Below we would like to inform you about our privacy policy. Here you will find information about the collection and use of personal data when using our website. We comply with the data protection law applicable in Germany. You can access this statement on our website at any time.
The Controller within the meaning of the General Data Protection Regulation (GDPR) is:
Offener Prozess gGmbH
Zietenstraße 2a
09130 Chemnitz
E-mail: info@offener-prozess.de
Represented by the managing directors:
Dr. Nora Krzywinski, Esther Gerstenberg
We endeavour to use gender-fair language. In some places, for the sake of simplified reading, we use only the masculine form of terms such as “Benutzer” [user] instead of “Benutzende,” “Benutzer:innen,” or “Benutzerinnen und Benutzer.” Where we use only the masculine form, the term is nevertheless intended to include all genders.
At this point we would like to summarise the general rights you have under the GDPR with regard to your personal data processed by us. For an explanation of the legal terms, please refer to the applicable definitions in the GDPR (see Article 4 there). Should anything remain unclear, please feel free to ask us.
You are entitled to lodge a complaint with a data protection supervisory authority, e.g. the Berlin Data Protection Commissioner, about data protection matters concerning us.
Every form of processing of personal data requires a legal basis that permits us to carry out this processing. The legal basis primarily results from the purpose for which the data is processed. The lawfulness within a given legal basis is generally measured according to the specific scope of the data processing and the measures we have taken to protect your data.
Legal bases for data processing arise from Article 6 paragraph 1 GDPR and, for particularly sensitive data such as health data, from Article 9 paragraph 2 GDPR. Both of these provisions name the preparation or fulfilment of contractual, statutory, or also societal obligations as the most important legal bases for data processing. In addition, many data processing operations take place on the basis of our legitimate interest, provided the interests of the data subjects do not outweigh this with regard to the specific circumstances. Should one of the aforementioned types of legal basis apply, the processing does not require any further consent from you.
In addition, data processing may take place on the basis of your consent (Article 7 GDPR) or, for persons under 16 years of age using information society services (e.g. websites, online games, social media platforms), on the basis of consent given by the children or minors in conjunction with the consent of a parent or legal guardian (Article 8 GDPR).
At this point we expressly point out that none of our online offerings requiring consent are directed at persons under 16 years of age.
In some cases, our obligation to ask for your consent does not arise, or does not arise solely, from the GDPR, but from the Telecommunications-Digital-Services-Data Protection Act (TDDDG) or the Act Against Unfair Competition (UWG). We have taken the obligations arising from these laws into account without explicitly pointing this out in each instance below.
If a data transfer takes place to a state outside the European Economic Area (EEA), we ensure that data protection is safeguarded within the meaning of Articles 44–49 GDPR. Such a transfer to outside the EEA is referred to in data protection law as a transfer to a third country.
Cookies are a specific form of text entries that are stored on your device by your browser when you visit a website. Various types of information can be stored in a cookie. In some cases, a cookie stores only a yes or no (“true” or “false”) or a country code such as “de” for the German language; in other cases, a string of characters is stored that allows a unique identification of the browser when the website is visited again (a so-called cookie ID).
The right to set cookies is not determined solely by the GDPR, but primarily by Section 25 TDDDG. This provision distinguishes between cookies that are strictly necessary (essential) for the operation of the online offering and those that are not. Essential cookies may be set even without consent; non-essential cookies, however, always require consent — even where this is not required under the GDPR (e.g. where a legitimate interest constitutes the legal basis or the data is not personal data).
Before we store non-essential cookies on your device, we ask for your consent in accordance with the requirements of Section 25 TDDDG.
The purpose of each cookie, as well as the legal basis for its use under the GDPR, is set out in the description of the individual data processing operations below.
You have various options available to prevent the acceptance of cookies on your device:
The standard case for many online offerings is that, when you access the offering, you decide via a consent manager which cookies you allow and which you do not. Since we operate our pages without cookies requiring consent, we forgo a consent manager that would be unnecessary for our offerings.
In principle, you can set your browser so that it never accepts cookies. Such a complete exclusion will, in all likelihood, cause you to lose functions that rely on cookies and that you might actually wish to allow, or that are not subject to consent requirements at all.
You can visit websites in your browser’s private mode. Private mode likewise blocks the setting of cookies in your browser’s storage, or automatically deletes all cookies at the end of the session.
Some browsers or browser plug-ins offer you the option of making more differentiated presettings regarding which cookies you generally want to accept by default and which you do not.
