Privacy Policy

  1. INTRODUCTION

The following information is intended to provide you, as a “data subject”, with an overview of how we process your personal data and of your rights under data protection law. As a general rule, our websites may be used without entering any personal data. However, if you wish to make use of certain services offered by our company via our website, the processing of personal data may become necessary. Where the processing of personal data is necessary and there is no statutory basis for such processing, we will generally obtain your consent.

The processing of personal data, such as your name, address or email address, is always carried out in accordance with the General Data Protection Regulation (GDPR) and the country-specific data protection regulations applicable to “EWG Essener Wirtschaftsförderungsges. mbH”. Through this Privacy Policy, we would like to inform you about the scope and purpose of the personal data that we collect, use and process.

As the controller, we have implemented numerous technical and organisational measures to ensure the most complete protection possible of personal data processed via this website. Nevertheless, internet-based data transmissions may generally be subject to security vulnerabilities, meaning that absolute protection cannot be guaranteed. For this reason, you are free to provide us with personal data by alternative means, for example by telephone or post.

 

  1. CONTROLLER

The controller within the meaning of the GDPR is:

EWG Essener Wirtschaftsförderungsges. mbH
Kennedyplatz 5, 45127 Essen, Germany
Telephone: +49 (0)201 820240
Representative of the controller: Andre Boschem

 

  1. DATA PROTECTION OFFICER

You can contact the Data Protection Officer as follows:

Björn Leineweber
Telephone: +49 (0)201 890 66 123
Email: [[email protected]](mailto:[email protected])

You may contact our Data Protection Officer directly at any time with any questions or suggestions concerning data protection.

 

  1. DEFINITIONS

This Privacy Policy is based on the terminology used by the European legislator when adopting the General Data Protection Regulation (GDPR). Our Privacy Policy is intended to be easy to read and understand both for the general public and for our customers and business partners. To ensure this, we would first like to explain the terminology used.

In this Privacy Policy, we use the following terms, among others:

 

4.1 Personal data

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics expressing the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

 

4.2 Data subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller responsible for the processing, i.e. our company.

 

4.3 Processing

Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or another form of making available, alignment or combination, restriction, erasure or destruction.

 

4.4 Restriction of processing

Restriction of processing means the marking of stored personal data with the aim of limiting its future processing.

 

4.5 Profiling

Profiling means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

 

4.6 Pseudonymisation

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data is not attributed to an identified or identifiable natural person.

 

4.7 Processor

A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.

 

4.8 Recipient

A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether or not that recipient is a third party. However, public authorities that may receive personal data in the context of a particular investigation in accordance with European Union or Member State law are not regarded as recipients.

 

4.9 Third party

A third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

 

4.10 Consent

Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes, in the form of a statement or another clear affirmative action, by which the data subject signifies agreement to the processing of personal data relating to them.

 

  1. LEGAL BASIS FOR PROCESSING

Article 6(1)(a) GDPR, in conjunction with Section 25 TDDDG, serves as the legal basis for processing operations for which our company obtains consent for a specific processing purpose. Where consent has been granted, you may withdraw it at any time with effect for the future.

Where the processing of personal data is necessary for the performance of a contract to which you are a party, as is the case, for example, with processing operations necessary for the delivery of goods or the provision of another service or consideration, the processing is based on Article 6(1)(b) GDPR. The same applies to processing operations that are necessary in order to take steps prior to entering into a contract, for example in cases of enquiries concerning our products or services.

Where our company is subject to a legal obligation that requires the processing of personal data, for example in order to comply with tax obligations, the processing is based on Article 6(1)(c) GDPR.

In rare cases, the processing of personal data may be necessary in order to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were injured on our premises and their name, age, health insurance details or other vital information had to be disclosed to a doctor, hospital or another third party. In such a case, the processing would be based on Article 6(1)(d) GDPR.

Finally, processing operations may be based on Article 6(1)(f) GDPR. This legal basis applies to processing operations that are not covered by any of the aforementioned legal bases, where processing is necessary for the purposes of the legitimate interests pursued by our company or a third party, provided that the interests or fundamental rights and freedoms of the data subject do not override those interests. We are permitted to carry out such processing operations in particular because they have been specifically mentioned by the European legislator. In this respect, the legislator took the view that a legitimate interest may be assumed where you are a customer of our company, as stated in Recital 47, sentence 2 GDPR. A balancing of interests is also carried out.

 

  1. DISCLOSURE OF DATA TO THIRD PARTIES

Your personal data will not be disclosed to third parties for purposes other than those listed below.

