- 01. Who is accountable for processing my personal data?
- 02. What data is collected?
- 03. What cookies are used?
- 04. What personal data is collected and for what purpose?
- 05. Who comes into possession of my personal data?
- 06. Is my personal data processed outside of the EU or EEA (‘transfer to a third country’)?
- 07. What data privacy rights do I have?
Who is accountable for processing my personal data?
Arvato CRM Solutions GmbH
An der Autobahn 22
Phone +49 5241 80-43600
is responsible for the processing of your data on the website. The website has sub-pages which are maintained by the subsidiaries*.
You can contact the Arvato CRM Solutions data protection officer at the above-mentioned postal address with the addition "To the data protection officer" or by using the e-mail address email@example.com.
Arvato CRM Solutions GmbH and the above-mentioned subsidiaries (hereinafter "we" or "us") process personal data in accordance with the provisions of the GDPR and the Federal Data Protection Act (hereinafter "BDSG").
What data is collected?
In connection with your visit to the website and solely for technical, contractual or legal reasons, your data will be collected in order to be able to display the desired content and to enable you to use the offers.
If you browse our websites by your PC certain information are collected simply for technical reasons of data flows (technical data). These technical data contain details about the content requested by you on the website and your usage behavior as well as information about the browser type and browser version, the operating system, the Internet service provider, the date and time of use of the website, the previously visited websites and newly accessed websites via the website and the IP address of the computer (also called "server log files"). Pseudonymous user profiles are created and evaluated from the access data with the help of web tracking. In principle, it is not possible for us to draw any conclusions about you personally.
In general, you can use the website without providing your data, for example to inform yourself about us. However, when using certain services, it is necessary to provide your data, for example to contact us or to order a technical article (also known as a "white paper"). Mandatory fields are regularly marked with *.
What cookies are used?
Cookies are used on our website. Cookies are small text files that are saved to your computer when visiting a website. The cookies that are saved can be attributed to the web browser used by you. When the website is visited again, the web browser returns the content of the cookies, thus enabling you, the user, to be recognized. Cookies are limited to a certain runtime (e.g. expiration of the browser session). You can also configure and delete cookies according to your preferences via your browser settings. However, premature deletion may result in limited availability of the offers on the website.
The website distinguishes between two types of cookies: functional cookies and optional cookies. Functional cookies are used to provide the website in a technically and functionally flawless manner (e.g. identification and authentication of the user, language settings, display of image recordings). Without the function-related cookies, the offerings of the website are only available to a limited extent. The optional cookies help to optimize the offers on the web-site by recording user behavior and evaluating it in statistical form.
As a general principle, cookies enable online recognition without reference to a specific per-son. Cookies can be related to individuals if the information generated by the cookies is com-bined with other data such as access data (e.g. when using web tracking). Such a combination only takes place in pseudonymised form, i.e. your data do not allow any direct conclusions to your person or on the basis of your consent.
What personal data is collected and for what purpose?
The purpose of data processing may be based on technical, contractual or statutory require-ments or result from consent having been given by the user.
We use the data described in section 2 for the following purposes:
- To provide website features and content and ensure technical security in trouble-shooting technical issues and also to ensure that unauthorized persons do not gain access to our web-site systems;
- To conduct marketing reach measurements and web analyses in order to make our website more efficient and interesting for you, and for market research purposes;
- For communication, promotional speech completion of precontractual procedures, and customer care purposes and establishing an employment relationship.
- To send out newsletters via email;
- For event registration and participation; and
4.1 Provision of the website
4.1.1 Description and scope of data processing
In order to enable the proper functioning of our websites, security analyses to be conducted, and denial-of-service attacks to be prevented and stopped, server log files are automatically collected and saved on a short-term basis as an integral part of access data that is created by the system of the visiting computer upon accessing our website and while using it (see section 2). The content of the server log files is not merged with other data. We use the server log files for statistical analyses to troubleshoot and remedy technical issues, prevent and defend against denial-of-service attacks and attempted fraud, and to optimize the proper functioning of our website.
4.1.2 Purpose and legal basis of data processing
The legal basis for the creation of server log files follows from Art. 6(1)(f) GDPR. Our legiti-mate interests lie in the proper functioning of our website, conducting security analyses and defending against threats.