A special case: Google offers a browser plug-in that prevents the setting of various Google cookies. You can find the corresponding plug-in here: https://tools.google.com/dlpage/gaoptout?hl=de
6.1 Visiting our websites
6.1.1 Providing our websites
Description: In order for a web server to make our website available to your browser, the server must record technical data about the device, browser, and internet access you use for this purpose. This is referred to as the so-called log file or weblog. This is the same data that you inevitably leave behind on every website you visit. Central to this is the IP address from which you access our pages. The web server sends the data you want to see to this internet address.
Data categories: IP address from which our page was accessed; date and time of access; objects on our website that are accessed in the browser; type and version of the internet browser; type and version of the operating system
Data recipients (transfer to a third country, if applicable): Our hosting service provider, which is obligated to comply with data protection through a data processing agreement. No transfer to a third country takes place as a result. In the event of attacks on our websites, disclosure to forensic experts and investigative authorities commissioned by us. No transfer to a third country takes place here either.
Purpose + legal basis: Provision of our website as well as investigations should unlawful access to our websites occur (e.g. a hacker attack). The legal basis is a legitimate interest, since operating a website without recording the weblog is not possible. In the specific case of an attack on our website, we have a legitimate interest in being able to provide investigators with evidence of how the attack took place.
Storage period: 7 days
6.1.2 Analysis of usage behaviour (Matomo) Description: On our website we use the web analytics service Matomo. On our behalf, Matomo creates statistical reports based on the information collected about activities on our website, the regional origin of visitors, and technical parameters of the devices used to visit our pages.
We have configured Matomo so that IP addresses are only further processed in truncated form, in order to limit direct personal identifiability. Through this IP anonymisation, the end of your IP address is replaced with zeros immediately after collection.
We use Matomo without cookies. However, based on technical parameters of your device and browser, Matomo creates a so-called digital fingerprint of your device as a hash value. This digital fingerprint enables us to track usage paths within our website. Matomo adds an additional value to the hash value (called a salt) and subsequently stores it for only 24 hours. This combination of hash value with salt and short storage period means that we can only recognise your device again within 24 hours. If you return later than 24 hours later, this is, for us, a completely unknown and therefore new visit.
It is also not possible for us to identify a specific person behind the hash value unless you inform us in parallel exactly when and in what way you used our website.
We do not pass on the data from Matomo to any third party. In particular, we do not combine the data with data from advertising networks or use it in any other way for marketing purposes.
In addition to activities on our website, we also use Matomo to document which internet links you click on in our newsletters. Here too, we do not recognise you as a specific person, but can only track which internet links motivate our newsletter recipients to click and which further path you then take via our website.
Further information on Matomo can be found at https://matomo.org/matomo-cloud-privacy-policy/.
Data categories: IP address via which the device goes online, until its immediate anonymisation; location or country derived from the IP address, as well as the internet service provider for internet access; date and time of access; objects on our website that are accessed (clicked on) in the browser; type and version of the internet browser; type and version of the operating system; websites accessed previously and next; digital fingerprint of the device with supplementary random value (salt)
Data recipients (transfer to a third country, if applicable): InnoCraft Ltd, 7 Waterloo Quay PO625, 6140 Wellington, New Zealand. InnoCraft (the operator of Matomo Cloud) is obligated to us to comply with data protection through a data processing agreement pursuant to Article 28 GDPR. The information collected via cookies is transferred to and stored on servers within the EEA, so that technically no transfer to a third country takes place. Legally, the transfer to a third country to InnoCraft as a New Zealand company is safeguarded by the EU’s adequacy decision for New Zealand.
Purpose + legal basis: The purpose of this usage analysis is to enable us to further improve our website based on the analytical insights gained.
The legal basis is a legitimate interest, arising from the fact that the personal reference of the collected data is significantly reduced through the anonymisation of IP addresses and the use of the hash value with salt and short storage period, and the data is not combined by us with other data collections.
Storage period: 24 hours (after which recognisability via the hash value with salt no longer applies)
6.1.3 Bot protection mechanism (Google reCAPTCHA)
Description: With regard to registrations for our newsletter, we use the reCAPTCHA service from Google to check whether you are a human or a so-called bot. reCAPTCHA enables a distinction to be made between human and automated, abusive input. Through the use of the reCAPTCHA service, data about you is transmitted to Google. For this purpose, Google sets the cookies _GRECAPTCHA (expiry: 6 months), AEC (expiry: 6 months), and __Secure-ENID (expiry: 1 year) in your browser’s storage, as well as values for the keys r::a and r::f in your browser’s local storage.