We will disclose your personal data to third parties only where:

  • you have given your express consent in accordance with Article 6(1), sentence 1, point (a) GDPR;
  • disclosure is permissible in accordance with Article 6(1), sentence 1, point (f) GDPR for the purposes of our legitimate interests and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed;
  • there is a legal obligation to disclose the data pursuant to Article 6(1), sentence 1, point (c) GDPR; or
  • disclosure is legally permissible and necessary pursuant to Article 6(1), sentence 1, point (b) GDPR for the performance of contractual relationships with you.

To protect your data and, where applicable, to enable us to transfer data to third countries outside the European Union or European Economic Area, we have entered into data processing agreements based on the European Commission’s Standard Contractual Clauses.

 

  1. TECHNOLOGY

7.1 SSL/TLS encryption

This website uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as orders, login details or contact enquiries that you send to us as the website operator. You can recognise an encrypted connection by the fact that the address bar of your browser displays “https://” instead of “http://” and by the padlock symbol in your browser bar.

We use this technology to protect the data you transmit.

 

7.2 Data collection when visiting the website

When you use our website for purely informational purposes, i.e. where you do not register or otherwise provide us with information, we collect only the data that your browser transmits to our server in so-called “server log files”. Each time you or an automated system accesses a page on our website, our website collects a range of general data and information. This general data and information is stored in the server log files. The following may be collected:

  1. the browser types and versions used;
  2. the operating system used by the accessing system;
  3. the website from which an accessing system reaches our website, known as the referrer;
  4. the subpages accessed on our website by the accessing system;
  5. the date and time of access to the website;
  6. a truncated Internet Protocol address, i.e. an anonymised IP address; and
  7. the internet service provider of the accessing system.

When using this general data and information, we do not draw any conclusions about you personally. Instead, this information is required in order to:

  1. deliver the content of our website correctly;
  2. optimise the content of our website and the advertising for it;
  3. ensure the long-term functionality of our IT systems and website technology; and
  4. provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack.

 

The collected data and information is therefore evaluated by us statistically and with the aim of improving data protection and data security within our company, thereby ultimately ensuring the best possible level of protection for the personal data we process. Anonymous server log file data is stored separately from any personal data provided by a data subject.

The legal basis for the processing is Article 6(1), sentence 1, point (f) GDPR. Our legitimate interest arises from the purposes of data collection listed above.

 

7.3 Cloudflare CDN

A Content Delivery Network, or CDN, provided by Cloudflare may be used to ensure the secure and rapid delivery of our website. The provider is Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C, 81671 Munich, Germany. The technical service may also be provided by companies affiliated with Cloudflare, in particular Cloudflare, Inc., USA.

When you access our website, technical connection data is transmitted to Cloudflare. This may include, in particular, your IP address, the date and time of access, the requested URL, the referrer URL, browser and device information, and security-related log data. Cloudflare processes this data in particular for the delivery of the website, load balancing, protection against attacks and ensuring the stability and security of our website.

The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and high-performance provision of our online services. Where Cloudflare uses technically necessary cookies or comparable technologies for security functions, this is carried out on the basis of Section 25(2), no. 2 TDDDG. Further information can be found in Cloudflare’s Privacy Policy: https://www.cloudflare.com/de-de/privacypolicy/.

 

  1. COOKIES

8.1 General information about cookies

We use cookies on our website. Cookies are small files that are automatically created by your browser and stored on your IT system, such as your laptop, tablet or smartphone, when you visit our website.

Information relating to the specific device used is stored in the cookie. However, this does not mean that we obtain direct knowledge of your identity as a result.

Cookies are used, on the one hand, to make our services more convenient for you. For example, we use session cookies to recognise that you have already visited individual pages of our website. These cookies are automatically deleted after you leave our website.

We also use temporary cookies to optimise user-friendliness. These cookies are stored on your device for a specified period. If you visit our website again in order to use our services, it is automatically recognised that you have visited us before and which entries and settings you selected, so that you do not have to enter them again.

On the other hand, we use cookies to statistically record the use of our website and to evaluate it for the purpose of optimising our services for you. When you return to our website, these cookies enable us to recognise automatically that you have visited us before. These cookies are automatically deleted after a defined period.

 

8.2 Legal basis for the use of cookies

Where the use of cookies or access to information on your device is strictly necessary for the provision of the website or individual functions expressly requested by you, this is carried out on the basis of Section 25(2), no. 2 TDDDG. The subsequent processing of personal data is carried out for the purposes of our legitimate interests and the interests of third parties pursuant to Article 6(1), sentence 1, point (f) GDPR, unless a more specific legal basis is stated below.

For all other cookies and comparable technologies, as well as for non-essential access to information on your device, we obtain your consent via our consent management tool in accordance with Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future by reopening the cookie settings and changing your selection.

