com.

Right to object

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right, in accordance with Article 21 of the GDPR, to object to the processing of your personal data, provided there are grounds arising from your particular situation or the objection relates to direct marketing. In the case of direct marketing, you have a general right to object, which we will honour without you needing to specify a particular situation.

Changes to our privacy policy

We reserve the right to amend this privacy policy from time to time to ensure it always complies with current legal requirements or to reflect changes to our services in the privacy policy, e.g. when introducing new services. The new privacy policy will then apply to your next visit.

Questions regarding data protection

You may direct any questions regarding data protection in relation to https://www.xeleo.com at any time to:

Benefit Partner GmbH
For the attention of the Data Protection Officer
Europaplatz 5
3100 St. Pölten
+43 2742/93151
datenschutz@xeleo.com

Links & Downloads

Subcontractors