A. General Information

I. Authorized representative

This privacy notice is provided by:
One Thousand GmbH

Leuschnerdamm 13

10999 Berlin
E-Mail: hello@onethousand.ai

(hereinafter also referred to as "One Thousand")
in fulfillment of its legal obligation to provide information pursuant to Articles 13 and 14 of the General Data Protection Regulation ("GDPR") with regard to the processing of personal data on this website.Below, we explain which personal data we collect from you and how we process it.

II. Personal Data

Personal data within the meaning of Article 4(1) GDPR includes, for example, information such as your name, address, telephone number, email address, bank details, or date of birth.

III. Processing of Personal Data

Processing of personal data within the meaning of Article 4(2) GDPR refers to any operation or set of operations which is performed on personal data, whether or not by automated means.

We process personal data as defined in Article 4(2) GDPR according to the conditions and provisions outlined below, as part of automated processing, and based on the applicable legal grounds.

In cases where processing is necessary to comply with legal obligations, Article 6(1)(c) GDPR serves as the legal basis. We process your personal data in accordance with the specific legal obligation in question.

Other applicable legal bases for data processing activities are presented below.

There is no automated individual decision-making, including profiling, as referred to in Article 22 GDPR.

B. General Processing Activities

I. Collection of Personal Data When Visiting Our Website

When you use our website for informational purposes only, that is, when you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect in particular the following data, which is technically necessary for us to display the website to you and to ensure its stability and security:

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each case
• Website from which the request comes (referrer, if available)
• Operating system and its interface, screen resolution and color depth
• Type, language, and version of the browser software

The legal basis for this processing is Article 6(1)(f) GDPR (legitimate interest).

II. Additional Features and Services
In addition to purely informational use of our website, we offer various services that you can use if you are interested. We also use other common features to analyze or promote our offerings, which are described in more detail below.

To provide these services, you may need to submit additional personal data, or we may process such additional data that you provide or that is necessary for the performance of the respective service. These are described in this document.

In some cases, we engage external service providers to process your data. These providers are carefully selected, bound by our instructions, and regularly monitored.

Furthermore, we may share your personal data with third parties if promotions, prize draws, contract conclusions, or similar services are offered jointly with partners. Depending on the service, your data may also be collected by the partners under their own responsibility. You will receive further information when you provide your data or in the description of the respective offer below.

If our service providers or partners are located in a country outside the EU or the European Economic Area (EEA), we will inform you about the implications of this circumstance in the respective offer description.

III. Contacting Us via Email, Telephone, or Contact Form
If you contact us by email, telephone, or via a contact form, we process the personal data you provide to us. Mandatory fields are marked accordingly in each contact method and are necessary to respond to your inquiry appropriately. You may also voluntarily provide additional personal data if you wish. We store the personal data you provide to respond to your inquiry. The data collected in this context will be deleted once it is no longer required for the purpose or, if legal retention obligations apply, its processing will be restricted.

The legal basis for this processing is Article 6(1)(f) GDPR (legitimate interest).

C. Use of Cookies

In addition to the data mentioned above, we use technical tools for various functions when you visit our website, particularly cookies, which may be stored on your device. When accessing our website, and at any later time, you have the option to decide whether to allow cookies in general and which individual additional features you want to enable. You can make changes via your browser settings or through our cookie consent manager.

Cookies are text files or information stored in a database, saved to your hard drive and linked to your browser. They enable the party setting the cookie to receive certain information. Cookies cannot run programs or transfer viruses to your computer. Their primary function is to make web services faster and more user-friendly.
This website uses the following types of cookies, whose operation and legal basis we explain below:

• Transient cookies: These include session cookies, which are automatically deleted when you close your browser or log out. They contain a session ID that allows multiple requests from your browser to be associated with a single session. This enables your computer to be recognized when you return to our website.
• Persistent cookies: These are automatically deleted after a predetermined period, which can vary depending on the cookie. You can view and manage the cookies and their lifetimes in your browser settings and delete them manually at any time
• Other technologies: These features do not rely on cookies but use similar technical mechanisms such as Flash cookies, HTML5 objects, or analysis of your browser settings. You can also consent to or reject the use of these technologies.