Data processing by reCAPTCHA takes place in accordance with Google’s privacy information: https://policies.google.com/privacy
We do not receive any data from Google about your usage behaviour.
Data categories: IP address from which the page is accessed; date and time of access; type and version of the internet browser; type and version of the operating system; Google IDs stored in cookies and local storage keys, as well as mouse movements in the area of the reCAPTCHA checkbox
Data recipients (transfer to a third country, if applicable): Google LLC, reachable for us as a European organisation via Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. To the extent Google transfers data to third countries, Google guarantees handling of the data at EU data protection level through the conclusion of standard contractual clauses. In addition, the company has certified itself according to the standards of the US-EU Privacy Shield, so that data transfers are covered by the EU Commission’s adequacy decision on data transfers to the USA from July 2023.
Purpose + legal basis: Protection of our newsletter registration against attacks by bots. The legal basis for the data disclosure is a legitimate interest, as there is a strong interest in securing our infrastructure.
Storage period: The storage period lies within Google’s area of responsibility. Deletion of data by us is not necessary, since we do not collect any data from you through the use of reCAPTCHA.
6.1.4 Online fonts (Google Fonts)
Description: To enable an individual design of our website, we use so-called web fonts. Your browser loads these fonts from the internet to display our pages, if the fonts are not already loaded into your browser’s storage from a previous visit to a page using this font.
In principle, fonts are made available directly from our own server. To that extent, this does not constitute a separate processing operation beyond the processing described under “Providing our websites.” In some cases, we access fonts from external servers — in our case, when using the protection mechanisms via Google’s reCAPTCHA technology, which loads fonts from Google (Google Fonts).
For the download of fonts from the Google font servers (gstatic.com), your IP address must be transmitted to Google, as transmission of the data packet would otherwise not be possible. Google does not receive any further data from you in direct connection with the font download.
Data categories: IP address from which your device accesses the internet, timestamp
Data recipients (transfer to a third country, if applicable): Google LLC, reachable for us as a European organisation via Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. To the extent Google transfers data to third countries, Google guarantees handling of the data at EU data protection level through the conclusion of standard contractual clauses. In addition, the company has certified itself according to the standards of the US-EU Privacy Shield, so that data transfers are covered by the EU Commission’s adequacy decision on data transfers to the USA from July 2023.
Purpose + legal basis: Provision of Google Fonts as part of the reCAPTCHA security mechanisms. The legal basis is a legitimate interest, since only the IP address of your device is transmitted as part of the font download, without further references to your use of the internet.
Storage period: The storage period lies within Google’s area of responsibility. Deletion of data by us is not possible, since we do not collect any data from you through the use of Google Fonts.
6.2 Newsletter and contact management
6.2.1 Newsletter registration
Description: You can sign up for our e-mail newsletter. To do so, you only need to provide an e-mail address.
If you register for the newsletter online, an e-mail will be sent to the address you provided, in which we ask you to confirm your registration. This is intended to prevent you from being signed up for our newsletter by someone who does not have, or should not have, access to this address. This two-step procedure is called double opt-in.
By signing up for our newsletter, you consent, both under data protection law and competition law, to us sending you e-mails on the topics described on the registration page.
You can revoke your registration, and thus your consent, for the future at any time. This is possible via the corresponding link at the end of every newsletter we send.
We record the use of our newsletter via so-called tracking pixels and campaign URLs for the internet links in the newsletter. The tracking pixel calls up our newsletter server when you open the e-mail. The clicking of internet links in the newsletter is recorded via campaign attribution in our web analytics (Matomo).
The registration form on our website sets a session cookie (automatically deleted when you close your browser) named __cfruid.
Data categories: E-mail address, documentation of e-mail verification (double opt-in), timestamp of your registration; usage data (opening the e-mail + clicking on internet links)
Data recipients (transfer to a third country, if applicable): Our service provider for newsletter dispatch, which is obligated to comply with data protection through a data processing agreement. No transfer to a third country takes place.
Purpose + legal basis: Provision of an e-mail newsletter and optimisation of our newsletter content. The legal basis is your consent.
Storage period: After you revoke your consent, your data is deleted immediately.
