Privacy at AKRA

1. responsible person

The party responsible for this website is

AKRA GmbH
Domstraße 17
20095 Hamburg

Further information about our company and the authorized representatives can be found in our imprint.

2. legal bases of data processing

In order to be able to offer you our website and the associated services, we process personal data on the basis of the following legal bases:

• Consent (Art. 6 para. 1 lit. a) GDPR)
• for the fulfillment of contracts (Art. 6 para. 1 lit. b) GDPR)
• on the basis of a balancing of interests (Art. 6 para. 1 lit. f) GDPR)
• for the fulfillment of a legal obligation (Art. 6 para. 1 lit. c) GDPR)

We will refer to the relevant terms in connection with the respective processing so that you can classify the basis on which we process personal data.

If personal data is processed on the basis of your consent, you have the right to withdraw your consent from us at any time with effect for the future.

If we process data on the basis of a balancing of interests, you as the data subject have the right to object to the processing of personal data, taking into account the provisions of Art. 21 GDPR.

3. what data is processed?

3.1 Access data

When you visit our website, personal data is processed in order to display the content of the website on your device.

In order for the pages to be displayed in your browser, the IP address of the end device you are using must be processed. Further information about the browser on your device is also required.

We are also obliged under data protection law to guarantee the confidentiality and integrity of the personal data processed with our IT systems.

For this purpose and out of this interest, the following data is logged on the basis of a balancing of interests in accordance with Art. 6 Para. 1 lit. f) GDPR:

• IP address of the accessing computer (for a maximum of 7 days)
• Operating system of the calling computer
• Browser version of the calling computer
• Name of the retrieved file
• Date and time of retrieval
• Amount of data transferred
• Referring URL

The IP address is deleted from all systems used in connection with the operation of this website after 7 days at the latest. We can then no longer establish a personal reference from the remaining data.

Our interest in processing is to be able to avert possible risks to the website, but also to be able to identify and rectify errors on the website.

3.2 Contact form

We offer a contact form on our website that you can use to request information about our products or services or to contact us in general. We have marked the data you are required to provide in order to respond to an inquiry as mandatory fields. Information on other data fields is voluntary. The data you enter in the contact form will be stored by us for the purpose of processing your inquiry.

The data processing of this data takes place in the case of specific inquiries for the fulfillment of a contract or the initiation of a contract in accordance with Art. 6 para. 1 lit. b) GDPR. For all other inquiries, the processing is based on our legitimate interest in the effective processing of the inquiry addressed to us in accordance with Art. 6 para. 1 lit. f).

Inquiries received via the contact form on our website will be processed by e-mail and stored by us until you ask us to delete them, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your inquiry has been fully processed). Legal provisions - in particular retention periods - remain unaffected.

The transmission of form data via the Internet takes place via encrypted connections.

3.3 Application

We are delighted that you are interested in our company and wish to apply or have applied for a position in our company. We would like to provide you with the following information on the processing of your personal data in connection with your application.

We process the data that you have sent us in connection with your application in order to check your suitability for the position (or any other open positions in our companies) and to carry out the application process. In particular, this involves the following data:

• Master data (name, address, contact details)
• Application documents (cover letter, curriculum vitae, certificates, qualifications
• any other information that you have voluntarily provided to us

The legal basis for the processing of your personal data in this application procedure is § 26 para. 1 sentence 1 BDSG-new in conjunction with Art. 6 para. 1 lit. b) GDPR. Accordingly, the processing of data required in connection with the decision on the establishment of an employment relationship is permitted.

Should the data be required for legal prosecution after completion of the application process, data processing may be carried out on the basis of the requirements of Art. 6 GDPR, in particular to safeguard legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR. Our interest then lies in legal prosecution.

Applicants' data will be deleted after 6 months in the event of rejection, unless you have consented to a longer retention period or there are statutory retention obligations.

In the event that you have consented to further storage of your personal data in accordance with Art. 6 para. 1 lit. a) GDPR, we will transfer your data to our applicant pool. There the data will be deleted after two years.

If you have been accepted for a position as part of the application process, the data from the applicant data system will be transferred to our personnel information system.

Your application data will be reviewed by the HR department after receipt of your application. Suitable applications are then forwarded internally to the department managers responsible for the respective open position. The next steps are then agreed. Within the company, only those persons have access to your data who need it for the proper course of our application procedure.