We use technically necessary cookies for the proper display of the website. The legal basis for this is Article 6 paragraph 1 sentence 1 letter f of the GDPR (legitimate interest), as outlined in the cookie consent manager. The technical design of the website requires the use of technologies, especially cookies. Without these technologies, proper functionality or a complete display of our website cannot be ensured, and certain support functions would not be available. These are generally transient cookies, deleted at the end of your session or when your browser is closed. These cookies cannot be deactivated if you wish to use our website. However, you may configure your browser to block even technically required cookies. Please note that in doing so, you may not be able to fully use the website.

For all other cookies, the legal basis is Article 6 paragraph 1 sentence 1 letter a of the GDPR (consent). You can make your selection when you first visit our website or at any later time through the cookie consent manager. These functions are activated only if you provide your consent. They may allow us to analyze and improve visits to our website, enable easier use across different browsers or devices, recognize returning users, or display advertising (including interest-based advertising, measuring ad effectiveness, or serving targeted ads). Further details are provided in this privacy notice.

The storage of information on your device by setting cookies, and access to information stored on your device through reading cookies, is only permitted if you have given us consent in accordance with Section 25 paragraph 1 sentence 1 of the German Telecommunications and Telemedia Data Protection Act (TDDDG). According to Section 25 paragraph 1 sentence 2 TDDDG, the provisions of the GDPR apply accordingly.

You can revoke your consent at any time. This does not affect the lawfulness of processing based on consent before its withdrawal.

You may choose to give consent for all cookies, only for specific categories, or not at all.

This consent is voluntary. You may refuse it without stating a reason and without experiencing any disadvantages. You may also revoke your consent at any time with future effect and without negative consequences. However, we advise that if you do not give or later revoke your consent, certain functions of this website may no longer be available to you.

Further information about the use of cookies is provided in the following sections.

D. Web Analytics

We use Google Analytics, a web tracking service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The purpose of our use is to analyze your interactions with our website and, based on the statistics and reports obtained, to improve our services and make them more relevant and engaging for you as a user.

We collect interactions between you as a user and our website primarily using cookies, device and browser data, IP addresses, and website activity. Google Analytics also records your IP address in order to ensure the security of the service and to provide us as the website operator with geographic insights such as country, region, or city of origin, known as IP location identification. For your protection, we use the IP anonymization feature (“IP masking”), which means that Google shortens your IP address by the last octet within the EU or the EEA.

Google acts as a data processor, and we have concluded a data processing agreement with Google pursuant to Article 28 of the GDPR. Data processors only process your data in accordance with legal requirements, under our instructions, and strictly for the purpose of fulfilling their contractual obligations.

The information generated by the cookie and the (usually shortened) IP address regarding your use of this website is typically transmitted to a Google server in the United States and processed there.

Google uses cookies and may also process your personal data in the United States. Data transfers to companies in the US are based on an adequacy decision by the European Commission pursuant to Article 45 paragraph 3 of the GDPR, which confirms that an adequate level of data protection is ensured in the US.

The legal basis for the collection and further processing of this information (which occurs for a maximum period of 14 months) is your explicit consent, in accordance with Article 6 paragraph 1 sentence 1 letter a of the GDPR in conjunction with Section 25 TDDDG. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. The easiest way to withdraw your consent is via our cookie consent manager or by installing the Google opt-out browser add-on, available at: https://tools.google.com/dlpage/gaoptout?hl=en

You may revoke this consent at any time with future effect without experiencing any disadvantages here.

Further information on the scope of Google Analytics services can be found at:
https://marketingplatform.google.com/about/analytics/terms/us/. Information on how Google processes data when you use Google Analytics can be found at: https://support.google.com/analytics/answer/6004245?hl=en. General information on Google's data processing (which also applies to Google Analytics) is available in Google's Privacy Policy:
https://www.google.com/policies/privacy/.

F. Social Media

I. Social Media Profiles

We maintain various profiles on so-called social media platforms. These profiles are operated on the following providers: Instagram, YouTube, LinkedIn, GitHub, Medium.