6.2.2 Contact database (CRM)
Description: We maintain your data in a contact database within the meaning of a Customer Relationship Management (CRM) system. In the CRM we store your contact details as well as the history of your customer relationship with us. We also manage communication via newsletter with you through the CRM.
Data categories: Contact details (name, e-mail address, telephone number, address), event participation, newsletter consents
Data recipients (transfer to a third country, if applicable): Our service provider for operating the CRM, which is obligated to comply with data protection through a data processing agreement. No transfer to a third country takes place.
Purpose + legal basis: Use of a CRM system that enables us to provide holistic support for our contacts, from initial contact through event management to newsletter dispatch. The legal basis is a legitimate interest, as the use of the CRM increases the level of service and reduces costs.
Storage period: Until you revoke your newsletter consent or object to the storage of your data.
6.3 Web shop
6.4 Events
6.4.1 Event booking
Description: You can register for events on our website. Depending on the type of event and its organisational requirements, we collect the respectively necessary data via the registration form. We manage event participation via our contact database (CRM).
You will receive confirmation of your booking, and further information about the event as needed, by e-mail.
Data categories: booked event, name of the participating person, name of the booking person, e-mail address, your comments in the free-text field; in addition, data relevant to conducting the event, such as information on food intolerances for events with catering
Data recipients (transfer to a third country, if applicable): Our service provider for operating the CRM, which is obligated to comply with data protection through a data processing agreement. No transfer to a third country takes place.
Purpose + legal basis: Registration for events. The legal basis is the performance of the contract for your event participation.
Storage period: Storage periods depend on the type of funding for the event. For paid events, booking records must be retained for eight years in accordance with tax law. For subsidised events, the documentation obligation arises from the respective requirements of the funding body.
6.4.2 Photo, audio, and video recordings
Description: At events we make photo, audio, and video recordings as needed. The recordings serve, on the one hand, to document our work for organisations that provide financial support for our work, as well as for the academic evaluation accompanying our work. On the other hand, we use recordings for our public relations work via our website, our newsletters, our publications, for press releases, and via our social media channels.
The legal basis to be applied depends on the role of the data subject and is to be distinguished between performance of a contract (applies to presenting and moderating persons), legitimate interest (applies to situations under Section 23 of the Act on Copyright in Works of Fine Art [KUG]), and consent.
For people whose task is to appear publicly on our behalf, such as speakers or moderators engaged by us, the assignment also includes documenting their work for us through corresponding recordings.
For certain situations, Section 23 KUG defines that persons must tolerate photo and video recordings. This concerns persons of contemporary history; persons who are merely incidental to a larger scene; persons participating in assemblies and marches; and cases in which the recordings are incorporated into works of art. For us, recordings that are lawful under Section 23 KUG are recordings that fall under a legitimate interest pursuant to the GDPR. With regard to these recordings, data subjects have a right to object under Article 21 GDPR.
Because consideration for the interests of participants at our events is important to us, we point out, at events where recordings are made, the manner and extent in which recordings will take place. In addition, we endeavour to obtain express consent from those present. Depending on the actual circumstances of the event, we endeavour to establish a system that makes clear to those making the recordings which persons have consented to being recorded and to the use of such recordings and which have not. Such measures may include colour-coded name badges, wristbands, or other types of markings. For online events, such measures also include a reminder before recording begins to deactivate one’s own camera or microphone.
If you find that we are using recordings of you that conflict with your interests, please contact us directly. We will then promptly work to find solutions that take your interests into account.
Data categories: photo; where applicable, the name of the person as part of the file name or photo description
Data recipients (transfer to a third country, if applicable): Depending on the communication channels used, recordings may be passed on to external media. Use by external parties then takes place within the scope of their own press-law and data protection responsibility. When published via our website or our newsletter, our respective hosting service providers gain access to the recordings, but within the protected framework of a data processing agreement.
When we publish recordings via our social media channels as well as via video hosting platforms for embedding on our website, the respective operators gain access to the recordings. Depending on the platform, the handling of the recordings is governed in part by data processing agreements and in part by their terms of use. Also in view of constant technical, economic, and legal change, we cannot reliably predict how the platforms will handle the recordings within the scope of their own use of them and to what extent the recordings will be used to train
models. In this regard, the platforms are obligated to provide information under the European Union’s AI legislation.
A transfer to a third country is conceivable when using international social media and streaming platforms. This usually involves transfers to the USA, which fall under the corresponding adequacy decision of the EU Commission. In this respect, we refer to the information on our social media profiles and video hosting elsewhere in this privacy policy.