 

8.3 Borlabs Cookie

We use Borlabs Cookie as a consent management tool on our website. Borlabs Cookie stores the choices you make in the cookie banner so that the website can take account of and document your consent or refusal. For this purpose, the “borlabs-cookie” cookie is generally placed. This cookie stores information about the service groups and individual services you have selected. Under the current configuration, the storage period is 60 days.

The use of Borlabs Cookie is necessary in order to implement and provide evidence of your consent decisions. The legal basis for access to your device is Section 25(2), no. 2 TDDDG. The subsequent processing of personal data is based on Article 6(1)(c) GDPR where we are complying with statutory documentation obligations and, additionally, on Article 6(1)(f) GDPR. Our legitimate interest lies in the legally compliant management and documentation of consent.

 

8.4 WPML

Our website uses WPML, a WordPress plugin for providing a multilingual website. WPML may use cookies or comparable information to store the language you have selected and to technically implement language redirects or language filtering. In particular, the cookies “wp-wpml_current_language”, “wpml_browser_redirect_test”, “*icl_visitor_lang_js” and “wp-wpml_current_admin_language**” may be used for this purpose.

Where the storage of or access to information on the device is technically necessary for the language function, WPML is used on the basis of Section 25(2), no. 2 TDDDG. The subsequent processing of personal data is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the user-friendly and technically error-free provision of the website in multiple languages.

 

  1. CONTENT OF OUR WEBSITE

9.1 Data processing when opening a customer account and for contract performance

In accordance with Article 6(1)(b) GDPR, personal data is collected and processed where you provide it to us for the performance of a contract or when opening a customer account. The data collected can be seen from the relevant input forms. You may delete your customer account at any time by sending a message to the controller at the address stated above. We store and use the data you provide for the purpose of performing the contract.

Following complete performance of the contract or deletion of your customer account, your data will be blocked in consideration of retention periods under tax and commercial law and deleted once those periods have expired, unless you have expressly consented to further use of your data or we have reserved the right to continue using the data in a manner permitted by law, about which we provide corresponding information below.

 

9.2 Contacting us/contact form

When you contact us, for example via a contact form or email, personal data is collected. The data collected when using a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or contacting you and for the associated technical administration.

The legal basis for processing the data is our legitimate interest in responding to your request pursuant to Article 6(1)(f) GDPR. Where your contact is aimed at entering into a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.

Your data will be deleted once your enquiry has been conclusively dealt with. This is the case where the circumstances indicate that the matter concerned has been fully clarified and provided that no statutory retention obligations prevent deletion.

 

9.3 Application management/job board

We collect and process the personal data of applicants. The relevant data processing may also take place electronically, for example where applicants send us application documents by email or via a web form available on our website. On our website, we offer you the opportunity to submit applications for advertised vacancies by email.

Your data will only be stored in an applicant database beyond the current application process where you have provided us with separate consent for this purpose.

Your data is processed in connection with your application for the purpose of handling your application and making a decision on establishing an employment relationship, on the basis of Section 26 BDSG. Where your application documents are disclosed to third parties, in particular to companies affiliated with us, or your data is stored beyond the current application process, the processing is based on Article 6(1), sentence 1, point (a) GDPR.

There is no statutory or contractual obligation to provide your data. However, your application cannot be processed without the necessary information.

We store the collected data for a period of six months from the date on which the position is filled.

 

9.4 BITE Applicant Manager/job portal

For the job portal linked to or integrated into our website and for applicant management functions, we use the BITE Applicant Manager provided by BITE GmbH, Magirus-Deutz-Straße 12, 89077 Ulm, Germany. BITE provides technical support for publishing job advertisements, receiving and managing applications, and communicating during the application process.

When you use the job portal or application functions, the data processed may include, in particular, master data and contact details, communication data, application documents, details of your professional background, qualifications, certificates, additional information voluntarily provided by you, and technical usage and log data. The data is processed for the purposes of conducting the application procedure, selecting suitable applicants and technically providing the applicant management system.

Where the processing is necessary for making a decision regarding the establishment of an employment relationship, the legal basis is Section 26 BDSG. Where you submit general contact enquiries or expressions of interest via the job portal, or where other pre-contractual measures are involved, processing is based on Article 6(1)(b) GDPR. In all other respects, processing is based on our legitimate interest pursuant to Article 6(1)(f) GDPR in efficient and secure applicant management.

Where BITE processes personal data on our behalf, BITE is engaged as a processor.

 

  1. NEWSLETTER DISTRIBUTION

10.1 Newsletter distribution to existing customers

Where you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers by email concerning goods or services from our range that are similar to those you have already purchased. In accordance with Section 7(3) UWG, we are not required to obtain separate consent from you for this purpose.

In this respect, the data processing is based solely on our legitimate interest in personalised direct marketing pursuant to Article 6(1)(f) GDPR. Where you initially objected to the use of your email address for this purpose, we will not send you marketing emails.

