Privacy Policy
Privacy policy for website visitors
Translation for convenience; the German version is legally binding. Datenschutzerklärung (German)
Name and address of the controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
Name and address of the data protection officer
The controller’s data protection officer is:
General information on data processing
Legal basis for the processing of personal data
In accordance with Article 13 of the GDPR, we hereby inform you of the legal bases for our data processing activities. Where you have consented to the processing of your data, we process your personal data on the basis of Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, where special categories of data as defined in Article 9(1) of the GDPR are processed. In the event of explicit consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Article 49(1)(a) of the GDPR. Where you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), data processing is also carried out on the basis of Section 25(1) of the TDDDG. Consent may be withdrawn at any time.
If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Article 6(1)(b) of the GDPR. Furthermore, we process your data where this is necessary to comply with a legal obligation on the basis of Article 6(1)(c) of the GDPR. Data processing may also take place on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR.
Data erasure and retention period
We adhere to the principles of data minimisation in accordance with Article 5(1)(c) of the GDPR and storage limitation in accordance with Article 5(1)(e) of the GDPR. We store your personal data only for as long as is necessary to fulfil the purposes set out here or as required by the retention periods stipulated by law. Once the relevant purpose no longer applies or once these retention periods have expired, the corresponding data will be deleted as soon as possible.
External links
This website may contain links to third-party websites or to other websites for which we are responsible. If you follow a link to one of the websites outside our responsibility, please note that these websites have their own privacy information. We accept no responsibility or liability for these third-party websites and their privacy notices. Please therefore check before using these websites whether you agree with their privacy policies.
You can recognise external links either because they are displayed in a slightly different colour from the rest of the text or underlined. Your cursor indicates external links when you move it over such a link. Only when you click on an external link is your personal data transferred to the link target. In particular, the operator of the other website receives your IP address, the time at which you clicked the link, the page on which you clicked the link and other information that you can find in the privacy notices of the respective provider.
Please also note that individual links may lead to data being transferred outside the European Economic Area. As a result, foreign authorities could gain access to your data. You may have no legal remedies against such data access. If you do not want your personal data to be transferred to the link target or even be exposed to undesired access by foreign authorities, please do not click on any links.
Rights of data subjects
As a data subject, you are entitled to the following rights under the EU General Data Protection Regulation (GDPR):
Right of access (Article 15 of the GDPR)
You have the right to request information about which personal data relating to you is stored, for what purpose it is processed, from which recipients it has been received or to whom it is disclosed, and for how long it is stored.
Right to rectification (Art. 16 GDPR)
You may request the immediate rectification of inaccurate personal data or the completion of incomplete personal data.
Right to erasure (‘right to be forgotten’) (Art. 17 GDPR)
Under certain conditions, you may request the erasure of your personal data, for example if it is no longer necessary for the purposes for which it was collected or if you have withdrawn your consent.
Right to restriction of processing (Article 18 of the GDPR)
You have the right to request the restriction of the processing of your personal data, for example if you contest the accuracy of the data or if the processing is unlawful, but you wish to have the processing restricted rather than erased.
Right to data portability (Art. 20 GDPR)
You may request that the personal data concerning you, which you have provided to us, be supplied to you in a structured, commonly used and machine-readable format – or that we transfer this data directly to another controller.
Right to object (Art. 21 GDPR)
You have the right to object at any time to the processing of your personal data, provided that the processing is based on the legitimate interests of our company or on a task carried out in the public interest. In the event of a justified objection, we will cease processing, unless there are compelling legitimate grounds for the processing.
Withdrawal of consent (Art. 7 GDPR)
If you have given us your consent, you may withdraw it at any time with future effect without giving any reason.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
Without prejudice to other administrative or judicial remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place where the alleged infringement occurred.
Hosting and server log files
Our website’s servers are operated by the provider IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. We have entered into a data processing agreement with the provider in accordance with Article 28 of the GDPR. The legal basis for the use of an external hosting service is the performance of a contract with our potential and existing customers in accordance with Article 6(1)(b) of the GDPR, as well as our legitimate interest in the secure and high-performance provision of our website in accordance with Article 6(1)(f) of the GDPR.
Every time our website is accessed, our system’s web server collects information about the end device used. We collect the following data:
- Information about the browser type
- Operating system of the user’s device
- Date and time of access
- The previous website from which the user accessed our website (referrer)
We collect IP addresses only in anonymised form; therefore, we do not store any personal data within the meaning of the GDPR in our log files.