Purpose + legal basis: The creation, storage, and publication of photo, audio, and video recordings serves both to document our work for funders and research and to support the public relations work essential to our type of work.
The legal basis, depending on the role of the person recorded and the type of recording, is performance of a contract, legitimate interest, or consent. See the explanations in the description of this processing activity.
Storage period:
We store recordings for which we have consent until the consent is revoked or until the consent ceases to be effective due to the passage of time. For recordings that fall under a legitimate interest or performance of a contract, we regularly review whether the interest in publication still exists. Recordings that we have uploaded to platforms are deleted as needed, to the extent the platforms allow us to delete them.
6.5 Our social media profiles
6.5.1 Facebook and Instagram
Description: We operate business profiles (also called fan pages) on Facebook and Instagram. Such a fan page enables us to present our organisation on Facebook and Instagram, to get in contact with you on this social media platform, and to draw attention to our services and offerings through advertisements on these platforms.
Meta provides us with analytical data on the use of our fan page (called Page Insights). This gives us an impression of how successful our individual communication measures are.
For details of data processing by Meta, Meta’s privacy information applies: https://www.facebook.com/about/privacy
In accordance with a ruling of the European Court of Justice, the use of this analytical data takes place under joint controllership with Meta pursuant to Article 26 GDPR. Meta has accordingly made available an agreement on joint controllership (https://www.facebook.com/legal/terms/page_controller_addendum). In this agreement, Meta has assumed sole responsibility for all questions relating to data processing. If you wish to exercise your rights under the GDPR with regard to the data processed in Page Insights, you should contact Meta directly via your Meta account. In accordance with the statutory rules on joint controllership, however, you are also free to direct your request to us. We would then forward your request to Meta.
Data categories: Meta username; comments, likes, and page views within Facebook and Instagram, as well as the time of the action
Data recipients (transfer to a third country, if applicable): Meta Platforms Inc., reachable for us as a European organisation via Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Meta guarantees handling of the data at EU data protection level through the conclusion of standard contractual clauses. In addition, the company has certified itself according to the standards of the US-EU Privacy Shield, so that data transfers are covered by the EU Commission’s adequacy decision on data transfers to the USA from July 2023.
Purpose + legal basis: Analysis of usage behaviour on our fan page and Instagram profile respectively. The legal basis is the consent you gave as part of your Meta registration.
Storage period: The storage period lies within Meta’s area of responsibility.
6.5.2 LinkedIn
Description: We operate a business profile on LinkedIn. Such a LinkedIn profile enables us to present our organisation on LinkedIn, to get in contact with you on this social media platform, and to draw attention to our services and offerings through advertisements on this platform.
LinkedIn provides us with analytical data on the use of our profile page. This gives us an impression of how successful our individual communication measures are.
For details of data processing by LinkedIn, LinkedIn’s privacy information applies: https://www.linkedin.com/legal/privacy-policy
Data categories: LinkedIn username; comments, likes, and page views within LinkedIn, as well as the time of the action
Data recipients (transfer to a third country, if applicable): LinkedIn Corp., reachable for us as a European organisation via LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn guarantees handling of the data at EU data protection level through the conclusion of standard contractual clauses. In addition, the company has certified itself according to the standards of the US-EU Privacy Shield, so that data transfers are covered by the EU Commission’s adequacy decision on data transfers to the USA from July 2023.
Purpose + legal basis: Analysis of usage behaviour on our LinkedIn profile. The legal basis is the consent you gave as part of your LinkedIn registration. Storage period: The storage period lies within LinkedIn’s area of responsibility.
6.6 Suppliers and service providers
6.6.1 Business relationship
Description: We process personal data, as a customer, from our suppliers and service providers who are self-employed individuals or partnerships, or from our contacts at such organisations, in order to be able to communicate with you about the handling of the order. In addition to substantive communication, your data is typically also processed within the separately described processing operations of our “General infrastructure” (see there).
Data categories: Contact, contract, and invoice data
Data recipients (transfer to a third country, if applicable): Tax advisors, auditors, lawyers in their capacity as professionals bound by professional secrecy.
Purpose + legal basis: Proper business management. The legal bases are performance of a contract as well as statutory obligations and legitimate interests.
Storage period: Invoice data must be retained for 10 years in accordance with tax law; contract data must be retained for varying periods depending on the type of contract. For copyrights, such periods can extend up to 70 years beyond the death of the author.