According to Article 4 paragraph 7 of the GDPR, we are responsible as the operator of the page, and the providers are joint controllers in accordance with Article 26 GDPR.

The essential content of the contract on our joint responsibility pursuant to Article 26 paragraph 2 sentence 2 GDPR is presented as follows:

The provider assumes primary responsibility according to the provisions of the GDPR for processing Insights data and will fulfill all obligations under the GDPR related to the processing of Insights data (including Articles 12 and 13 GDPR "information duties," Articles 15 to 21 GDPR "data subject rights," and Articles 32 to 34 GDPR "technical and organizational measures," among others).

In this context, data collected about you are processed by the platforms and transferred to countries outside the European Union, especially the USA. Data transfer to companies in the USA is based on an adequacy decision of the European Commission pursuant to Article 45 paragraph 3 GDPR, which confirms an adequate level of data protection in the USA.

We are not aware of how the social media platforms use the data from your visit to our accounts and interactions with our posts for their own purposes, how long this data is stored, or whether it is shared with third parties. The data processing may differ depending on whether you are registered and logged into the social network or if you visit the page as an unregistered and/or logged-out user. When accessing a post or the account, the IP address assigned to your device is transmitted to the social media platform provider. If you are currently logged in as a user, a cookie on your device can track how you have navigated the web. Through embedded buttons on websites, the platforms can track your visits on these websites and assign them to your profile. Based on this data, content or advertisements can be tailored to you. If you wish to avoid this, you should log out or deactivate the "stay logged in" function, delete the cookies stored on your device, and restart your browser.

We use the technical platform and services of the providers for these information services. We inform you that you use our social media profiles and their functions at your own responsibility. This applies especially to the use of interactive features (e.g., commenting, sharing, rating). When visiting our profiles, the social media platform providers collect, among other things, your IP address and other information stored in the form of cookies on your device. This information is used to provide us, as the account operator, with statistical information about the interaction with us.

As the service provider, we only process data from your use of our service that you provide to us and that require interaction. For example, if you ask a question that we can only answer by email, we will store your information according to the general principles of our data processing described in this privacy notice.

The legal basis for processing your data on the social media platform by us is Article 6 paragraph 1 sentence 1 letter f GDPR ("legitimate interest").

We may also collect and process your personal data for conducting contests or sweepstakes. The legal basis in this case is Article 6 paragraph 1 sentence 1 letter b GDPR ("contract performance"). These data are necessary to conclude the contract for the contest. Without this data, we cannot enter into a contest contract with you.

To exercise your data subject rights, you may contact either us or the social media platform provider. If one party is not responsible for responding or needs to receive information from the other party, we or the provider will forward your request to the respective partner. For questions about profiling and data processing on the platform, please contact the social media platform operator directly. For questions regarding the processing of your interaction with us on our page, please write to the contact details provided above.

Addresses of the respective providers and URLs to their privacy policies:

1. Instagram: Operated by Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA; www.facebook.com/policy.php; more information on data collection: www.facebook.com/help/186325668085084, www.facebook.com/about/privacy/your-info-on-other#applications, and www.facebook.com/about/privacy/your-info#everyoneinfo.
2. YouTube: Operated by Google Inc., 1600 Amphitheater Parkway, Mountain View, California 94043, USA; www.google.com/policies/privacy/partners/?hl=en.
3. LinkedIn: Operated by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA; www.linkedin.com/legal/privacy-policy.
4. GitHub: Operated by GitHub, Inc., c/o Corporation Service Company, 2710 Gateway Oaks Drive, Suite 150N, Sacramento, California 95833-3505, USA; docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement.
5. Medium: Operated by A Medium Corporation, 548 Market St., PMB 42061, San Francisco, California 94104–5401, USA; policy.medium.com/medium-privacy-policy-f03bf92035c9.

More information about data protection at the respective providers can be found in the above-listed privacy policies and also on youngdata.de.

II. Embedding YouTube Videos

We have embedded YouTube videos in our online offerings that are stored on www.YouTube.com and can be played directly from our website.