4.1.3 Duration of storage or criteria applied in defining this period
When the pages of our website are accessed, information is logged to server log files that are stored on our web server; the IP address contained in them is deleted after 7 days at the latest. This does not apply if there is a concrete suspicion of an offence and storage beyond this is required by law for the purpose of evaluation and clarification.
4.1.4 Options for lodging an objection and having your data removed
You have the right to lodge an objection to the processing of your data contained in the server log files provided that there are cogent reasons that arise from your specific situation. If you would like to exercise your right to lodge an objection, please write to the contact address in section 1.
4.2 Contact form, email and telephone contact information
4.2.1 Description and scope of data processing
On the website you have the possibility to contact us via a contact form, an e-mail address or a telephone number. If you use this option, provide us with data such as your e-mail address, telephone number, first and last name and your request (hereinafter referred to as "contact data"). The contact data will only be stored and used to process your request (e.g. questions about Arvato CRM Solutions' products and services).
4.2.2 Purpose and legal basis of data processing
The legal basis for processing your contact details follows from Art. 6(1)(f) GDPR. We have legitimate interests in processing your request and in continued communication. If the purpose for your establishing contact with us is to enter into a contract with our company or to use one of our services, the legal basis for processing your contact details follows from Art. 6(1)(b) GDPR.
4.2.3 Duration of storage or criteria applied in defining this period
Your contact details are deleted once your request has been processed and further commu-nication has been discontinued. This does apply if the purpose of your establishing contact with us is to conclude a contract or you wish to exercise your right as a data subject (e.g. request information). In this case your details are stored until all contractual and/or statutory obligations have been fulfilled and statutory retention periods (currently 6 to 10 years) do not prevent this information from being deleted.
4.2.4 Options for lodging an objection and having your data removed
You have the right to lodge an objection to the processing of your contact information provided that there are cogent reasons that arise from your specific situation. If you would like to exer-cise your right to lodge an objection, please write to the contact address in section 1. If you lodge an objection, communication with you cannot be continued. This does not apply if the storage of your contact details is necessary for completing precontractual procedures, ful-filling a contract or exercising your rights as a data subject.
4.3 Studies, reports and whitepapers
4.3.1 Description and scope of data processing
The website offers free studies, reports and whitepapers. Reports and whitepapers on current topics from our business segment can be downloaded free of charge. Only the provision of your e-mail address is required for the download. If, on the other hand, you wish to be contacted in a company-related and/or personal manner, you can also provide information about yourself and/or your company. When we collect your information with your consent to the use of your information to download our studies, reports and whitepapers, we use your email address for authentication by providing you with a confirmation link. This so-called double opt-in procedure serves to protect against unauthorized data transfer and only when you use the confirmation link we save your data and you can download it free of charge. Data will not be processed for other purposes.
4.3.2 Purpose and legal basis of data processing
The free download of studies, reports and whitepapers on current topics from our business segment serves to present our corporate activities and provide scientific research results. legal basis for this is your consent pursuant to Art. 6(1)(a) GDPR.
4.3.3 Duration of storage or criteria applied in defining this period
Your information is stored for two years in principle. If you revoke your consent, your data will also be deleted during this period. Your consent, however, will be stored 3 years after deletion and/or revocation to be able to prove that we have complied with our legal obligations - to let you consent to data processing.
4.3.4 Options for lodging an objection and having your data removed
You can revoke your consent to receiving press releases at any time by writing to Arvato CRM Solutions GmbH (An der Autobahn 500, 33333 Gütersloh, Telefon: +49 5241 80-43600, E-Mail: firstname.lastname@example.org) “.
4.4. Business customer survey
4.4.1 Description and scope of data processing
As part of our business customer relationships, we occasionally conduct customer surveys to measure satisfaction and improve our services. The customer survey is aimed at our business customers, but we regularly store your contact data in our customer database. We use your contact details to invite you to participate in the customer survey. Participation is voluntary and you have the possibility to communicate to us at any time that you no longer wish to receive an invitation to participate in customer surveys. Your contact data is no longer regularly required for the evaluation, so that the survey results consist of purely statistical information. It is then no longer possible to draw any conclusions about your person.
4.4.2 Purpose and legal basis of data processing
The legal basis for processing your contact data is art. 6 sec. 1 lit. f GDPR. The legitimate interests lie in customer care and customer loyalty as well as the improvement of our services.
4.4.3 Duration of storage or criteria applied in defining this period
In principle, the survey results are stored for the duration of the business relationship. This does not apply if the survey results consist of purely statistical data.