AI-generated image and video content
Some of the image and video content used on this website has been created with the aid of artificial intelligence. This applies in particular to illustrative images and background media. The content is used solely for the visual design of our website.
No personal data from customers, applicants, employees or other real persons was used to create this content. The people depicted do not represent real persons.
Contacting us
You may contact us by email, telephone, via the contact form or by post; this may involve the processing of personal data. We process your data to handle and process your enquiry. We will not pass on your data to third parties without your consent.
The legal basis for the processing is our legitimate interest in the effective handling of your enquiry in accordance with Article 6(1)(f) of the GDPR.
When you contact us by email, we store your email address and the information contained in the email. If you use the contact form, your IP address is recorded in pseudonymised form in addition to the details provided in the contact form. If you contact us by post, your return address and the contents of the letter will be stored. If you contact us by telephone, we will collect personal data depending on the specific circumstances.
We store your data until you request its deletion or until the purpose of processing (handling your enquiry) has been fulfilled.
Presence on LinkedIn
Social networks process their users’ personal data on a large scale. When you visit our profiles, your IP address and other information about the devices you use are processed, amongst other things, which enables IP addresses to be linked to individual users. We have no control over this data processing. Please note that you use our profiles on social media platforms and their features at your own risk. Details regarding data processing can be found in the operator’s privacy policy.
We have a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.
You can find detailed information on the handling of personal data in LinkedIn’s privacy policy at the following link: https://www.linkedin.com/legal/privacy-policy.
The purpose of our profiles on social media platforms is to increase our online presence and, consequently, our visibility. Therefore, the legal basis is legitimate interest in accordance with Article 6(1)(f) of the GDPR. Furthermore, with regard to the processing activities carried out by the social networks, reference must be made to their own legal bases (e.g. consent in accordance with Article 6(1)(a) of the GDPR), which you can find in the respective privacy policies.
In principle, we are jointly responsible with the social media platform for the data processing operations triggered when you visit our profile. You may therefore exercise your data subject rights under Article 15 et seq. of the GDPR both vis-à-vis the social media platform and vis-à-vis us. We would, however, point out that we have no influence over the data processing carried out by the social media platform.
Privacy policy for candidates
Personal data in the application process
Personal data is information about the personal or material circumstances of an identified or identifiable natural person. This includes information such as your name, address, telephone number and date of birth, but also data about your specific career history etc. that can be attributed to a specific person with reasonable effort.
Application procedure
We process your applicant data exclusively for the purpose of and within the scope of the application procedure in accordance with the statutory requirements. Applicant data is processed in order to fulfil our (pre-)contractual obligations within the applicant selection procedure within the meaning of Article 6(1)(b) of the GDPR and Section 26 of the BDSG (German Federal Data Protection Act, Bundesdatenschutzgesetz), where data processing becomes necessary for us, e.g. in the context of legal proceedings.
The application procedure requires applicants to send us their application documents. The required applicant data is marked in the online form and otherwise follows from the job descriptions. In principle, this includes personal details, postal and contact details and the documents belonging to the application, such as cover letter, CV and references. In addition, applicants may voluntarily provide us with further information.
Where special categories of personal data within the meaning of Article 9(1) of the GDPR are voluntarily disclosed in the application procedure, they are additionally processed in accordance with Article 9(2)(b) of the GDPR (e.g. health data, severe disability status or ethnic origin). Where special categories of personal data within the meaning of Article 9(1) of the GDPR are requested from applicants in the application procedure, they are additionally processed in accordance with Article 9(2)(a) of the GDPR (e.g. health data, if this is necessary for the exercise of the profession).
Applicants can submit their applications to us via an online form on our website. The data is transmitted to us in encrypted form in accordance with the state of the art. Applicants can also submit their applications to us by email. Please note, however, that emails are generally not sent in encrypted form and applicants must ensure encryption themselves. In addition to applying via the online form and by email, applicants can also send us their application by post.
If the application for a vacancy is unsuccessful, the applicants’ data will be deleted. The applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time.
Subject to a justified withdrawal by the applicants, deletion takes place after a period of six months has elapsed, so that we can answer any follow-up questions about the application and comply with our obligations to provide evidence under the Equal Treatment Act (Gleichbehandlungsgesetz). Invoices for any reimbursement of travel expenses are archived in accordance with the requirements of tax law.