We use the so-called two-click solution. This means that when you visit our site, no personal data is initially transmitted to the provider. All videos are embedded in "enhanced privacy mode," which means that no data about you as a user is transmitted to YouTube unless you play the videos. We provide you the option to communicate directly with the provider via the video. Only when you play the videos are the data listed under B., I., "Collection of Personal Data when Visiting Our Website" transmitted. Additionally, YouTube then receives information that you have accessed the corresponding subpage of our website. This occurs regardless of whether YouTube provides a user account through which you are logged in or if no user account exists. If you are logged in, your data is assigned directly to your account. If you do not wish this association with your YouTube profile, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for advertising, market research, and/or tailored website design. Such analysis is performed especially (also for users not logged in) to provide targeted advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, but you must address YouTube directly to exercise this right.

The legal basis for processing your data is Article 6 paragraph 1 sentence 1 letter a GDPR in conjunction with Section 25 TDDDG, meaning embedding only takes place after your consent. Consent is voluntary. You can refuse it without giving reasons and without suffering disadvantages. You can revoke this consent at any time with future effect here without disadvantages here.

YouTube also processes your personal data in the USA. Data transfer to companies in the USA is based on an adequacy decision of the European Commission pursuant to Article 45 paragraph 3 GDPR, which confirms an adequate level of data protection in the USA.

Further information on the purpose and scope of data collection and processing by YouTube, as well as your rights and privacy settings, can be found in YouTube’s privacy policy:
www.google.com/intl/en/policies/privacy.

G. Marketing

I. Google Ads

We use the Google Ads service to draw attention to our offers through advertising. If you access our website via a Google ad, Google Ads will store a cookie on your device.

The advertising materials are delivered by Google via so-called “Ad Servers.” For this, we use so-called Ad Server cookies that allow measurement of certain parameters for success tracking, such as the display of ads or clicks by users. Through the Google Ads cookies stored on our website, we can obtain information about the success of our advertising campaigns. These cookies are not intended to personally identify you. Typically, the following values are stored with the cookie for analysis purposes: the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions), and opt-out information (indicating that a user no longer wishes to be addressed).

The cookies set by Google enable Google to recognize your internet browser. If a user visits certain pages on an advertiser’s website and the cookie stored on their computer has not expired, Google and the advertiser can recognize that the user clicked on the ad and was redirected to that page. Each advertiser is assigned a different cookie, so cookies cannot be tracked across the websites of other advertisers. By integrating Google Ads, Google receives the information that you visited the respective part of our website or clicked on one of our ads. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered or not logged into Google, it is possible that the provider obtains and stores your IP address.

Due to the marketing tools used, your browser automatically establishes a direct connection to Google’s server. We do not independently collect personal data in the aforementioned advertising measures but merely provide Google with the possibility to collect data. We receive only statistical evaluations from Google that inform us which ads were clicked, how often, and at what costs. We do not receive any further data from the advertising tools and cannot identify users based on this information.

The legal basis for processing your data is Art. 6(1) sentence 1 lit. a GDPR in conjunction with § 25 TMG (German Telemedia Act), meaning integration occurs only after your consent. Consent is voluntary. You can refuse it without giving reasons and without disadvantages. You can also revoke this consent at any time with future effect here without any disadvantages here.

You can revoke your consent at any time without affecting the lawfulness of processing before the revocation. The revocation is easiest via our cookie consent manager or through the following methods: a) by adjusting your browser settings, especially blocking third-party cookies, which prevents you from receiving third-party ads; b) by setting your browser to block cookies from the domain "www.googleadservices.com" (www.google.de/settings/ads), noting that this setting is deleted if you clear cookies; c) by deactivating interest-based ads from providers part of the self-regulation campaign “About Ads” via www.aboutads.info/choices, noting this setting is deleted if cookies are cleared; d) by permanently disabling in browsers Firefox, Internet Explorer, or Google Chrome via www.google.com/settings/ads/plugin. Please note that in this case, you might not be able to use all functions of this offer fully.

Google processes your personal data also in the USA. Data transfer to companies in the USA is based on an adequacy decision by the European Commission pursuant to Art. 45(3) GDPR, which establishes that an adequate level of protection exists in the USA.