4.4.4 Options for lodging an objection and having your data removed
You have the right to object to the processing of your contact data if there are reasons for this arising from your particular situation. If you would like to exercise your right of objection, please contact us at the address given under point 1.
4.5. Application for employment
4.5.1 Description and scope of data processing
Job advertisements are published on the website. Via the job advertisement you will be forwarded to our applicant portal, which collects and processes your data for recruitment purposes. Further information about data processing for recruitment purposes can be obtained by registering in the applicant portal. In addition to applying via the applicant portal, you can also submit a short application on the website. With the short application you can draw attention to yourself as a suitable talent without referring to a specific job posting. To assess your talent and contact you for suitable vacancies, you must provide your first and last name, e-mail address and telephone number as well as a small cover letter in the online application form provided for the short application. By providing your data and consenting to data processing, your e-mail address will be used for your authentication by providing you with a confirmation link. This so-called double opt-in procedure serves to protect against unauthorized data transfer and your short application will only be processed when you use the confirmation link. The short application is voluntary and can be revoked at any time with effect for the future.
The location function on the website gives you the opportunity to submit your brief application to Arvato CRM Solutions GmbH, based in Gütersloh, as well as to other affiliated companies of the Arvato CRM Group. The respective company to which you are addressing your brief application can be found in the consent in the online form. Technical measures ensure that only this company receives your data. No data is passed on within the group of companies. You can send your brief application to the following companies in the Arvato CRM Group:
- Arvato Direct Services Wilhelmshaven GmbH
Olympiastraße 1, 26419 Schortens
- Arvato Direct Services Dortmund GmbH
Schleefstraße 1, 44287 Dortmund
- Arvato CRM Nordhorn GmbH
Bentheimer Straße 118a, 48529 Nordhorn
- Arvato Direct Services GmbH
An der Autobahn 2, 33333 Gütersloh
- Arvato Direct Services Münster GmbH
Höltenweg 33, 48155 Münster
- Arvato Direct Services Eiweiler GmbH
Lebacher Straße 60, 66265 Heusweiler-Eiweiler
- Arvato Direct Services Cottbus GmbH
Am Seegraben 21, 03051 Cottbus
- Arvato Direct Services Neubrandenburg GmbH
Flurstraße 2 , 17034 Neubrandenburg
- Arvato Direct Services Potsdam GmbH
Behlertstraße 3a, 14467 Potsdam
- Arvato Services Rostock GmbH
Deutsche-Med-Platz 1, 18057 Rostock
- Arvato Direct Services Brandenburg GmbH
Wilhelmsdorfer Landstraße 43, 14776 Brandenburg / Havel
- Arvato Direct Services Stralsund GmbH
Große Parower Str. 133, 18435 Stralsund
- Arvato Direct Services Rostock GmbH
Deutsche-Med-Platz 1, 18057 Rostock
- Arvato Services Chemnitz GmbH
Rathausstr. 7, 09111 Chemnitz
- Arvato Telco Services Erfurt GmbH
Camburger Straße 4, 99091 Erfurt
- Arvato Direct Services Schwerin GmbH
Marienplatz 12, 19053 Schwerin
- Arvato Services Essen GmbH
Hollestraße 7a, 45127 Essen
- KWS Kontowechsel Service GmbH
Olympiastraße 1, 26419 Schortens
- Arvato Services Leipzig GmbH
Gutenbergplatz 1, 04103 Leipzig
- Arvato Services Gera GmbH
Straße des Friedens 200, 07548 Gera
- Arvato Services Cottbus GmbH
Ostrower Damm 20, 03046 Cottbus
- Arvato Services Dresden GmbH
Ammonstr. 74 , 01067 Dresden
- Arvato Services Halle GmbH
Kaiserslauterer Straße 75, 06128 Halle (Saale)
- Arvato Services Magdeburg GmbH
Nachtweide 82, 39124 Magdeburg
- Arvato Services Suhl GmbH
Neuer Friedberg 5, 98527 Suhl
- Arvato CRM Energy GmbH
Maximilianallee 4, 04129 Leipzig
4.5.2 Purpose and legal basis of data processing
Your application data will be processed in order to assess your talent and to be able to contact you in suitable vacant positions. The legal basis is Art. 6 sec. 1 lit. a GDPR, by submitting your short application you give your consent to the data processing.