Types of data processed: applicant data (e.g. personal details, postal and contact details, CV, references and other information about their person or qualifications provided with regard to a specific position or voluntarily by applicants).
Data subjects: applicants
Purposes of processing: applicant selection procedure
Legal bases: Article 6(1)(b) of the GDPR in conjunction with Section 26(1) of the BDSG, legitimate interests (Article 6(1) sentence 1(f) of the GDPR)
Service providers used
We use the following third-party providers to carry out the online application procedure:
- Salesforce: applicant management system and candidate database; service provider: salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 München
- Cloudworx: process automation in Salesforce; service provider: cloudworx GmbH, Rupert-Mayer-Straße 44, Gebäude 64.07a, 81379 München
- Microsoft Teams: interviews with applicants; service provider: Microsoft Ireland Operations, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland
- Cal.com: appointment booking; operated on our own servers
- netcup: hosting of our servers; service provider: netcup GmbH, Karlsruhe
- Hetzner: data backup; service provider: Hetzner Online GmbH, Gunzenhausen
Talent pool
As part of the application, we offer applicants the opportunity to be included in our ‘talent pool’ on the basis of consent within the meaning of Article 6(1)(a) and Article 7 of the GDPR.
The application documents in the talent pool are processed solely in the context of future job vacancies and are destroyed at the latest after a period of one year has elapsed. Inclusion in the talent pool is voluntary and has no influence on the current application procedure. This consent is voluntary and can be withdrawn at any time with future effect.
Rights of data subjects
As a data subject, you have various rights under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:
Right to object:
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
Right to withdraw consent:
You have the right to withdraw consent you have given at any time.
Right of access:
You have the right to request confirmation as to whether data concerning you is being processed and to obtain access to this data as well as further information and a copy of the data in accordance with the statutory requirements.
Right to rectification:
In accordance with the statutory requirements, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
Right to erasure and restriction of processing:
In accordance with the statutory requirements, you have the right to request that data concerning you be erased without undue delay or, alternatively, in accordance with the statutory requirements, to request the restriction of the processing of the data.
Right to data portability:
You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the statutory requirements, or to request its transmission to another controller.
Complaint to a supervisory authority:
In accordance with the statutory requirements, you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.
Career coaching
Integration of the booking system
On the career coaching page, we integrate the booking system Cal.com, which we operate on our own servers. When the page is accessed, a script is loaded from calcom.constares.org for this purpose. In the process, your IP address is transmitted to this server. The legal basis is our legitimate interest in simple appointment booking (Article 6(1)(f) of the GDPR).
To provide the booking function, Cal.com may store information on your device or read information stored on it (e.g. cookies, local storage or session storage), for example to save display settings, your time zone or the status of your booking. This only takes place to the extent that it is strictly necessary for the appointment booking you have expressly requested (Section 25(2) no. 2 of the TDDDG).
What data we process and for what purpose
If you book an orientation call, we process your name, email address, telephone number, the selected appointment and the information you provide in the booking form. If you order a coaching package, we additionally process the selected package and your billing data (name, address, email address). To carry out the coaching, we process the documents and information you provide to us, in particular your CV, target roles, job advertisements and your LinkedIn profile, as well as our notes from the sessions.
Legal bases
Processing is carried out to implement pre-contractual measures and to perform the contract (Article 6(1)(b) of the GDPR). We retain billing data on the basis of legal obligations (Article 6(1)(c) of the GDPR in conjunction with Section 147 of the AO (German Fiscal Code, Abgabenordnung) and Section 257 of the HGB (German Commercial Code, Handelsgesetzbuch)). Your documents will only be passed on to third parties or included in our candidate pool with your express consent (Article 6(1)(a) of the GDPR). You can withdraw this consent at any time with future effect.
Recipients
Your data is only received by our hosting service provider, netcup GmbH, Karlsruhe, for hosting our servers, Hetzner Online GmbH, Gunzenhausen, for data backup, DATEV eG for invoicing and accounting, our tax advisers and, for video calls, the video conferencing service we use. Data processing agreements are in place with all service providers. We do not pass on your data to employers without your express consent.
Retention period
We delete your coaching documents and session notes as soon as they are no longer required for carrying out the coaching, at the latest 12 months after conclusion of the contract. We store billing data for the duration of the statutory retention periods of up to ten years. If you have consented to inclusion in our candidate pool, we store your data until you withdraw your consent.
Obligation to provide data
Without the data mentioned, we cannot conclude the contract or carry out the coaching.