3.4 Bullhorn applicant pool

We process the data you have sent us in order to be included in our applicant pool so that we can check your suitability for a suitable position and carry out the application process on behalf of our clients.

We collect and process your data for the purpose of job placement by us on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR. You thereby consent to us including the data collected from you in our applicant pool, contacting you by telephone and/or email and forwarding the data to suitable job providers (our customers). You can revoke this consent at any time without giving reasons.

If a forwarding to one of our customers takes place, its legal basis for the processing of your personal data in an application procedure is primarily § 26 BDSG-new. This permits the processing of data required in connection with the decision to establish an employment relationship.

Our legal basis will not change.

Should the data be required for legal prosecution after completion of the application process, data processing may be carried out on the basis of the requirements of Art. 6 GDPR, in particular to safeguard legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR. Our interest then lies in legal prosecution.

Initially, your data will only be processed within our company by persons authorized to do so. In the course of our recruitment activities, we will pass on your data to our customers if we have found a suitable job position. We will also use external service providers. In all cases, we will ensure that appropriate agreements regulate the handling of your data in accordance with data protection regulations. In any case, only authorized persons will have access to your data.

Data will only be passed on to third parties under the following circumstances:

• We may pass on your data to customers in order to fill a suitable job position.
• We use IT service providers for processing. The service providers only have access to the personal data that they need in order to carry out their activities. No other purposes are permitted. We have concluded order processing contracts with these service providers.
• By including you in the applicant pool, we can forward your data to our customers at any time without renewed consent and obtain suitable offers for you.
• We may forward your data to government agencies if we are legally obliged to do so. The legal basis for the use of your data is Art. 6 para. 1 lit. c) GDPR.
• We may also forward the data to tax, audit or other authorities if we are convinced that we are obliged by law or another regulation to forward this data (for example, because there is a request from a tax authority or in connection with a prospective legal dispute). The legal basis here is also Art. 6 para. 1 lit. c) GDPR.

In the event that you have consented to the storage of your personal data, we will transfer your data to our applicant pool. The data will be deleted there after two years unless you give your consent again.

We use a specialized software provider for the active sourcing process. This provider acts as a service provider for us and may also obtain knowledge of your personal data in connection with the maintenance and servicing of the systems. We have concluded a so-called order processing contract with this provider, which ensures that the data processing is carried out in a permissible manner.

Your data will be reviewed by our recruiting department after you have given your consent. Suitable candidates will then be forwarded internally to the department managers responsible for the respective open position. The further process is then coordinated. Within the company, only those persons have access to your data who need it for the proper execution of our active sourcing process.

The data is processed exclusively in data centers in the Federal Republic of Germany.

3.5 Cookies

No cookies are used on our websites.

3.6 Analysis services for websites, tracking

Plausible.io

We use the web analysis tool "Plausible" on our website to understand and improve the use of our website. This tool is installed on our own servers. No personal data is collected in connection with the tool. No cookies are set or other information stored in the browser.
Further information about the provider can be found at
Plausible Insights OÜ, Västriku tn 2, 50403, Tartu, Estonia. https://plausible.io/. Information on data protection: https://plausible.io/data-policy

3.7 Microsoft Teams

We use the "Microsoft Teams" tool to conduct telephone conferences, online meetings, video conferences and/or webinars (hereinafter: "online meetings"). This service is provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

If you access the "Microsoft Teams" website, the provider of "Microsoft Teams" is responsible for data processing. However, accessing the website is only necessary for the use of "Microsoft Teams" in order to download the software for the use of "Microsoft Teams".

If you do not want to or cannot use the "Microsoft Teams" app, you can also use "Microsoft Teams" via your browser. The service is then also provided via the "Microsoft Teams" website.

Various types of data are processed when using "Microsoft Teams". The legal basis for data processing when conducting "online meetings" is Art. 6 para. 1 lit. b) GDPR, insofar as the meetings are conducted within the framework of contractual relationships. If there is no contractual relationship, the legal basis is Art. 6 para. 1 lit. f) GDPR. Here too, we are interested in the effective conduct of "online meetings".

