Data
Protection
This privacy policy clarifies the nature, scope and purpose of the processing of personal data (hereinafter referred to as ‘data’) within our online offer and the associated websites, functions and content as well as external online presences, such as our social media profile. (hereinafter collectively referred to as ‘online offer’).
Lukas Rogge & Drazen Nikolaus GbR
Römerstrasse 15
63450 Hanau
Tel.: +49 69 870046466
E-Mail: info@calmaroi.de
Die Auditoren GmbH
Mercatorstraße 2
40545 Düsseldorf
E-Mail: datenschutzprofi_17@die-auditoren.de
As an intermediary between jobseekers and companies, we process personal data for the purpose of job placement. Furthermore, we process personal data in order to register foreign job seekers in Germany and to accompany their relocation.
‘Personal data’ means any information relating to an identified or identifiable natural person (hereinafter ‘data subject’)
‘Processing’ means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data.
The ‘controller’ is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
A ‘processor’ is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
‘Recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
‘Third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.
Consent is an expression of self-determination under data protection law. It is the voluntary, informed and unambiguous expression of will in the form of a statement or other unambiguous affirmative act by which the data subject indicates that they consent to the processing of their personal data. Consent that has been given can be revoked at any time.
In accordance with Art. 13 GDPR, we inform you of the legal basis of our data processing. If the legal basis is not stated in the privacy policy, the following applies: The legal basis for obtaining consent is Art. 6 para. 1 lit. a and Art. 7 GDPR, the legal basis for processing for the performance of our services and implementation of contractual measures as well as responding to inquiries is Art. 6 para. 1 lit. b GDPR, the legal basis for processing to fulfill our legal obligations is Art. 6 para. 1 lit. c GDPR, and the legal basis for processing to protect our legitimate interests is Art. 6 para. 1 lit. f GDPR. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.
The processing of applicant data is carried out to fulfill our (pre-)contractual obligations in the context of the application process within the meaning of Art. 6 para. 1 lit. b. GDPR Art. 6 para. 1 lit. f. GDPR if the data processing becomes necessary for us, e.g. in the context of legal proceedings (in Germany, § 26, BDSG also applies).
The application procedure requires applicants to provide us with their application data. If we offer an online form, the necessary applicant data is marked, otherwise it is derived from the job descriptions and generally includes personal details, postal and contact addresses and the documents belonging to the application, such as cover letter, CV and certificates. Applicants can also voluntarily provide us with additional information.
By submitting their application to us, applicants consent to the processing of their data for the purposes of the application process in accordance with the type and scope set out in this privacy policy.
Insofar as special categories of personal data within the meaning of Art. 9 para. 1 GDPR are voluntarily communicated as part of the application process, their processing is also carried out in accordance with Art. 9 para. 2 lit. b GDPR (e.g. health data, such as severely disabled status or ethnic origin). Insofar as special categories of personal data within the meaning of Art. 9 para. 1 GDPR are requested from applicants as part of the application process, their processing is also carried out in accordance with Art. 9 para. 2 lit. a GDPR (e.g. health data if this is necessary for the exercise of the profession).
If provided, applicants can send us their applications using an online form on our website. The data is transmitted to us in encrypted form in accordance with the state of the art.
Applicants can also send us their applications by e-mail. Please note, however, that e-mails are generally not sent in encrypted form and applicants must ensure that they are encrypted themselves. We therefore cannot assume any responsibility for the transmission path of the application between the sender and receipt on our server and therefore recommend using an online form or sending it by post. Instead of applying via the online form and e-mail, applicants still have the option of sending us their application by post.
We ask you to inform yourself regularly about the content of our privacy policy. We will adapt the privacy policy as soon as changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.
Right to lodge a complaint with the competent supervisory authority
In the event of breaches of data protection law, the data subject has the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection issues is the state data protection officer of the federal state in which our company is based. The authority responsible for us is
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Website: https://datenschutz.hessen.de
Right of withdrawal
You have the right to withdraw your consent in accordance with Art. 7 (3) GDPR with effect for the future.
Right of objection
You can object to the future processing of data concerning you at any time in accordance with Art. 21 GDPR. In particular, you may object to processing for direct marketing purposes.
Right to information
You have the right to request confirmation from us as to whether we are processing personal data concerning you. If this is the case, you can request the following information:
We will provide you with a copy of the personal data that is the subject of the processing within one month of receiving your request for information. For any further copies you request, we may charge a reasonable fee based on administrative costs. If you make the request electronically, we will provide you with the information in a commonly used electronic format, unless you specify otherwise.
