We - rindus GmbH ("rindus" or "we") - would like to let you know how we process your personal data in accordance with the General Data Protection Regulation ("GDPR").
Our Privacy Policy has a modular structure. It consists of general information for all processing of personal data and processing situations (I.) and special information, the content of which relates only to the processing situation specified there (II. et seqq.).
The controller within the meaning of the GDPR and other national data protection laws of the member states as well as other data protection regulations is:
Rindus GmbH
Freibadstraße 30, 81543 Munich, Germany
Email: info@rindus.de
Our external data protection officer is:
ARTANA Digital GmbH
Prof. Dr. Christian Rauda
Alstertwiete 3, 20099 Hamburg, Germany
Email: privacy@artana.law
We process some of your personal data based on the following legal bases:
a) The data subject’s consent
Insofar as we obtain the consent of the data subject for certain purposes, Art. 6 (1) sentence 1 lit. a GDPR is the legal basis.
b) FulfilLment of contractual obligations
Insofar as the processing is necessary for the fulfilment of a contract to which you are a party, Art. 6 (1) sentence 1 lit. b GDPR is the legal basis. This also applies to processing procedures that are necessary for the implementation of pre-contractual measures.
c) Legal requirements and obligations
Insofar as the processing is necessary for the fulfilment of a legal obligation to which we are subject, Art. 6 (1) sentence 1 lit. c GDPR is the legal basis.
d) Safeguarding legitimate interests
Insofar as processing is necessary to safeguard our legitimate interests or those of a third party and your interests, fundamental rights and freedoms do not outweigh the interest of the former, Art. 6 (1) sentence 1 lit. f GDPR is the legal basis.
Personal data will be deleted or disabled as soon as there is no longer a legal basis for processing it.
Internally, only those departments that need it to fulfil their processing purposes, process personal data. This also applies to the processors, service providers and vicarious agents engaged by us. All bodies and persons who work with personal data are obliged to maintain data confidentiality and have been made aware of the sensitive handling of such data.
Personal data will only be passed on to third parties if this is in accordance with data protection regulations. In particular, persons engaged to conduct our business operations (e.g. banks, payment service providers, tax advisers, service providers for EDP and IT services) and government agencies/authorities may receive your personal data insofar as this is necessary in order to fulfil a legal obligation.
In some cases, our services require personal data to be processed in countries outside the EU/EEA ("third countries") by our processors. Insofar as personal data is processed and there is no level of data protection corresponding to the European standard in the country that has been recognised by an adequacy decision in accordance with Art. 45 (3) GDPR by the EU Commission, we have implemented appropriate safeguards within the meaning of Art. 46 GDPR, signing EU standard contractual clauses with the processors concerned. A copy of the EU standard contractual clauses can be found here: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN.
Insofar as processing takes place in a third country, we draw your attention to the following points.
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis us as the controller:
In accordance with Art. 15 GDPR, you have the right to request information about the personal data processed by us. In particular, you can request:
- Information about the purposes of processing.
- The data category.
- The categories of recipients to whom your data has been or will be disclosed and information as to whether the personal data will - be transferred to a third country or to an international organisation (in this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR).
- The planned retention period.
- The existence of a right to rectification, to erasure, to restrict processing or to object.
- The existence of a right of appeal.
- The origin of your data if it was not collected by us.
And the existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR and - at least in these cases - meaningful information on the logic involved and the scope and intended effects of such processing for the data subject.
In accordance with Art. 16 GDPR, you have the right to rectification and/or completion of your personal data if it is incorrect or incomplete. We must make the correction without delay.
In accordance with Art. 18 GDPR, you have the right to demand the restriction of the processing of your data if the accuracy of the data is disputed by you or the processing is unlawful.
If a restriction of processing is in force, we shall inform you before the restriction is lifted.
In accordance with Art. 17 GDPR, you have the right to erasure of your personal data, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.
If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom the personal data have been disclosed, of the rectification, erasure of the personal data or restriction of processing, unless this proves impossible or involves a disproportionate effort.
In accordance with Art. 20 GDPR, you have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller.
In accordance with Art. 21 GDPR, you have the right to object to the processing if the processing is based on Art. 6 (1) sentence 1 lit. e or lit. f GDPR.