The following personal data is processed:

• User details: e.g. display name, e-mail address if applicable, profile picture (optional), preferred language
• Meeting metadata: e.g. date, time, meeting ID, telephone numbers, location
• Text, audio and video data: You may have the option of using the chat function in an "online meeting". In this respect, the text entries you make are processed in order to display them in the "online meeting". In order to enable the display of video and the playback of audio, the data from the microphone of your end device and from any video camera of the end device will be processed accordingly for the duration of the meeting. You can switch off or mute the camera or microphone yourself at any time via the "Microsoft Teams" applications.

We use "Microsoft Teams" to conduct "online meetings". If we want to record "online meetings", we will inform you transparently in advance and - if necessary - ask for your consent.

The chat content is logged when using Microsoft Teams. We store the chat content for a period of ten years. If it is necessary for the purposes of logging the results of an online meeting, we will log the chat content. However, this will not usually be the case.

Automated decision-making within the meaning of Art. 22 GDPR is not used.

You can find more information here: https://privacy.microsoft.com/de-de/privacystatement

3.8 Contact questionnaire at career fairs

We would like to intensify contact with potential new employees at careers fairs. We have created a contact form for this purpose and use the "Microsoft Forms" tool. Microsoft Forms is a service provided by Microsoft Corporation. The processing is carried out on behalf of AKRA by

Microsoft Ireland Operations Limited

One Microsoft Place

South County Business Park

Leopardstown

Dublin 18

D18 P521

Ireland

Please note that this data protection notice only informs you about the processing of your personal data by AKRA when using Microsoft Forms. If you require information about the processing of your personal data by Microsoft, please refer to the relevant Microsoft statement. Here you will find further information from Microsoft on this topic:

Microsoft Privacy Policy - Microsoft Privacy Policy

Microsoft service contract

Security and data protection in Microsoft Forms

Various types of data are processed when using Microsoft Forms. The scope of the data also depends on the information you provide on the contact form, especially if questions are formulated "openly".

The following personal data is processed:

• IP address
• First name
• Surname
• E-mail address
• Telephone number (optional)
• Study (optional)
• Conclusion (optional)

If there are any unanswered questions, you decide which personal data will be transmitted.

Legal basis: The legal basis for this processing is the possible initiation of a contract within the meaning of Art. 6 para. 1 lit. b) GDPR in conjunction with Section 26 BDSG.

The use of the contact form is basically voluntary.

No device identifiers and no other location data are recorded.

We only store the data in the forms for a short period of time and then transfer the data to our internal systems. There we process the data for the duration of the employment or for a maximum of 6 months if a collaboration does not materialize.

4. purposes of the processing of personal data

We process the aforementioned data for the operation of our website and for the fulfillment of contractual obligations towards our customers or the protection of our legitimate interests.

In the case of inquiries from you outside of an active customer relationship, we process the data for sales and advertising purposes. You can object to the use of your personal data for advertising purposes at any time.

5. links to social networks

On our website, we link to the presences in the social networks (Facebook, X (formerly Twitter), XING, LinkedIn and Instagram), which you can use to access our profiles with the respective providers.

If you visit these pages, your personal data will be processed by the respective providers. The providers of Meta and LinkedIn are based in the USA, which means that your data will be transferred to a third country. If you do not wish this to happen, please remain on our website.

In the following, we provide you with data protection information if your data is processed jointly with the providers of the social networks.

5.1 Facebook

If you visit the Facebook website and specifically our website, Facebook (Meta Platforms Ireland Limited, 4 Grand Canal Square, Duplin 2, Ireland, a subsidiary of Meta Platforms Inc, 1601 S. California Ave, Palo Alto, CA 94304, USA) is responsible for the processing of personal data on the Facebook page.

We are jointly responsible with Facebook with regard to individual phases of processing - here specifically the so-called "Insights" function. In this respect, we have concluded an agreement with Facebook on joint responsibility, the content of which you can view here.

We operate the Facebook page to draw attention to our services and products and to get in touch with you as a visitor and user of this Facebook page.

We have no interest in the collection and further processing of your individual personal data for analysis or marketing purposes.

The operation of this Facebook page, including the processing of users' personal data, is based on our legitimate interests (Art. 6 para. 1 lit. f. GDPR) in a contemporary and supportive information and interaction opportunity for and with our users and visitors.

Data may be passed on to service providers and vicarious agents employed by us for the purpose of processing. Provided that they comply with the applicable statutory provisions. We have concluded corresponding contractual agreements on data protection with these parties for this purpose.