6.6.2 Attribution in publications
Description: In publications we publish, we name authors by name in accordance with the authors’ right to attribution. This attribution also extends to accompanying marketing and public relations work. Where authors represent an institution relevant to the publication, the affiliation with this institution is also named. For some publications, as a service to readers, the professional contact details of the authors are also published.
Data categories: Name, academic titles; in some cases institution and professional contact details
Data recipients (transfer to a third country, if applicable): none
Purpose + legal basis: Identification of authorship. The legal basis for the name is performance of the author’s contract. For the contact details, the legal basis is a legitimate interest, as only professional contact details for subject-relevant contacts are published here.
Storage period: After delivery of printed publications, subsequent deletion by us is not possible.
6.7 Job recruitment
6.7.1 Applications
Description: If you apply to us for a position, we process your application documents until the conclusion of the application process solely for the purpose of deciding on your recruitment. We limit access to your documents to the persons whom it makes sense to involve in the decision on your recruitment.
If you are hired, your application documents become part of your personnel file. If you are not hired, we will either ask for your consent to be included in our candidate pool, or return or destroy your documents as soon as, under anti-discrimination law, an objection to our decision is no longer to be expected.
Data categories: Name + contact details (e-mail, telephone, address), photo, profile URL on professional networks (e.g. Xing); information in the cover letter, CV, references and testimonials, proof of education and professional qualifications, notes from interviews (by telephone and in person), where applicable results from aptitude tests
Data recipients (transfer to a third country, if applicable): Microsoft as our service provider for hosting our e-mail mailboxes and file storage. Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland; Microsoft is obligated to comply with data protection through a data processing agreement. To the extent the EU subsidiary transfers data to the US parent company Microsoft Corp. or other Microsoft companies, Microsoft guarantees handling of the data at EU data protection level through the conclusion of standard contractual clauses. In addition, the company has certified itself according to the standards of the US-EU Privacy Shield, so that data transfers are covered by the EU Commission’s adequacy decision on data transfers to the USA from July 2023.
Purpose + legal basis: Basis for decision on job recruitment. The legal basis is preparation for performance of a contract (employment contract) and, subsequently, a legitimate interest in defending against objections to rejection decisions. Storage period: 6 months after conclusion of the original application process
6.7.2 Candidate pool
Description: Should we currently be unable to offer you a suitable position, but wish to consider you again in the selection process for future vacancies, we will ask for your consent to retain your application documents beyond the conclusion of the current application process. Should we be unable to get back to you for more than two years, we will either seek your consent again for further retention or return or delete your documents.
Data categories: Name + contact details (e-mail, telephone, address), photo, profile URL on professional networks (e.g. Xing); information in the cover letter, CV, references and testimonials, proof of education and professional qualifications, notes from interviews (by telephone and in person), where applicable results from aptitude tests
Data recipients (transfer to a third country, if applicable): Microsoft as our service provider for hosting our e-mail mailboxes and file storage. Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland; Microsoft is obligated to comply with data protection through a data processing agreement. To the extent the EU subsidiary transfers data to the US parent company Microsoft Corp. or other Microsoft companies, Microsoft guarantees handling of the data at EU data protection level through the conclusion of standard contractual clauses. In addition, the company has certified itself according to the standards of the US-EU Privacy Shield, so that data transfers are covered by the EU Commission’s adequacy decision on data transfers to the USA from July 2023.
Purpose + legal basis: Basis for decision on future job recruitment. The legal basis is consent. Storage period: 2 years from the last contact or last consent
6.8 General infrastructure
6.8.1 E-mail mailbox, address book, calendar
Description: For e-mail, address book, and calendar we use Exchange accounts, which record these groups of data together. E-mails that you send to us or receive from us, your contact details, and appointments with you are stored both on the servers of our hosting provider and as a local copy on the devices that we have connected to our corresponding accounts.
Data categories: Name, contact details (e-mail, telephone, address, fax), your company, your company’s business field, your job title, your area of responsibility, place, time, and circumstances of contact, as well as, where applicable, special notes on your availability or the business topics addressed; time of sending or receiving an e-mail; content of the e-mail (texts, documents, images, other files); other typical metadata of an e-mail
Data recipients (transfer to a third country, if applicable): Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland; Microsoft is obligated to comply with data protection through a data processing agreement. To the extent the EU subsidiary transfers data to the US parent company Microsoft Corp. or other Microsoft companies, Microsoft guarantees handling of the data at EU data protection level through the conclusion of standard contractual clauses. In addition, the company has certified itself according to the standards of the US-EU Privacy Shield, so that data transfers are covered by the EU Commission’s adequacy decision on data transfers to the USA from July 2023.