In accordance with Art. 7 (3) GDPR, you have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
We are responsible for our website www.rindus.de and its subpages ("website"). Personal data is processed when you use our website. We provide detailed information below about the data processing that is carried out.
When our website is accessed, we automatically collect data and information from the user's end device (so-called log files).
Processor
To provide our website and the services contained therein, we use the processor Hubspot, Inc., 25 First Street, Cambridge, MA 02141, USA ("Hubspot"), with whom we have concluded a data processing agreement and who processes the personal data exclusively on our behalf. Insofar as Hubspot processes data outside the EU/EEA, the transfer of data to the USA takes place on the basis of EU standard contractual clauses and the EU/US Data Privacy Framework, with which Hubspot is registered.
Processed information & duration of the processing
The following information is processed:
- Information about the browser type and version used.
- The operating system of the end device.
- The user's internet service provider.
- The IP address of the end device.
- Date and time of access.
The log files are deleted within 14 days at the latest.
Purpose of processing & legal basis
The data is required in order to display the website on the user's device, to ensure its functionality and to analyse any malfunctions. We also use the data to optimise the website and to ensure the security of our information technology systems.
The legal basis is Art. 6 (1) sentence 1 lit. f GDPR. The collection of log files is absolutely necessary for the operation of the website. Consequently, there is no possibility of objection on the part of the user.
We use cookies on our website. These are text files that are stored in or by the Internet browser on the system of the user's device when visiting a website.
Processor
The Consent Manager is also provided by our processor Hubspot.
Processed information & duration of the processing
Each cookie contains a characteristic character string that makes it possible to uniquely identify the browser the next time the website is accessed and thus the respective user device.
Information on which necessary cookies are used for which specific purposes, the recipients of the associated data and the duration of processing, can be found in our Consent Manager.
Purpose of processing & legal basis
Some functions on our website cannot be performed without the use of cookies. For example, it may be necessary to use so-called counting cookies to prevent the website from being overloaded. Session cookies may also be required in order to retain the selected language setting of the website for future visits. In addition, mandatory cookies also serve to enable our system to recognise whether the user has consented to the placement of cookies in their browser or has restricted them (so-called opt-out cookies). Cookies that are technically necessary are not used to determine the identity of the user or to create user profiles.
The legal basis for the storage of mandatory cookies is Sec. 25 (2) No. 2 TTDSG.
The legal basis for processing the resulting personal data is Art. 6 (1) sentence 1 lit. f GDPR.
The use of these cookies is absolutely necessary for the operation of the website. Consequently, there is no possibility of objection on the part of the user.
We use several additional Hubspot services from our processor Hubspot on our website:
We use Hubspot fonts on this website, i.e. fonts and characters (icons) from Hubspot. When you visit our website, the fonts are loaded via a Hubspot server using Hubspot Fonts. These external calls transmit data such as the user's IP address to the Hubspot servers. The legal basis for data processing at Hubspot Fonts is our overriding legitimate interest in the appealing presentation and simple functionality of our website in accordance with Art. 6 (1) lit. f) GDPR.
The web analysis service Hubspot Analytics is used on this website if you have given your consent.
Hubspot Analytics uses cookies that enable us to analyse how you use our website. The following categories of data are processed:
- IP address.
- Date, time.
- Queried page.
- Browser information.
- Data on how the website is used and the logging of clicks on individual elements.
Purpose of the processing: Anonymization and compilation of statistics, analysis of user behaviour and optimisation of content.
The legal basis for this data processing is your consent in accordance with Sec. 25 (1) TTDSG in conjunction with Art. 6 (1) sentence 1 lit. a GDPR. You can revoke your consent at any time with effect from the future by accessing the cookie settings in our Consent Manager and changing your selection there. You will also find information there on the cookies processed and their storage duration. The legality of the processing carried out on the basis of the consent remains unaffected until revocation.
The following information applies to all communication with us.
If the communication takes place within a customer relationship or another contractual relationship, the data processing is also governed by the supplementary information under IV.
If the communication pertains to an application as a candidate with us, the data processing is also based on the supplementary information under V.
You can contact us by telephone.
Processed information & duration of the processing
In addition to your telephone number, we process the personal data that you provide to us during the conversation.