More information about data protection at Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland, can be found here: www.google.com/intl/en/policies/privacy and services.google.com/sitestats/en.html.

II. Google Conversion Tracking

We use Google Ads with the additional application Google Conversion Tracking. This is a procedure that allows us to check the success of our advertising campaigns. The ads are marked with a technical feature, e.g., an ID, which enables us to determine how a user interacts after clicking the ads and whether any of our services were actually used. This provides us with statistical information about the total number of readers of our ads, which ads are particularly popular, and possibly further information about consequences from the ad.

You can prevent or stop using the conversion tracking function in the same way as described above for Google Ads.

The legal basis for processing your data is Art. 6(1) sentence 1 lit. a GDPR in conjunction with § 25 TMG, i.e., integration is only after your consent. Consent is voluntary, can be refused without disadvantage, and revoked at any time here with future effect.

Google processes your personal data also in the USA. The data transfer is based on an adequacy decision of the European Commission under Art. 45(3) GDPR.

More information about data protection at Google Ireland Limited is available here: www.google.de/intl/de/policies/privacy and services.google.com/sitestats/de.html.

III. LinkedIn Insight Tag

Our website also uses the so-called LinkedIn Insight Tag (or LinkedIn Pixel) from LinkedIn Ireland Unlimited Company ("LinkedIn"). By embedding this JavaScript tag, interest-based and relevant ads can be displayed to you as a user during visits to the social network LinkedIn or other websites also using this technology. We receive statistics about website visitors and demographics. We can also evaluate your use of our LinkedIn advertising and your interest in our offers via a conversion tracking function, and show you LinkedIn ads via retargeting on other websites. Our goal is to track interest, improve the effectiveness of LinkedIn ads, and make our website more interesting for you.

By embedding the LinkedIn Insight Tag, your browser automatically establishes a direct connection to LinkedIn’s servers, both when visiting the LinkedIn website and websites that have integrated the Insight Tag. LinkedIn and we are jointly responsible for collecting your usage data on our website and transmitting it to LinkedIn. However, LinkedIn is solely responsible for further processing after receiving the data. We have no influence on the scope and type of data use by LinkedIn but inform you according to our knowledge: LinkedIn receives the information that you accessed the relevant webpage or clicked an ad from us. If you are registered with LinkedIn, LinkedIn can assign the visit to your account. Even if you are not registered or logged in, LinkedIn may collect your IP address, time windows, and other identifiers and link them to actions assigned to you.

The legal basis for processing your data is Art. 6(1) sentence 1 lit. a GDPR in conjunction with § 25 TMG, meaning integration is only after your consent. Consent is voluntary, can be refused without disadvantage, and revoked at any time here with future effect.

You can deactivate the LinkedIn Insight Tag and object to advertising under www.linkedin.com/help/linkedin/answer/62931 and www.linkedin.com/psettings/guest-controls/retargeting-opt-out. Further settings and information can be found at LinkedIn’s Privacy Center: privacy.linkedin.com/en-us.

LinkedIn processes your personal data also in the USA. The data transfer is based on an adequacy decision by the European Commission under Art. 45(3) GDPR.

More information on data processing by LinkedIn is available at LinkedIn Ireland Unlimited Company, Attn: Legal Dept., Wilton Plaza, Wilton Place, Dublin 2, Ireland; LinkedIn Insight Tag: business.linkedin.com/marketing-solutions/insight-tag; Privacy Policy: www.linkedin.com/legal/privacy-policy.

IV. General

We intend to process the data you provide or we collect during an existing customer relationship or other paid contractual relationships also for advertising purposes. The legal basis for this is Art. 6(1) sentence 1 lit. f GDPR (“legitimate interest”). Such legitimate interest particularly includes direct marketing (Recital 47 sentence 7 GDPR). Direct marketing means the direct approach of a customer by a provider aiming to promote the sale of products or services for payment. Customer satisfaction surveys or participation in polls may also fall under the legal term of advertising. Other legal requirements, particularly §7(3) UWG (German Act Against Unfair Competition), are naturally observed.