You are entitled to object at any time, with effect for the future, to the use of your email address for the aforementioned advertising purpose by notifying the controller named at the beginning of this Privacy Policy. You will incur only the transmission costs charged at the basic rates. Once we receive your objection, we will immediately cease using your email address for advertising purposes.

 

10.2 Marketing newsletter

Our website provides you with the option of subscribing to our company newsletter. The personal data transmitted to us when you order the newsletter can be seen from the input form used for this purpose.

We regularly inform our customers and business partners about our offers by means of a newsletter. As a general rule, you can receive our company newsletter only where:

  1. you have a valid email address; and
  2. you have registered to receive the newsletter.

For legal reasons, a confirmation email is sent as part of the double opt-in procedure to the email address you entered when registering for the newsletter for the first time. This confirmation email is used to verify that you, as the owner of the email address, have authorised receipt of the newsletter.

When you register for the newsletter, we also store the IP address assigned by your internet service provider to the IT system you used at the time of registration, as well as the date and time of registration. The collection of this data is necessary in order to trace any possible misuse of your email address at a later date and therefore serves to provide us with legal protection.

The personal data collected when you register for the newsletter is used exclusively for sending our newsletter. Newsletter subscribers may also be informed by email where this is necessary for the operation of the newsletter service or a related registration, for example in the event of changes to the newsletter service or technical circumstances.

The personal data collected as part of the newsletter service is not disclosed to third parties. You may cancel your newsletter subscription at any time. The consent you have given to the storage of personal data for newsletter distribution may be withdrawn at any time. A corresponding link for withdrawing consent is included in every newsletter. You may also unsubscribe from the newsletter directly via our website at any time or notify us by another means.

The legal basis for processing data for the purpose of newsletter distribution is Article 6(1)(a) GDPR.

 

10.3 Microsoft Dynamics 365 Marketing

This website uses Microsoft Dynamics 365 Marketing to distribute newsletters. The provider is Microsoft Deutschland GmbH, Walter-Gropius-Straße 5, 80807 Munich, Germany.

Microsoft Dynamics 365 Marketing is a service that can be used, among other things, to organise and analyse newsletter distribution. The data you enter for the purpose of subscribing to the newsletter is stored on the servers of Microsoft Deutschland GmbH in Europe.

Where you do not wish your use to be analysed by Microsoft Dynamics 365 Marketing, you must unsubscribe from the newsletter. We provide an appropriate link for this purpose in every newsletter. You can also unsubscribe from the newsletter directly on the website.

You may withdraw your consent at any time. You may also prevent processing at any time by unsubscribing from the newsletter. You can also prevent cookies from being stored by configuring your web browser accordingly. You may also prevent the storage and transmission of personal data by disabling JavaScript in your web browser or installing a JavaScript blocker, such as https://noscript.net or https://www.ghostery.com.

Please note that these measures may result in some functions of our online services no longer being fully available.

Microsoft Dynamics 365 Marketing enables us to analyse our newsletter campaigns. For example, we can see whether a newsletter message has been opened and which links have been clicked. This allows us, among other things, to determine which links are clicked particularly frequently.

We can also determine whether certain predefined actions have been carried out after opening the newsletter or clicking a link, known as the conversion rate. For example, we may be able to determine whether you made a purchase after clicking a link in the newsletter.

Microsoft Dynamics 365 Marketing also enables us to divide or “cluster” newsletter recipients into different categories. For example, recipients may be divided according to age, gender or place of residence. This allows the newsletter content to be better tailored to the respective target groups.

Data processing is based on your consent pursuant to Article 6(1)(a) GDPR. You may withdraw this consent at any time. The lawfulness of data processing operations carried out prior to withdrawal remains unaffected.

The data you provide to us for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter. After you unsubscribe, it will be deleted both from our servers and from the servers of Microsoft Deutschland GmbH. Data stored by us for other purposes, such as email addresses for a members’ area, remains unaffected.

Further information can be found in the privacy provisions of Microsoft Deutschland GmbH.

Despite the data location selected by us in Germany, the transfer of data to and corresponding storage on a Microsoft server in the USA cannot be completely ruled out. By consenting to the use of this service, you also consent to the processing of your data in the USA pursuant to Article 49(1)(a) GDPR. Please note the information provided below concerning such data transfers under Section 18.

 

  1. OUR ACTIVITIES ON SOCIAL NETWORKS

We maintain so-called fan pages, accounts or channels on the networks listed below in order to provide you with information and offers within social networks and to offer you additional ways of contacting us and learning about our services. The following information explains which data we or the respective social network process when you access and use our fan pages or accounts.

 

11.1 Data processed by us

Where you contact us by messenger or direct message via the respective social network, we generally process the username you use to contact us and, where applicable, store additional data provided by you insofar as this is necessary to handle or respond to your request.