We only pass on your personal data to other recipients if this is required by law, if you have given your consent or if we are authorized to do so. If these requirements are met, recipients of personal data may include public bodies and institutions (e.g. law enforcement authorities).

Processing of personal data by Facebook

Facebook uses cookies, i.e. small text files that are stored on the user's various end devices, to store and further process this information. If the user has a Facebook profile and is logged in to it, the storage and analysis also takes place across devices.

Facebook's privacy policy contains further information on data processing : https://www.facebook.com/about/privacy/

Objection options (so-called opt-out) can be set here: https://www.facebook.com/settings?tab=ads and here: https://www.facebook.com/help/contact/6359191084165019.

Meta is based in the USA. This means that data may be transferred to a third country. The conditions for this can be found at https://www.facebook.com/legal/terms/dataprocessing/update.

In addition, Facebook has issued so-called standard contractual clauses for legal protection. Further information is available at: https://www.facebook.com/legal/EU_data_transfer_addendum.

The transfer and further processing of users' personal data to third countries, such as the USA, and the associated potential risks for users cannot be ruled out by us as the operator of the site.

Information on the use of Page Insights and the agreement on joint data processing can be found at https://www.facebook.com/legal/terms/page_controller_addendum.

Statistical data We can access statistical data of various categories via the so-called "Insights" of the Facebook page. These statistics are generated and provided by Facebook. As the operator of the page, we have no influence on the generation and presentation of this data. We cannot deactivate this function or prevent the generation and processing of the data. Facebook provides us with the following data relating to our Facebook page for a selectable period of time and for the categories fans, subscribers, people reached and people interacting:

Total number of page views, "Like" information, page activity, post interactions, reach, video views, post reach, comments, shared content, responses, proportion of men and women, origin in relation to country and city, language, views and clicks in the store, clicks on route planners, clicks on telephone numbers. Data on the Facebook groups linked to our Facebook page is also provided in this way. Due to the constant development of Facebook, the availability and processing of the data changes, so we refer you to the above-mentioned Facebook privacy policy for further details.

We use this data, which is available in aggregated form, to make our posts and activities on our Facebook page more attractive to users. For example, we use the distribution by age and gender for a customized approach and the preferred visiting times of the users for a time-optimized planning of our posts. Information about the type of end devices used by visitors helps us to adapt the visual design of our posts accordingly. In accordance with the Facebook terms of use, which every user has agreed to when creating a Facebook profile, we can identify subscribers and fans of the page and view their profiles and other information shared by them.

User rights

Since only Facebook has full access to user data, we recommend that you contact Facebook directly if you wish to make requests for information or ask other questions about your rights as a user (e.g. right to deletion). If you require assistance with this or have any other questions, please contact us by email at datenschutz@akra.de. If you no longer wish the data processing described here to take place in future, please remove the link between your user profile and our site by using the "I no longer like this page" and/or "No longer subscribe to this page" functions.

5.2 X (formerly Twitter)

You also have the option of sharing our content in the social network X.

If you live in the USA or another country outside the European Union, EFTA States or the United Kingdom, the controller of your personal data is X Corp. at the following address: X Corp, Attn: Privacy Policy, Inquiry, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.

If you live in the European Union, EFTA States or the United Kingdom, the controller of your personal data is Twitter International Unlimited Company with the following address: Twitter International, Unlimited Company, Attn: Data Protection Officer, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, IRELAND.

When you click on the "Re-Tweet" button, the websites you have visited are linked to your X account and made known to other users. Data is also transmitted to X in the process. Details on the handling of your data by X as well as your rights and setting options for protecting your personal data can be found in Twitter's privacy policy: https://x.com/de/privacy

5.3 Xing

You also have the option of sharing our content on the XING social network. The operator of this website is New Work SE, Am Strandkai 1, 20457 Hamburg, Germany.

By clicking on the Xing button, you will be redirected to our Xing account. Data may also be transferred to Xing in the process. Details on the collection of data and your legal options and settings can be found here: https://privacy.xing.com/de/datenschutzerklaerung

5.4 LinkedIn

You also have the option of sharing our content on the social network LinkedIn, LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, a subsidiary of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085 USA.