4.5.3 Duration of storage or criteria applied in defining this period
After your consent has been given, your short application will be stored for 1 year, unless you withdraw your consent prematurely. This shall not apply if statutory retention obligations oblige us to a longer storage period. Your consent, on the other hand, will be stored 3 years after deletion and/or revocation in order to be able to prove that we have complied with our legal obligations - to let you consent to data processing.
4.5.4 Options for lodging an objection and having your data removed
You can obtain your consent any time without any formality by contacting Arvato CRM Solutions GmbH (Motorway 500, 33333 Gütersloh, Phone: +49 5241 80-43600, E-Mail: email@example.com). The same applies to the individual companies in the Arvato CRM group. The corresponding address can be found in Section 4.5.1 or in the consent.
The website includes services that optimize user-friendliness and measure the reach of the website. Your access data (see paragraph 2) is recorded and the usage behaviour is evaluated with the help of cookies (see paragraph 3). Personal identification is generally not required for web tracking, so that when your access data is recorded, the stored IP address is either not used or only used in abridged form (shortened by the last octet) and pseudonymous user profiles are created. This data will not be merged with other data and you have the possibility of revocation at any time. Personal user profiles are only created in exceptional cases and if you have given your consent.
The web tracking services are regularly provided by service providers who process the pseudonymous user profiles only according to instructions and not for their own purposes. This is ensured by means of contracts for order processing. If the service providers are established outside the European Union or the European Economic Area (hereinafter referred to as "EU or EEA"), a so-called third country transfer takes place. This is permissible if you have given your consent, if we have created guarantees for a level of data protection that meets European standards or if the EU Commission has classified the respective third country as a safe third country. The third country transfer of the respective service is identified below. Further information on the recipients of your data can be found in paragraph 5.
The individual web tracking services of the website are described in more detail below.
4.6.1 Adobe Tag Manager
This website uses Adobe Tag Manager. Adobe Tag Manager is a service provided by Adobe Systems Software Irland Limited, 6 Riverwalk Naas Road Dublin 24, Ireland (Adobe). Adobe Tag Manager managers „tags“ (placeholder for website code). Adobe Tag Manager does not collect data and data collected by the tags cannot be accessed by the Adobe Tool Manager.
4.6.2 Adobe Analytics (Omniture)
This website uses Adobe Analytics. Adobe Analytics is a service provided by Adobe Systems Software Irland Limited, 6 Riverwalk Naas Road Dublin 24, Ireland (Adobe). Adobe Analytics causes a usage profile to be created in order to optimize the user-friendliness of our website. A pseudonym is assigned to this profile. In so doing, your access data is collected as de-scribed in section 2 and your usage behaviour analyzed using analytics cookies as described in section 3. Personal identification is not necessary for web tracking: when collecting your access data your IP address is shortened before being transmitted to Adobe meaning no in-formation can be attributed to you. These usage profiles to which pseudonyms are assigned are analyzed for the purpose of optimizing user-friendliness. This data is not merged with oth-er data by Adobe. We ensure that Adobe only uses this data as instructed by us under a con-tract data processing contract we have concluded with Adobe.
For more information on data processing related to Adobe Analytics, refer to the Adobe priva-cy policy:
4.6.4 Purpose and legal basis of data processing
The legal basis for collecting and analyzing pseudonym usage profiles follows from Art. 6(1)(f) GDPR / Section 15(3) German Telemedia Act (TMG). We have a legitimate interest in optimiz-ing the user-friendliness of our website and performing marketing reach measurements.
4.6.5 Duration of storage or criteria applied in defining this period
As a general rule, the data that is collected and analyzed in association with Google and Ado-be Analytics remains stored until you raise an objection to it being used in this manner. Analyt-ics cookies are stored for a maximum of 24 months.
4.6.6 Options for lodging an objection and having your data removed
You can raise an objection to the use of Google Analytics by changing your browser settings and/or clicking on the following links to download and install the browser plug-ins and/or opt-out:
· Google Analytics: https://tools.google.com/dlpage/gaoptout
· Adobe Analytics: http://bertelsarvatoprod.d3.sc.omtrdc.net/optout.html
4.7 External services and content on our website
We integrate external services and content on our website. If you use one of these services or you are shown the content of third parties, communication data is exchanged between you and the provider of that service or content for technical purposes.