Without an existing customer or paid contractual relationship, we only process your personal data for advertising purposes if you have given us your voluntary consent, Art. 6(1) sentence 1 lit. a GDPR.

Advertising is done by post, electronically (e.g., email, especially newsletters, social media), or by phone, as far as legally permitted.

Advertising campaigns refer especially to all products and services, customer satisfaction surveys and polls, as well as invitations to trade fairs and events.

You may object at any time to the processing of your personal data for advertising purposes. Contact details are listed in the privacy notice. In this case, your data will no longer be used for advertising and removed from the relevant distribution lists.

If we use processors for this purpose, we have concluded contracts in accordance with Art. 28 GDPR, ensuring that the processor is subject to our instructions as the client.

H. Administration, Google Tag Manager

For easier administration, we use the Google Tag Manager. The Google Tag Manager is a solution that allows marketers to manage website tags via an interface. The Tag Manager itself, which implements the tags, operates on a cookie-free domain and does not collect any personal data, but ensures the execution of other tags, which in turn may collect data. The Google Tag Manager does not access this data. If deactivation has been made at the domain or cookie level, this remains effective for all tracking tags implemented via Google Tag Manager.

The legal basis for processing your data is Art. 6(1) sentence 1 lit. a GDPR in conjunction with § 25 TMG, i.e., integration occurs only after your consent. You can refuse consent without giving reasons and without any disadvantages. You can revoke this consent at any time with future effect here.

Google also processes your personal data in the USA. Data transfer to companies in the USA is based on an adequacy decision by the European Commission pursuant to Art. 45(3) GDPR, which states that an adequate level of protection exists in the USA.

More information about data protection at Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland, can be found here: policies.google.com/privacy?hl=en and services.google.com/sitestats/en.html.

I. Job Applications

When you apply to us, the data you provide will be processed by us to determine whether we want to establish and conduct an employment relationship with you.

If you apply online via one of our partners, your data will be stored and processed on our partner’s systems. Our partner will process your data only in accordance with legal requirements and has taken necessary security measures, including technical and organizational safeguards.

If we use processors in this context, we have concluded contracts with them in accordance with Art. 28 GDPR, ensuring that the processor is subject to our instructions as the client.

During the application process, in addition to salutation, first and last names, the usual contact details such as postal address, email address, and phone numbers are stored. Application documents such as cover letters, CVs, professional, educational and further training certificates, as well as references, are also collected.

The applicant data you provide and send to us will generally only be processed until the decision about hiring is made if no employment relationship is established. Four months after sending the rejection or returning the application documents to the applicant, the data will be deleted.

Storage in an applicant pool only takes place if you explicitly consent to this according to Art. 6(1) sentence 1 lit. a GDPR. This storage is limited to a maximum period of two years. Consent is voluntary and can be refused without disadvantages. You can revoke this consent at any time in writing (e.g., by email) with future effect to the contact details given above without disadvantages.

If we enter into an employment relationship with you, the data you provided will be processed for the establishment, execution, and, if applicable, termination of the employment relationship.

The data may also be processed for statistical purposes (e.g., reporting). In this context, no conclusions can be drawn about individual persons.

The legal basis is § 26 German Federal Data Protection Act (BDSG) (§ 26(8) sentence 2 BDSG).

J. Duration of Processing

The maximum duration of storage depends on the purpose of the data processing. The storage period is particularly determined by how long the storage is necessary to fulfill the purpose. In addition, the data is processed to comply with legal obligations (e.g., commercial and tax retention requirements according to § 257 German Commercial Code (HGB), § 147 Fiscal Code (AO)) for up to ten years.

K. Recipients of the Data

We transfer your data to our specialist departments as far as this is necessary.

The legal basis for any further data transfer within the Techniropa corporate group is Art. 6(1) sentence 1 lit. f GDPR (“legitimate interest”). According to this, data processing is lawful if processing is necessary to safeguard legitimate interests of ours, provided that the interests or fundamental rights of the data subject do not override this. Recital 48 of the GDPR specifies the legitimate interest for transfers within a corporate group. Accordingly, the transfer within a corporate group for internal administrative purposes concerning the processing of customer and employee/applicant data qualifies as a legitimate interest of ours within the meaning of Art. 6(1) sentence 1 lit. f GDPR.