When you click on the LinkedIn button, you will be redirected to our LinkedIn account. Data will also be transferred to LinkedIn. Details on the collection of data and your legal options and settings options can be found here: https://www.linkedin.com/legal/privacy-policy

5.5 Instagram

We operate an Instagram page that you can follow on the operator platform itself. The operator is Meta Platforms Ireland Limited, 4 Grand Canal Sauare, Dublin 2, Ireland, a subsidiary of Meta Platforms Inc, 1601 S. California Ave, Palo Alto, CA 94304, USA.

If you click on the "Follow" button on our Instagram page, the controller and all other Instagram users will see that you are a fan of our page. As long as you are logged into your Instagram account and visit our Instagram profile, Meta can associate this with your Instagram profile. We expressly point out that Meta stores the data of its users (e.g. personal information, IP address, etc.) and may also use it for business purposes. If you would like to prevent Meta from processing personal data that you have transmitted to us, please contact us by other means. You can find more information about Meta's data processing at https://privacycenter.instagram.com/policy/version/ 7122790421067234 /

Insofar as the data you transmit to us via Instagram is also or exclusively processed by Instagram (Insights data), we are joint controllers with Meta Platforms Ireland Limited for data processing within the meaning of the GDPR. The associated data processing is carried out on the basis of an agreement between joint controllers pursuant to Art. 26 GDPR, which you can view here: www.facebook.com/legal/terms/page_controller_addendum .

You can contact Meta's data protection officer using the online form at https://www.facebook.com/help/contact/540977946302970.

Meta provides us with so-called page insights for our Instagram page: https://help.instagram.com/788388387972460?helpref=related&ref=related .

This is aggregated data that allows us to understand how people interact with our site. Page Insights may be based on personal data collected in connection with a person's visit to or interaction with our site and its content.

You can object to the processing of your data for the aforementioned purposes at any time by changing your settings in your Instagram user account at https://www.instagram.com/accounts/privacy_and_security/.

We operate our Instagram page as part of the balancing of interests pursuant to Article 6(1)(f) GDPR in order to present ourselves to Instagram users and other interested parties and to communicate with them. The processing of users' personal data is based on our legitimate interest in an optimized company presentation.

6. voluntary information

If you voluntarily provide us with data, e.g. in forms, and this data is not required for the fulfillment of our contractual obligations, we process this data on the legitimate assumption that the processing and use of this data is in your interest.

7. disclosure of data

Data that you provide to us will not be passed on to third parties, with the exception of the above-mentioned exceptions. In particular, your data will not be passed on to third parties for their advertising purposes.

However, we may use service providers for the operation of these websites or for other products or services of ours. In such cases, a service provider may obtain knowledge of personal data. We select our service providers carefully - particularly with regard to data protection and data security - and take all measures required under data protection law to ensure permissible data processing.

8. data processing outside the European Union

Insofar as personal data is processed outside the European Union, you can see this in the previous explanations.

9. data protection officer

We have appointed a data protection officer. You can reach him as follows:

B3 Datenschutz GmbH
Dipl. Inf. (FH) Andreas Bethke
Papenbergallee 34
25548 Kellinghusen
E-mail: datenschutz@akra.de

10. your rights as a data subject

You have the right to information in accordance with Art. 15 GDPR about the personal data concerning you. You can contact us at any time for information.

In the case of a request for information that is not made in writing, we ask for your understanding that we may require proof from you that you are the person you claim to be.

Furthermore, you have the right to rectification pursuant to Art. 16 GDPR, erasure pursuant to Art. 17 GDPR or to restriction of processing pursuant to Art. 18 GDPR, insofar as you are legally entitled to this, as well as the right to data portability pursuant to Art. 20 GDPR.

Finally, you have the right to object to processing in accordance with Art. 21 GDPR within the framework of the legal requirements.

If the processing is based on your consent, you can revoke it at any time with effect for the future. The revocation should be sent to datenschutz@akra.de.

Deletion of data

We generally delete personal data when there is no need for further storage. A requirement may exist in particular if the data is still needed to fulfill contractual services, to check and grant or defend against warranty and guarantee claims. In the case of statutory retention obligations, deletion will only be considered after the respective retention obligation has expired.

Right to lodge a complaint with a supervisory authority

You have the right to complain about the processing of personal data by us to a supervisory authority for data protection.

11. amendment of this data protection notice

We will revise this data protection notice in the event of changes to this website or other occasions that make this necessary. You will always find the current version on this website.

Status: 31.05.2024