Right to rectification
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure (‘right to be forgotten’)
You have the right to obtain from us the erasure of personal data concerning you without undue delay and we are obliged to erase personal data without undue delay where one of the following grounds applies:
If we have made the personal data concerning you public and we are obliged to delete it, we will take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform data controllers who process the personal data that you have requested them to delete all links to this personal data or copies or replications of this personal data.
The right to erasure (‘right to be forgotten’) does not exist if the processing is necessary:
Right to restriction of processing
You have the right to demand that we restrict the processing of your personal data if one of the following conditions is met:
Where processing has been restricted in accordance with the above conditions, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
If the restriction of processing has been restricted in accordance with the above conditions, we will inform you before the restriction is lifted.
Right to data portability
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another controller without hindrance from us, where the processing is based on consent or on a contract and carried out by automated means.
In exercising the right to data portability, you may request that the personal data be transmitted directly from us to another controller, insofar as this is technically feasible. The exercise of the right to data portability does not affect the right to erasure (‘right to be forgotten’). This right does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
We do not use automated decision-making or profiling.
If cookies or cookie-like technologies are used in the context of data processing, the storage of information in the end user’s terminal equipment or access to information already stored in the end user’s terminal equipment is carried out in accordance with Section 25 (1) TTDDG in conjunction with Art. 6 (1) (a) GDPR (consent).
If the use of cookies is deemed absolutely necessary for the operation of the website, this is done on the basis of Section 25 (2) TDDDG.
[cmplz-cookies]
[cmplz-manage-consent]
We, or our hosting provider, collect on the basis of our legitimate interests within the meaning of Art. 6 para. 1 lit. f. GDPR. GDPR, we collect data about every access to the server on which this service is located (so-called server log files). The access data includes the name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.
Log file information is stored for security reasons (e.g. to investigate misuse or fraud) for a maximum of 7 days and then deleted. Data whose further storage is required for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.
We process inventory data (e.g., names and addresses as well as contact data of users), contract data (e.g., services used, names of contact persons, payment information) for the purpose of fulfilling our contractual obligations and services in accordance with Art. 6 para. 1 lit. b. GDPR. GDPR. Data marked as mandatory in online forms is required for the conclusion of the contract.
As part of the use of our online services, we store the IP address and the time of the respective user action. The storage takes place on the basis of our legitimate interests, as well as those of the user in protection against misuse and other unauthorized use in accordance with Art. 6, para. 1 lit. f. This data is not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so in accordance with Art. 6 para. 1 lit. c GDPR.
When contacting us (e.g. by contact form, email, telephone or via social media), the user’s details are processed to process the contact request and its handling in accordance with Art. 6 para. 1 lit. b) GDPR. The user’s details may be stored in a customer relationship management system (‘CRM system’) or comparable inquiry organization.
We delete the requests if they are no longer required. We review the necessity every two years
On the basis of our legitimate interests (i.e. interest in the analysis, optimization and economic operation of our online offer within the meaning of Art. 6 para. 1 lit. f. GDPR), we use content or service offers from third-party providers within our online offer. GDPR) content or service offers from third-party providers in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as ‘content’).
This always presupposes that the third-party providers of this content are aware of the IP address of the user, as they would not be able to send the content to their browser without the IP address. The IP address is therefore required to display this content. We endeavor to only use content whose respective providers only use the IP address to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as ‘web beacons’) for statistical or marketing purposes. Pixel tags can be used to analyze information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and contain, among other things, technical information about the browser and operating system, referring websites, visit time and other information about the use of our online offer, as well as being linked to such information from other sources.
Our website uses Google Analytics, a web analytics service provided by Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables us to analyze the behavior of visitors to our website and to improve user-friendliness.
Type of data collected
Google Analytics collects the following data, among others:
Legal basis of the processing
The processing of personal data by Google Analytics is carried out in accordance with Art. 6 para. 1 lit. a GDPR on the basis of your consent. You can withdraw your consent at any time.
IP anonymization
We have activated IP anonymization in Google Analytics. This means that your IP address is shortened within the EU and not stored in full.
Data transfer to the USA
Google Analytics transfers data to the USA. Google is certified in accordance with the EU-US Data Privacy Framework, which is intended to guarantee an appropriate level of data protection. Nevertheless, there is a residual risk, as US authorities could gain access to this data under certain circumstances.
We maintain online presences within social networks in order to communicate with the users active there and to offer information about us. When accessing the respective networks, the terms and conditions and data processing guidelines of their respective operators apply. Data may also be processed outside the European Union. For US providers that are certified under the Data Privacy Framework, this ensures an appropriate level of data protection.