Any further transfer of personal data to third parties only takes place if it is necessary to fulfill the respective purpose and we can rely on a corresponding legal basis, in particular on our legitimate interest pursuant to Art. 6(1) sentence 1 lit. f GDPR.

In part, we use external service providers for processing your data. These have been carefully selected and commissioned by us, are bound by our instructions, and are regularly monitored. All requirements of Art. 28 GDPR are observed.

L. Location of Data Processing

All processing of your personal data takes place either in Germany or in member states of the European Union. A transfer of your personal data by us to countries outside the EU member states (so-called third countries) or to other international organizations generally does not take place unless stated otherwise in this document.

If we transfer personal data to service providers outside the EU, this only occurs if the third country has been confirmed by the EU Commission as having an adequate level of data protection pursuant to Art. 45(3) GDPR or other appropriate safeguards exist (e.g., binding corporate rules or a contract based on the current standard contractual clauses of the EU Commission) or if consent of the data subject is present, Art. 44 ff. GDPR.

M. Security / Technical and Organizational Measures

We take all necessary technical and organizational measures in accordance with the provisions of Arts. 24, 25, and 32 GDPR to protect your personal data from loss, destruction, access, alteration, or dissemination by unauthorized persons and misuse.

This includes complying with legal requirements regarding pseudonymization and encryption of personal data, confidentiality, integrity, availability, and resilience of systems and services related to processing, availability of personal data, and the ability to restore data quickly in case of physical or technical incidents, as well as the implementation of procedures for regular testing, assessment, and evaluation of the effectiveness of technical and organizational measures to ensure the security of processing.

Furthermore, we comply with the requirements of Art. 25 GDPR concerning the principles of “privacy by design” and “privacy by default.”

N. Your Rights / Contact Details of the External Data Protection Officer

You have the right to receive free information about your personal data as well as, if the legal requirements are met, the right to correction, blocking, and deletion of your data, to restriction of processing, to data portability, and to object, particularly if we rely on a legitimate interest or in relation to direct marketing.

Specifically:

You have the right to

• request confirmation from us whether personal data concerning you is being processed; if so, you have the right to access this personal data and to receive the information specified in Art. 15 GDPR,
• request from us the immediate correction of incorrect personal data concerning you and, if applicable, completion of incomplete personal data, see Art. 16 GDPR,
• request the immediate deletion of personal data concerning you from us if one of the reasons listed in Art. 17 GDPR applies, e.g., if data is no longer necessary for the purposes pursued (right to deletion),
• request restriction of processing if one of the conditions listed in Art. 18 GDPR applies, e.g., if you have objected to the processing, for the duration of our review,
• request data transfer if one of the conditions listed in Art. 20 GDPR applies,
• object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims, see Art. 21 GDPR. If we base the processing of your personal data on legitimate interest pursuant to Art. 6(1) sentence 1 lit. f GDPR, you may object to the processing. This applies if processing is not necessary to fulfill a contract with you. When exercising such an objection, please state the reasons why we should not process your personal data as we have done. If you raise a justified objection, we will review the situation and either stop or adjust the data processing or explain our compelling legitimate reasons to continue processing.

Without prejudice to any other administrative or judicial remedy, you have the right to complain to a supervisory authority if you believe that the processing of personal data concerning you violates the GDPR, see Art. 77 GDPR. You can exercise this right with the supervisory authority in the member state of your residence, workplace, or the location of the alleged violation. In Berlin, the responsible supervisory authority is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

For questions about the processing of your personal data, your rights, or to exercise your rights, or for suggestions, please contact us or our external data protection officer:

CDV Consulting GmbH

Dr. Thomas Kehr

Ferdinand-Sauerbruch-Straße 28

56073 Koblenz

Germany

Phone: 0049 (0) 261-88 44 699

E-Mail: T.Kehr@cdv-consulting.de

Version: 2, valid from 03.02.2025.

Our current version of this document always applies.