The legal basis is Article 6(1), sentence 1, point (f) GDPR, as the processing is necessary for the purposes of the legitimate interests pursued by the controller. A balancing of interests has been carried out.

 

11.2 Statistical usage data received by us from social networks

Through insights functions, we receive automatically generated statistics relating to our accounts. These statistics include, among other things, the total number of page views, likes, information on page activities and interactions with posts, reach, video views, and information on the proportion of men and women among our fans or followers.

The statistics contain only aggregated data that cannot be related to individual persons. You cannot be identified by us on the basis of this data.

 

11.3 Data processed about you by social networks

You do not need to be a member of the relevant social network in order to view the content of our fan pages or accounts. Accordingly, a user account with the respective social network is not required.

Please note, however, that social networks may also collect and store data from website visitors who do not have a user account when they access the respective social network. This may include technical data required to display the website. Social networks also use cookies and similar technologies over which we have no control. Further details can be found in the privacy policies of the respective social network.

Where you wish to interact with content on our fan pages or accounts, for example by commenting on, sharing or liking our posts, or where you wish to contact us via messenger functions, you must first register with the relevant social network and provide personal data.

We have no influence over the data processing carried out by social networks when you use their services. To the best of our knowledge, your data is stored and processed in particular in connection with the provision of the respective social network’s services and for the analysis of usage behaviour using cookies, pixels, web beacons and similar technologies. On the basis of this analysis, advertising based on your interests may be displayed both within and outside the respective social network.

It cannot be ruled out that social networks may store your data outside the European Union or European Economic Area and disclose it to third parties.

Information concerning the precise scope and purposes of the processing of your personal data, storage periods and deletion, and policies regarding the use of cookies and similar technologies during registration with and use of the social networks can be found in the privacy policies and cookie policies of the respective social networks. These policies also contain information about your rights and options for objecting.

 

11.4 Instagram

When you visit our Instagram page, Instagram collects, among other things, your IP address and other information stored on your computer in the form of cookies. This information is used to provide us, as the operator of the Instagram page, with statistical information about the use of that page. Instagram provides further information at the following link: https://www.facebook.com/business/help/441651653251838?id=419087378825961

The statistical information transmitted to us does not enable us to draw conclusions about individual users. We use it only to respond to the interests of our users, continually improve our online presence and maintain its quality.

We collect your data via our fan page solely in order to enable communication and interaction with us. This collection generally includes your name, the content of messages and comments, and profile information that you have made publicly available.

Your personal data is processed for the aforementioned purposes on the basis of our legitimate commercial and communication interest in providing an information and communication channel pursuant to Article 6(1)(f) GDPR. Where you, as a user, have given consent to data processing to the respective social network provider, the legal basis for processing additionally extends to Articles 6(1)(a) and 7 GDPR.

As the actual data processing is carried out by the social network provider, our ability to access your data is limited. Only the provider of the social network has full access to your data. Consequently, only the provider can directly take and implement appropriate measures to fulfil your user rights, including requests for access, erasure and objection. The most effective way to exercise the relevant rights is therefore directly against the respective provider.

We and Instagram are jointly responsible for the personal content of the fan page. Data subject rights may be exercised against Meta Platform Technologies Ireland Ltd. and against us.

Under the GDPR, Instagram has primary responsibility for the processing of insights data and fulfils all obligations arising from the GDPR in relation to the processing of insights data. Meta Platform Technologies Ireland Ltd. makes the essential content of the Page Insights Addendum available to data subjects.

We do not make any decisions concerning the processing of insights data or any other information required pursuant to Article 13 GDPR, including the legal basis, the identity of the controller or the storage period of cookies on users’ devices.

Further information is available directly from Instagram in the addendum agreement with Facebook: https://www.facebook.com/legal/terms/page_controller_addendum

 

11.5 LinkedIn

LinkedIn is a social network operated by LinkedIn Inc., based in Sunnyvale, California, USA. It enables natural persons to create private and professional profiles and companies to create corporate profiles. Users can maintain existing contacts and establish new contacts within the social network. Companies and other organisations can create profiles on which photographs and other company information can be uploaded in order to present themselves as employers and recruit employees. Other LinkedIn users can access this information and write their own articles and share content with others. The network focuses on professional exchanges on specialist topics between people who share the same professional interests.

When the network is used or visited, LinkedIn automatically collects data from users or visitors, such as usernames, job titles and IP addresses. This takes place using various tracking technologies. LinkedIn provides users with information, offers and recommendations based, among other things, on the data collected in this way.

We collect your data via our company profile solely in order to enable communication and interaction with us. This collection generally includes your name, the content of messages and comments, and profile information that you have made publicly available.