Purpose + legal basis: Use of a mutually synchronised e-mail mailbox, calendar, and address book. The legal basis is legitimate interest, as participation in modern business life would not be possible in a reasonably efficient manner without such a digital infrastructure.
Storage period: We store e-mails and entries for as long as necessary to fulfil a purpose. Depending on the content of an e-mail, the business relationship with a contact, or the background to an appointment, these purposes can vary widely; the retention periods are correspondingly diverse.
An example: If your e-mail serves to prepare the conclusion of a contract, the obligation from the German Commercial Code (HGB) to retain business letters for six years applies.
6.8.2 Video conferencing (Teams)
Description: If you take part in a video conference with us to which we have (technically) invited you, responsibility for the data processing arising from this communication lies with us. We use Microsoft Teams for video conferences. When we invite you to a conference, we send a Teams URL specific to that conference along with the appointment.
You can take part in a Teams video conference via the Teams app for mobile devices or desktop/laptop, or via your internet browser.
Participation as a guest is possible, so that you do not need your own Microsoft user account. When dialling into the conference, you will be asked to give yourself a participant name for the conference, e.g. so that comments in the chat during the conference can be attributed to you. You may also use a fictitious name here.
Teams asks for your consent to access your microphone and camera. You may grant each of these permissions, but you do not have to, for example if you wish to follow a conference without actively participating.
In addition to audio and video, Teams offers you supplementary functions: an accompanying chat for exchanges in text form, raising your hand via icon symbols, profile management (profile picture, further contact details), artificial background image. Conferences can be recorded. If a conference is to be recorded, we inform all participants beforehand and only start the recording once all participants have declared their consent to the recording. Audio recordings can be transcribed into a text file by Microsoft on our behalf.
Unless an explicitly agreed recording takes place, the conference is not stored by us in any way. After the conference ends, the content of a non-recorded conference can no longer be accessed. This corresponds, in this respect, to telephone calls that were not recorded.
It is technically possible for every participant to create screenshots or a recording of the conference, in whole or in part, using means outside of Teams. Such conduct without corresponding agreement from all participants constitutes a data protection violation on the part of the person acting, and, where this does not involve one of our employees, lies outside our responsibility. Covert recordings of the spoken word may constitute a criminal offence under Section 201 of the German Criminal Code (StGB). We reserve the right to take any type of legal action against persons who use their participation in a video conference for conduct hostile to data protection.
To the extent it concerns data processing that is not directly related to the specific conference, responsibility does not lie with us but directly with Microsoft. This applies, for example, to downloading the Teams app. By downloading the Teams app to your device, you thereby establish an independent legal relationship between yourself and Microsoft. In some cases, responsibility also lies with you or the organisation that provides you with your personal Teams user account.
The data transfer between your device and the Teams server requires that Microsoft becomes aware of the IP address via which you are online during the video conference. The servers also record all types of data that regularly arise from the use of telemedia services.
Information on data protection at Microsoft can be found here: https://privacy.microsoft.com/de-de/privacystatement
Data categories: Username, participation times, video and/or audio signal, video and/or audio recording (only with consent), audio transcript (only after recording), actions in chat, hand-raising status, profile data (profile picture, contact details, background image), telephone number (when participating by phone); further data categories such as IP address or e-mail address are processed by Microsoft under its own responsibility.
Data recipients (transfer to a third country, if applicable): Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland; Microsoft is obligated to comply with data protection through a data processing agreement. To the extent the EU subsidiary transfers data to the US parent company Microsoft Corp. or other Microsoft companies, Microsoft guarantees handling of the data at EU data protection level through the conclusion of standard contractual clauses. In addition, the company has certified itself according to the standards of the US-EU Privacy Shield, so that data transfers are covered by the EU Commission’s adequacy decision on data transfers to the USA from July 2023.
Purpose + legal basis: Use of a video conference. Depending on the content of the conversation, the legal basis is preparation for or performance of a contract, or a legitimate interest in exchange with you. For recordings, consent is the legal basis.
Storage period: Where no recording takes place, all data is deleted upon conclusion of the conference. If the conference was recorded, the recording is deleted as soon as the last purpose for which the recording was made has been achieved.