That provider may use your data for their own purpose. To the best of our knowledge and belief, we have configured the services or content of third-party providers who are known to use data for their own purposes so that communication for purposes other than rendering their content or services on our website is prevented or communication does not come about unless you actively decide to use the service. However, since we have no control over the data collected by third parties and its processing by them we are unable to make any binding statements pertaining to the purpose and scope of the processing of your data.
- YouTube: https://support.google.com/youtube/answer/7671399
- Google Maps: https://maps.google.com/help/terms_maps.html
4.8.1 Description and scope of data processing
You have the option of registering for webinars. Registering requires that you provide your first and last name and your email address. If you would like to be addressed as a company you can also optionally provide details on your company and your position there. After you have entered your details and given your consent to data processing, we use this information to send you confirmation of registration including a link enabling you to take part in the webinar. No other data processing takes place.
4.8.2 Purpose and legal basis of data processing
Your participation in our webinars on current topics relating to our business segment enables us to inform you of current developments in our company or provide the results of scientific research. All webinars are free of charge. The legal basis for data processing follows from your consent pursuant to Art. 6 (1) point a General Data Protection Regulation (GDPR).
4.8.3 Duration of storage or criteria applied in defining this period
As a general principle, the information provided by you is stored for two years. If, however, you revoke your consent before this two-year period lapses, your information will be deleted. After the information provided by you is deleted, your consent is stored for another three years so that we are able to comply with our statutory obligation of documenting proof that you gave your consent to the processing of your data. If you should revoke your consent, this is treated like your initial provision of consent in that it is stored for a period of three years upon the deletion of your information.
4.8.4 Options for lodging an objection and having your information removed
You can revoke your consent at any time. This can be done by way of a simple notice to this effect, without having to state any reasons. Any revocation only has effect for the future, meaning it does not affect the admissibility of data processing during the time prior to you revoking your consent. In the event you would like to revoke your consent, please write to Arvato CRM Solutions GmbH (An der Autobahn 500, 33333 Gütersloh, Germany, phone: +49 5241 80-43600, email: firstname.lastname@example.org).
Who comes into possession of my personal data?
Within our company those who need access to your information for the purposes described in section 4 will be given access to it. Service providers contracted by us may also be given ac-cess to your information (“contract data processors”, e.g. data centers, mailing services for newsletters, web tracking). They are bound by our directives and must provide for data securi-ty and the confidential treatment of your information under the contract data processing agreements we have concluded with them.
No sharing of information with other recipients such as advertising partners, providers of so-cial media services or credit institutions (“third parties”) takes place.
Is my personal data processed outside of the EU or EEA (‘transfer to a third country’)?
If the service providers and/or third parties mentioned under point 5 are located outside the EU or the EEA, this may result in your data being transferred to a country where an appropri-ate level of data protection cannot be guaranteed for the EU or the EEA. However, such a level of data protection can be ensured with an appropriate guarantee. Suitable guarantees include standard contractual clauses provided by the EU Commission. You can request a copy of these warranties on request under the contact details mentioned in section 1. Any guaran-tees may exceptionally be waived if you give your consent or the transfer to a third country is necessary for the fulfilment of our contractual relationship. The EU Commission has also rec-ognised certain third countries as safe third countries, so that here too the company can refrain from providing suitable guarantees.
Through the use of Google Analytics, a third country transfer takes place. However, with cer-tification according to the EU-US Privacy Shield, Google ensures that the European data pro-tection level is guaranteed for the transfer to third countries.
What data privacy rights do I have?
You have the right to request access to your personal data that is currently stored by us. If this data is incorrect or not up to date, you have the right to request rectification. You also have the right to have your personal data erased and/or its processing restricted as provided for in Art. 17 and Art. 18 GDPR. You also have the right to request a copy of the personal data provided by you in a structured, commonly-used, machine-readable format (right to data port-ability).
If you have given your consent to the processing of your personal information for specific purposes, you can revoke that consent at any time for the future.
Pursuant to Art. 21 GDPR, you also have the right for reasons relating to your specific situa-tion to raise an objection to the processing of your data that is done on the basis of Art. 6(1)(f) GDPR.
You also have the right to lodge an objection to the processing of your personal infor-mation for direct marketing purposes. The same applies to automated processes involving the use of individual cookies, unless they are required for providing the functionality of our website.
You also have the right to lodge a complaint with the competent data protection authority. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
40213 Düsseldorf, Germany
You also have the right to contact the data protection authority at your place of residence and request support in pursuing your matter.