Your personal data is processed for the aforementioned purposes on the basis of our legitimate commercial and communication interest in providing an information and communication channel pursuant to Article 6(1)(f) GDPR. Where you, as a user, have given consent to data processing to the respective social network provider, the legal basis for processing additionally extends to Articles 6(1)(a) and 7 GDPR.

As the actual data processing is carried out by the social network provider, our ability to access your data is limited. Only the provider of the social network has full access to your data. Consequently, only the provider can directly take and implement appropriate measures to fulfil your user rights, including requests for access, erasure and objection. The most effective way to exercise the relevant rights is therefore directly against the respective provider.

We and LinkedIn are jointly responsible for the personal content of our company profile. Data subject rights may be exercised against LinkedIn Inc. and against us.

We do not make any decisions regarding the data collected on LinkedIn’s website using tracking technologies.

Further information about LinkedIn is available at: https://about.linkedin.com

Further information about data protection at LinkedIn is available at: https://www.linkedin.com/legal/privacy-policy

Further information concerning storage periods, deletion and policies regarding the use of cookies and similar technologies during registration with and use of LinkedIn is available at: https://de.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy.

 

  1. WEB ANALYTICS

12.1 Matomo

We have integrated the Matomo component provided by InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, into this website. Matomo is a web analytics software tool used to collect, compile and evaluate data concerning the behaviour of visitors to websites.

Among other things, data is collected concerning the website from which a data subject reached another website, known as the referrer, which subpages of the website were accessed, how frequently a subpage was viewed and how long visitors remained on it. This is used to optimise the website and to carry out cost-benefit analyses of online advertising.

The software is operated on the controller’s server. Log files that are sensitive from a data protection perspective are stored exclusively on this server.

Matomo places a cookie on your IT system. Placing this cookie enables us to analyse the use of our website. Each time an individual page of this website is accessed, the Matomo component automatically causes the web browser on your IT system to transmit data to our server for online analysis purposes.

As part of this technical process, we obtain knowledge of personal data such as the data subject’s IP address, which enables us, among other things, to trace the origin of visitors and clicks.

The cookie stores personal information such as the time of access, the location from which access originated and the frequency of visits to our website. Each time our website is visited, this personal data, including the IP address of the internet connection you use, is transmitted to our server. This personal data is stored by us. We do not disclose this personal data to third parties.

You may prevent cookies from being placed by our website at any time by configuring the web browser you use accordingly and may thereby permanently object to the placement of cookies. Such a browser configuration would also prevent Matomo from placing a cookie on your IT system. In addition, a cookie already placed by Matomo may be deleted at any time via a web browser or other software program.

You also have the option of objecting to and preventing the collection of data generated by Matomo relating to your use of this website. To do so, you must set an opt-out cookie. Where your IT system is subsequently deleted, formatted or reinstalled, you must set another opt-out cookie.

However, setting the opt-out cookie may mean that our website is no longer fully usable for you.

These processing operations are carried out only where express consent has been given pursuant to Article 6(1)(a) GDPR.

Further information and Matomo’s applicable privacy provisions are available at: https://matomo.org/privacy/

 

  1. PLUGINS AND OTHER SERVICES

13.1 LinkedIn

13.1.1 LinkedIn Insight Tag

We use the LinkedIn Insight Tag provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, to create target groups, segment groups of visitors to our online services, determine conversion rates and subsequently optimise them. This occurs in particular where you interact with advertisements that we have placed with LinkedIn Ireland Unlimited Company. For this purpose, LinkedIn Ireland Unlimited Company offers retargeting for website visitors in order to display targeted advertising outside our website.

The LinkedIn Insight Tag collects data relating to visits to our website, including the URL, referrer URL, IP address, device and browser characteristics, known as the user agent, and timestamps. This data is used to provide anonymised reports about the website audience and advertising performance.

The LinkedIn Insight Tag is used on the basis of your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.

We have no influence over the specific storage period of the processed data, which is determined by LinkedIn Ireland Unlimited Company. Further information is available in the privacy policy for the LinkedIn Insight Tag: https://www.linkedin.com/legal/privacy-policy.

 

13.1.2 LinkedIn Ads

We have integrated LinkedIn Ads into our website. LinkedIn Ads is a service provided by LinkedIn Ireland Unlimited Company that displays targeted advertising to users.

LinkedIn Ads uses cookies and other browser technologies to evaluate user behaviour and recognise users. LinkedIn Ads collects information about visitor behaviour across different websites. This information is used to optimise the relevance of advertising. LinkedIn Ads also delivers targeted advertising based on behavioural profiles and geographical location.

Your IP address and other identifying characteristics, such as your user agent, are transmitted to the provider. In this case, your data is disclosed to the operator of LinkedIn Ads, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

Web-tracking technologies are used to create pseudonymised user profiles. These profiles cannot be linked to you as a natural person and are used, for example, to segment users when displaying advertisements.

