Privacy policy

1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we explain how your personal data is handled when you use our website. Personal data means any data that can be used to identify you personally.

1.2 The controller responsible for processing data on this website within the meaning of the General Data Protection Regulation (GDPR) is Prof. Dr. Sascha J. Flemnitz, ExCaMa | Experts. Career. Management, Fraunhoferstr. 31, 10587 Berlin, Germany, telephone: +49 30 86322952, email: info@excama.de.

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

2) Data collected when you visit our website

2.1 When you use our website solely for information purposes, meaning that you do not register or otherwise provide us with information, we collect only the data that your browser transmits to the website’s server (“server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• The page of our website visited
• Date and time of access
• Amount of data transmitted in bytes
• Source or referring page from which you reached our website
• Browser used
• Operating system used
• IP address used, where applicable in anonymised form

This data is processed pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is neither disclosed nor used for any other purpose. However, we reserve the right to review the server log files retrospectively if there are specific indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content, such as orders or enquiries addressed to the controller, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the “https://” prefix and the padlock symbol in your browser’s address bar.

3) Hosting & Content Delivery Network

To host our website and display its content, we use a provider that delivers its services, either itself or through selected subcontractors, exclusively on servers located within the European Union.

All data collected on our website is processed on these servers, unless different data recipients are specified below for particular processing activities.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

4) Cookies

To make your visit to our website more appealing and enable certain functions, we use cookies, which are small text files stored on your device. Some cookies are automatically deleted when you close your browser (“session cookies”), while others remain on your device for longer and allow website settings to be saved (“persistent cookies”). For persistent cookies, you can find the storage period in your browser’s cookie settings overview.

Where individual cookies used by us also involve the processing of personal data, that processing takes place pursuant to Article 6(1)(b) GDPR for the performance of a contract, pursuant to Article 6(1)(a) GDPR where consent has been given, or pursuant to Article 6(1)(f) GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and making your visit user-friendly and effective.

You can configure your browser to notify you when cookies are set and decide individually whether to accept them, or to reject cookies in specific cases or altogether.

Please note that rejecting cookies may restrict the functionality of our website.

5) Contacting us

When you contact us, for example through a contact form or by email, personal data is collected. The data collected when you use a contact form is apparent from the respective form. This data is stored and used exclusively to respond to your enquiry or to communicate with you, and for the associated technical administration.

The legal basis for processing this data is our legitimate interest in responding to your enquiry pursuant to Article 6(1)(f) GDPR. If you contact us with a view to entering into a contract, Article 6(1)(b) GDPR provides an additional legal basis for processing. Your data will be deleted once your enquiry has been fully dealt with. This is the case when the circumstances indicate that the matter concerned has been conclusively resolved, provided that no statutory retention obligations prevent deletion.

6) Website functionality

Google reCAPTCHA

On this website, we use the CAPTCHA service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Data may also be transferred to Google LLC, USA.

To display the CAPTCHA window, the provider uses “Google Fonts”, meaning fonts loaded from Google over the internet. This does not involve processing any information beyond the information described above that is already transmitted to Google through the reCAPTCHA functionality.

The service checks whether an input is made by a natural person or abusively through automated, machine-based processing, and blocks spam, DDoS attacks and similar malicious automated access. To establish that an action is performed by a human rather than an automated bot, the provider collects the IP address of the device used, identifying information about the browser and operating system types, and the date and duration of the visit, and transmits this information to its servers for analysis. Cookies may be used for this purpose. These are small text files stored in the browser on the device.

Where the processing described above involves cookies, these are set only if you have given us your express consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by disabling this service in the cookie consent tool provided on the website.

Where the processing described above takes place without cookies, the legal basis is our legitimate interest in establishing individual accountability on the internet and preventing abuse and spam pursuant to Article 6(1)(f) GDPR.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

For transfers of data to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with European data protection standards on the basis of an adequacy decision adopted by the European Commission.

7) Tools and other services

7.1 Cookie consent tool

This website uses a cookie consent tool to obtain valid user consent for cookies and cookie-based applications that require consent. When users access the website, the tool appears as an interactive interface where they can give consent to specific cookies and/or cookie-based applications by selecting checkboxes. The tool ensures that all cookies and services requiring consent are loaded only when the user has given the corresponding consent by selecting a checkbox. This ensures that such cookies are stored on the user’s device only where consent has been given.

The tool sets technically necessary cookies to store your cookie preferences. As a rule, no personal user data is processed for this purpose.

If, in an individual case, personal data such as an IP address is nevertheless processed to store, assign or record cookie settings, this processing takes place pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly cookie consent management and, consequently, in operating our website in compliance with the law.

Article 6(1)(c) GDPR provides a further legal basis for processing. As the controller, we are legally obliged to make the use of cookies that are not technically necessary conditional on the user’s consent.

Where required, we have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

Further information about the operator and the settings available in the cookie consent tool can be found directly in the corresponding interface on our website.

7.2 Papierkram

For our bookkeeping, we use the cloud-based accounting software service provided by odacer Finanzsoftware GmbH, Konrad-Adenauer-Ring 13, 65187 Wiesbaden, Germany.

The provider processes our business’s incoming and outgoing invoices and, where applicable, bank transactions to capture invoices automatically, match them to transactions and prepare the financial accounts through a partially automated process.

Where this also involves the processing of personal data, that processing takes place on the basis of our legitimate interest in efficiently organising and documenting our business transactions pursuant to Article 6(1)(f) GDPR.

8) Rights of the data subject

8.1 Applicable data protection law grants you the following rights against the controller in relation to the processing of your personal data (rights of access and intervention). The conditions for exercising each right are set out in the legal provisions cited:

• Right of access pursuant to Article 15 GDPR;
• Right to rectification pursuant to Article 16 GDPR;
• Right to erasure pursuant to Article 17 GDPR;
• Right to restriction of processing pursuant to Article 18 GDPR;
• Right to notification pursuant to Article 19 GDPR;
• Right to data portability pursuant to Article 20 GDPR;
• Right to withdraw consent pursuant to Article 7(3) GDPR;
• Right to lodge a complaint pursuant to Article 77 GDPR.

8.2 RIGHT TO OBJECT

WHERE, FOLLOWING A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

WHERE WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. YOU MAY EXERCISE YOUR OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

9) Retention of personal data

The period for which personal data is retained depends on the applicable legal basis, the purpose of processing and, where relevant, the applicable statutory retention period, such as retention periods under commercial and tax law.

Where personal data is processed on the basis of express consent pursuant to Article 6(1)(a) GDPR, the data concerned is retained until you withdraw your consent.

Where statutory retention periods apply to data processed in connection with contractual or quasi-contractual obligations on the basis of Article 6(1)(b) GDPR, that data is routinely deleted after those periods expire, provided that it is no longer required to perform a contract or take steps towards entering into one and/or we no longer have a legitimate interest in retaining it.

Where personal data is processed on the basis of Article 6(1)(f) GDPR, it is retained until you exercise your right to object under Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes on the basis of Article 6(1)(f) GDPR, it is retained until you exercise your right to object under Article 21(2) GDPR.

Unless the other information in this policy concerning specific processing situations states otherwise, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.