The data will be deleted as soon as the matter has been resolved with you, unless there is another reason for processing it.
Purpose of processing & legal basis
The personal data will be processed exclusively for the purpose of processing the enquiry and in the event of follow-up questions.
If the communication pertains to the conclusion of a contract, the legal basis for the processing is Art. 6 (1) sentence 1 lit. b GDPR.
In all other cases, Art. 6 (1) sentence 1 lit. f GDPR is the legal basis. Your interest does not outweigh our interest in responding to your enquiry; since you are calling us, it is also in your interest to respond and you are aware that we need to process your personal data in order to respond to your enquiry.
You can contact us by email. We would like to point out that it is possible for third parties to gain an insight into email communication. If it is important to you that the information you provide is not exposed to the risk of illegal access by third parties, then we recommend a different communication channel. However, if you contact us by email, we assume that you are also interested in further communication via this channel.
Processed information & duration of processing
In addition to your email address, we process the personal data that you provide to us in the course of email communication.
The data will be deleted as soon as the matter has been resolved with you, unless there is another reason for processing it.
Purpose of processing & legal basis
The personal data will be processed exclusively for the purpose of processing the enquiry and in the event of follow-up questions.
If the communication pertains to the conclusion of a contract, the legal basis for the processing is Art. 6 (1) sentence 1 lit. b GDPR.
In all other cases, Art. 6 (1) sentence 1 lit. f GDPR is the legal basis. Your interest does not outweigh our interest in responding to your enquiry; since you are writing to us, it is also in your interest to respond and you are aware that we need to process your personal data in order to respond to your enquiry.
We also use video calls for communication.
Processor
To carry out video calls we use the services "Google Meet" from Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland), "Zoom" from Zoom Video Communications, Inc., (55 Almaden Blvd., San Jose, Ca 95113, USA) and "Teams" from Microsoft Ireland Operations Ltd. (South County Business Park, One Microsoft Place, Dublin, D18 P521, Ireland) as our data processors. We have concluded a data processing agreement with each of the processors. The processors may process personal data in the USA in order to ensure a smooth video call. Google Ireland Ltd. and Microsoft Ireland Operations Ltd. have therefore concluded appropriate safeguards pursuant to Art. 46 GDPR EU standard contractual clauses with their respective parent company Google LLC. or Microsoft Corporation or transfer data to the USA on the basis of an adequacy decision with respective certification in accordance with the EU Data Privacy Framework (DPF). Zoom Video Corporation, Inc. also transfers data to the USA on the basis of an adequacy decision with certification in accordance with the DPF.
Processed information & duration of the processing
The following communications data is processed during video calls:
- Personal master data (if you provide this information yourself).
- Content of the online meeting (if you appear in person and contribute verbally or in writing).
- Authentication data.
- Log files, log data.
- Meta data (e.g. IP address, time of your participation, etc.).
- Profile data (e.g. your user name, if you provide this yourself).
The personal data will be deleted as soon as the matter with you has been resolved and provided there is no other reason for processing it.
Purpose of processing & legal basis
The personal data will be processed exclusively for the purpose of processing the enquiry and in the event of follow-up questions.
If the communication pertains to the conclusion of a contract, the legal basis for the processing is Art. 6 (1) sentence 1 lit. b GDPR.
In all other cases, Art. 6 (1) sentence 1 lit. f GDPR is the legal basis. Your interest does not outweigh our interest in responding to your enquiry; since you are writing to us, it is also in your interest to respond and you are aware that we need to process your personal data in order to respond to your enquiry.
As part of an application process or contact confirmation, we process the data you have provided or communicated to us after receiving your application and which is necessary for us to carry out an application process.
The following categories of data are processed:
Master data (last name, first name, name affixes, and date of birth)
Contact details (address, email, telephone number)
Any other information you have provided yourself
Documents sent to us and their content (e.g., cover letter, resume, certificates, proof of employment, references, residence permit, work permit).
The legal basis for this is the initiation of a contractual relationship with you; Art. 6 (1) (b)
GDPR.