LinkedIn Ads is used on the basis of your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.

We have no influence over the specific storage period of the processed data, which is determined by LinkedIn Ireland Unlimited Company. Further information is available in the privacy policy for LinkedIn Ads: https://www.linkedin.com/legal/privacy/eu.

 

13.2 Instagram

Content from Instagram may be embedded on our website. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Where you consent to the display of such content, a connection is established to the servers of Meta or Instagram. In this context, the data processed may include, in particular, your IP address, browser and device information, the referrer URL, the date and time of access, interaction data and, where applicable, cookies and comparable technologies. Where you are logged in to Instagram, Meta may associate your visit to our website with your user account.

The content is embedded in order to display social media content to you on our website. The legal basis is your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Further information is available at https://privacycenter.instagram.com/policy/ and https://www.facebook.com/privacy/policies/cookies/

 

13.3 Integration of content and services from the City of Essen/essen.de

Individual subpages may integrate or access content, functions or technical resources from websites operated by the City of Essen or from the essen.de domain.

When such content is accessed, technical connection data may be processed, including, in particular, your IP address, browser and device information, the referrer URL, the date and time of access, and the requested resource. Where cookies or comparable technologies are used in this context, their use is governed by the applicable statutory requirements and the choices you made in the consent management tool.

The content is integrated in order to provide information and functions from the City of Essen in connection with our services in a user-friendly manner.

Where the integration is technically necessary, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in providing the relevant information and functions. Where the integration is not necessary or involves non-essential access to your device, the legal basis is your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.

 

  1. YOUR RIGHTS AS A DATA SUBJECT

14.1 Right to confirmation

You have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed.

 

14.2 Right of access pursuant to Article 15 GDPR

You have the right to obtain information from us, free of charge and at any time, about the personal data stored concerning you, as well as a copy of that data, in accordance with the statutory provisions.

 

14.3 Right to rectification pursuant to Article 16 GDPR

You have the right to request the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to request that incomplete personal data be completed.

 

14.4 Right to erasure pursuant to Article 17 GDPR

You have the right to request that we erase personal data concerning you without undue delay where one of the statutory grounds applies and provided that the processing or storage is not necessary.

 

14.5 Right to restriction of processing pursuant to Article 18 GDPR

You have the right to request that we restrict processing where one of the statutory requirements is met.

 

14.6 Right to data portability pursuant to Article 20 GDPR

You have the right to receive personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format.

You also have the right to transmit this data to another controller without hindrance from us, where the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, or on a contract pursuant to Article 6(1)(b) GDPR, and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

In exercising your right to data portability pursuant to Article 20(1) GDPR, you also have the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

 

14.7 Right to object pursuant to Article 21 GDPR

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you where such processing is based on Article 6(1)(e), concerning processing in the public interest, or Article 6(1)(f) GDPR, concerning processing based on a balancing of interests.

This also applies to profiling based on those provisions within the meaning of Article 4, no. 4 GDPR.

Where you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.

In individual cases, we process personal data for direct marketing purposes. You may object at any time to the processing of personal data for such marketing purposes. This also applies to profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, we will no longer process your personal data for those purposes.

You also have the right, on grounds relating to your particular situation, to object to the processing of personal data concerning you for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

In connection with the use of information society services and notwithstanding Directive 2002/58/EC, you are free to exercise your right to object by automated means using technical specifications.

 

14.8 Withdrawal of consent under data protection law

You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.

 

14.9 Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint concerning our processing of personal data with a supervisory authority responsible for data protection.

 

  1. ROUTINE STORAGE, ERASURE AND BLOCKING OF PERSONAL DATA

We process and store your personal data only for the period necessary to achieve the purpose of storage or where this is required by the laws and regulations to which our company is subject.

Where the purpose of storage no longer applies or a prescribed storage period expires, the personal data is routinely blocked or erased in accordance with the statutory provisions.

 

  1. DURATION OF PERSONAL DATA STORAGE

The criterion used to determine the duration of personal data storage is the applicable statutory retention period. Once that period has expired, the relevant data is routinely erased, provided that it is no longer required for the performance of or entry into a contract.

 

  1. DATA PROCESSING IN THIRD COUNTRIES

Some of the services we use, as described in the relevant information concerning the respective providers and services, may also process data in the USA.

The Court of Justice of the European Union has regarded the USA as a country with an inadequate level of data protection by European Union standards. In particular, there is a risk that your data may be processed by US authorities for monitoring and surveillance purposes, potentially without an effective means of legal redress.

In this respect, we confirm that all necessary and required measures have been taken to adequately document data protection and to ensure the greatest possible level of security for such transfers to the USA.