6.8.3 IT administration
Description: We engage service providers for the administration, maintenance, and upkeep of our information technology. These service providers are not substantively involved with the personal data processed by us. However, in the course of maintaining databases and other system components, it may happen that personal data comes to the attention of the service providers. All our service providers are expressly bound to confidentiality through corresponding contracts, in accordance with the sensitivity of the data to which they may have access.
Data categories: Any type of data
Data recipients (transfer to a third country, if applicable): IT service providers who are obligated to comply with data protection through a data processing agreement or another form of confidentiality obligation. No transfer to a third country takes place.
Purpose + legal basis: Engaging competent service providers for professional IT administration. The legal basis is a legitimate interest, as the service providers have been bound to data protection through adequate confidentiality obligations.
Storage period: No independent storage takes place.
6.8.4 File storage
Description: In addition to data collection in the individual databases described above, we store documents on our storage media. This typically includes office documents (Word, Excel, PowerPoint), PDF files, images, films, layouts, other formats of text, spreadsheet, and presentation files, and ultimately any type of file whose use is appropriate within the scope of our business processes.
Data protection questions regarding the content of the files are governed by the respective applicable processing purposes. In parallel, the storage of the files and the metadata regularly attached to them (primarily the creator signature) gives rise to a separate processing operation. Office documents in particular contain personal metadata when they are worked on collaboratively and the comment and note functions as well as track-changes mode are used for this purpose.
We use Microsoft 365 as a cloud solution for file storage (in Teams, SharePoint, or OneDrive). Comprehensive information on the use of data collected by Microsoft can be found in Microsoft’s privacy information (https://privacy.microsoft.com/de-de/privacystatement).
Data categories: Any type of data, though the focus here is on metadata: signature of the file creator, signatures of file editors (also in comments and notes); time of creation, editing, or storage
Data recipients (transfer to a third country, if applicable): Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland; Microsoft is obligated to comply with data protection through a data processing agreement. To the extent the EU subsidiary transfers data to the US parent company Microsoft Corp. or other Microsoft companies, Microsoft guarantees handling of the data at EU data protection level through the conclusion of standard contractual clauses. In addition, the company has certified itself according to the standards of the US-EU Privacy Shield, so that data transfers are covered by the EU Commission’s adequacy decision on data transfers to the USA from July 2023.
Purpose + legal basis: File storage in a high-performance data centre as well as the use of modern search functionality. The legal basis is a legitimate interest, as the processing takes place within the scope of a data processing agreement. Storage period: Depends on the retention period for the individual file
6.8.5 Legal enforcement
Description: In the event that we become involved in a legal dispute with you, we disclose data concerning your person and the circumstances of the dispute to lawyers and, where applicable, to authorities or courts.
Data categories: Name, contact details, information on the subject matter of the dispute
Data recipients (transfer to a third country, if applicable): Lawyers, authorities, courts, bailiffs. All recipients are bound to confidentiality either as state institutions or as professionals bound by professional secrecy. No transfer to a third country takes place.
Purpose + legal basis: Legal enforcement. The legal basis is the legitimate interest in seeking legal assistance from lawyers and, where applicable, authorities or courts as needed.
Storage period: The recipients named store your data according to their own requirements, to the extent necessary to fulfil the respective task. We store the data relating to a legal dispute until the dispute is finally concluded, including all relevant limitation and objection periods. Should the repetition of a comparable dispute with you or other persons be conceivable, we store at least the documents decisive to the proceedings — where applicable in anonymised form — for a correspondingly longer period.
6.8.6 Data protection management
Description: If you assert your data protection rights against us, we document the accompanying communication and processes in our data protection management application.
Data categories: Name, contact details, information on the data protection request
Data recipients (transfer to a third country, if applicable): Our data protection officer, who is legally bound to confidentiality, is based in the EEA. Our service provider for the cloud application used for data protection management, which is obligated to comply with data protection through a data processing agreement, is based in the EEA. No transfer to a third country takes place.
Purpose + legal basis: Data protection management. The legal basis is the statutory accountability obligation under the GDPR.
Storage period: We store the data relating to a legal dispute until the dispute is finally concluded, including all relevant limitation and objection periods. Should the repetition of a comparable dispute with you or other persons be conceivable, we store at least the documents decisive to the proceedings — where applicable in anonymised form — for a correspondingly longer period.
Last updated: March 2026