In addition, we may process personal data that we have obtained in a permissible manner from publicly available sources or personal contacts (e.g., from joint communication on a professional social network such as LinkedIn) for the purpose of contacting you or after receiving your application for the purpose of conducting the application process. This includes, in particular, your name, LinkedIn link, current position, current employer, and any correspondence with you via those services. The legal basis for this is our overriding legitimate interest in establishing targeted communication with potential applicants via professional social networks and the mutual interest of the users of these networks; Art. 6 (1) (f) GDPR. The data will be deleted as soon as a user deletes their account on the professional social network.
If, in the context of your application or when contacting us, you voluntarily provide us with special categories of personal data within the meaning of Art. 9 GDPR (e.g. information about an existing severe disability or attach a photo to your application that shows, for example, glasses and thus a visual impairment), this is done on the basis of your consent that we may process the relevant data after receipt of your application for the purpose of carrying out the application process. The legal basis for the processing of special
categories of personal data is your consent pursuant to Art. 6 (1) (a) and Art. 9 (2) (a) GDPR. You can revoke your consent at any time without giving reasons by contacting us. The lawfulness of the processing carried out on the basis of your consent until revocation remains unaffected.
In order to better assess your job history, you can agree to us contacting your previous employer ("reference call"). The legal basis for data processing in the case of a reference call is your consent pursuant to Art. 6 (1) (a) GDPR. You can revoke your consent at any time without giving reasons by contacting us. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected. We would like to point out that this consent is voluntary. Nevertheless, we must point out that we cannot continue the application process without a reference call.
In the event of rejection or loss of interest in a specific job offer, you can consent to the longer storage of your data in our applicant database in order to provide you with further job offers that may be of interest to you in the future. The legal basis for the longer processing of data in the applicant database is your consent pursuant to Art. 6 (1) (a) GDPR. You can revoke your consent at any time without giving reasons by contacting us. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.
The recipients of your personal data are only those persons at our company who need your data to decide on the establishment of an employment relationship and the subsequent implementation of the decision made or, in the event of contact with you, to inquire about your interest in career prospects and job offers at our company. Contact will be made with the utmost confidentiality, usually by telephone or email using the contact details you have provided.
There are no automated individual decisions or profiling measures.
We only process your personal data until the purpose of the processing no longer applies or you revoke your consent, unless this conflicts with legal obligations (e.g., documentation and retention obligations under tax and occupational safety laws).
If our efforts result in you starting employment with us, we will store your data for as long as we need it for the lawful and proper establishment, implementation, and termination of the employment relationship and for the processing of related business activities. We will then delete your data, provided that there are no legal obligations to the contrary (e.g., documentation and retention obligations under tax and occupational safety laws).
If, on the other hand, our efforts do not lead to the establishment of an employment relationship but to a rejection (either by you or by us), we will store your data on the basis of Art. 6 (1) (f); 9 (2) (f) GDPR for as long as this is necessary to defend against any claims resulting from the rejection of the application, but generally only for six months from the date of rejection.
In addition, the following information applies to you if we have a contractual relationship with each other
Processed information & duration of the processing
Which of your data is processed in detail depends on the responsibilities within the contractual relationship. We use the personal information solely for the purpose for which it was provided to us. These are, for example, personal details (name, address and other contact details, date and place of birth). In addition, this may also include order data (e.g. payment order), data resulting from the fulfilment of our contractual obligations (e.g. turnover data in payment transactions), information about your financial situation (e.g. creditworthiness data), advertising and sales data as well as other data comparable with the categories mentioned.
The personal data will be deleted as soon as the contractual relationship with you has ended and provided there is no other reason for processing it.
Purpose of processing & legal basis
The processing is mainly carried out for the purpose of establishing and implementing the contractual relationship; the legal basis is Art. 6 (1) sentence 1 lit. b GDPR.
In addition, we also process your data in part on the basis of our legitimate interest, namely for the purposes of contact and communication management, profitability checks, contract and project management and to ensure the operation of information and telecommunications systems. The legal basis is Art. 6 (1) sentence 1 lit. f GDPR.
As a company, we are also bound by various legal obligations with which we must comply under applicable laws and regulations. The legal basis for processing for the purposes of fulfilling legal requirements and obligations is Art. 6 (1) sentence 1 lit. c GDPR. This includes, for example, retention obligations under tax law.