For this purpose, the required data processing agreements have been concluded and the applicability of the European Union Standard Contractual Clauses has been agreed. Separate safeguards for data security have also been agreed with the providers.

All measures have been documented by us and subjected to a risk assessment and a data protection impact assessment.

 

  1. GENERAL INFORMATION CONCERNING DATA PROCESSING OUTSIDE OUR WEBSITE

18.1 Contact/visitors

You may contact us. The data processed for this purpose, such as email data and your name, is necessary to enable communication and to deal with your request. Additional data that you provide makes it easier for us to address you personally or to handle your request more effectively or quickly.

This processing is based on Article 6(1)(b) GDPR where it is necessary in order to take steps prior to entering into or to perform a contract. In all other cases, processing is carried out on the basis of our legitimate interest pursuant to Article 6(1)(f) GDPR. Our legitimate interest lies in responding to your request.

 

18.2 Suppliers, service providers and business partners

We use contact and communication data and other relevant personal data relating to our suppliers, service providers and business partners where they or their employees are natural persons.

We process this data for the purposes of conducting the business relationship, communicating and maintaining contacts. The provision of data is generally necessary in order to initiate, perform and invoice contracts. Where the data is not provided, it may not be possible to enter into a contract.

This processing is based on Article 6(1)(b) GDPR where it is necessary in order to take steps prior to entering into or to perform a contract.

Where the processing does not concern the initiation or performance of a contract, it is carried out on the basis of our legitimate interest pursuant to Article 6(1)(f) GDPR. Our legitimate interest lies in managing the business relationship and maintaining contacts.

The storage period is determined by the general limitation rules and applicable tax retention obligations.

 

18.3 Applications

You may apply to us by sending us your documents. The personal data provided in this context is processed exclusively for the purpose of handling your application.

The processing is necessary in order to take steps prior to entering into an employment relationship, to enable the relevant communication and to deal with your request.

In individual cases and where necessary in order to initiate an employment relationship, we process personal data that we have lawfully received from third parties, such as recruitment agencies, or obtained from publicly accessible sources, such as social networks or internet search engines.

This processing is based on Article 6(1)(b) GDPR in conjunction with Section 26(1) BDSG.

As a general rule, we store this data for a period of up to six months after completion of the application procedure. Data is stored beyond this period only where you have expressly consented to this pursuant to Article 6(1)(a) GDPR.

There is no statutory or contractual obligation to provide your data. However, your application cannot be processed without the necessary information.

 

18.4 Recipients of the aforementioned data

In connection with the aforementioned activities, we work with service providers, partners, authorities and other third parties that may receive personal data, including, among others:

  • hosting service providers;
  • IT and telecommunications service providers;
  • logistics and delivery service providers;
  • document storage and disposal service providers; and
  • authorities and institutions

We transmit your data to these recipients only where this is necessary for the performance of a contract with you, where we are subject to a legal obligation to do so or where we have a legitimate interest in disclosing your data.

The legitimate interest may consist, in particular, of maintaining our business organisation or establishing, exercising or defending legal claims. Please contact our Data Protection Officer where you have any further questions.

As a general rule, we do not disclose personal data to recipients based outside the European Economic Area in so-called third countries. Where such transfers occur in individual cases, we ensure an appropriate level of protection in accordance with Chapter V GDPR, including by concluding the contractual addenda currently recommended by the authorities and agreeing specific safeguards for your data.

Such processing operations and their effects are documented and regularly subjected to risk assessments.

 

18.5 Storage period

Where we store your personal data, we do so only for a limited period and no longer than necessary. As a general rule, we erase your data when it is no longer necessary for the processing purpose for which it was collected or where other legal grounds require its erasure.

Where we are subject to statutory retention obligations requiring longer storage, we retain the data for the relevant period, in particular in order to comply with retention periods under commercial and tax law, which range from two to ten years.

Other legal grounds for retention may include the need to retain data as evidence for the duration of the applicable limitation periods. These periods generally range from two to thirty years.

Please contact our Data Protection Officer where you have any further questions.

 

18.6 Obligation to provide data

Where personal data is necessary in order to establish and perform the contractual relationship and fulfil the associated contractual or statutory obligations, you are required to provide this data so that we can fulfil our service obligations or legal obligations.

Without the provision of this data, we may no longer be able to provide the service, or may be unable to provide it properly or in full.

 

  1. VALIDITY AND AMENDMENT OF THIS PRIVACY POLICY

This Privacy Policy is currently valid and was last updated in June 2026.

As a result of the further development of our websites and services, or due to changes in statutory or regulatory requirements, it may become necessary to amend this Privacy Policy.

The current Privacy Policy may be accessed and printed at any time from our website at https://www.ewg.de/datenschutz

 

Ansprech-
partner:innen