Data Protection Policy
Thank you for visiting our website. The protection and confidentiality of your personal data is of particular importance for StepStone.
In this document we will inform you about the processing of personal data in connection with the services we offer at www.stepstone.com and other websites or apps (collectively referred to as “Platforms”) that incorporate this Data Protection Policy. Personal data comprises all information that relates to an identified or identifiable natural person (Article 4 (1) GDPR). This includes information such as your name, e-mail address, postal address, or telephone number. Information that is not directly associated with your identity, e.g. the number of users of an Internet site, does not fall within this scope.
- Who is responsible for the processing of your personal data?
The data controller (hereinafter referred to as “StepStone” or “we”) in the sense of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:
T +49 30 398 0620
F +49 30 398 09111
E-mail : email@example.com
2. Contact details of the data protection officer
You can contact our data protection as follows:
StepStone Deutschland GmbH
Völklinger Straße 1
Contactable by telephone on +49 (0) 211 93493-0
and by e-mail at firstname.lastname@example.org
- Purposes and legal basis of the data processing and period for which data will be stored
In the following we inform you about the different purposes for which we process personal data, on which legal basis such processing takes place, and for how long we store the data.
Insofar as we obtain the consent of the data subject for processing personal data, Art. 6 (1) (a) EU General Data Protection Regulation (GDPR) is the legal basis for the processing of personal data. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) (b) GDPR will be the legal basis. This also applies to processing operations required to carry out pre-contractual actions. If processing of personal data is required to fulfill a legal obligation that our company is subject to, Art. 6 (1) (c) GDPR is the legal basis. If processing is necessary to safeguard the legitimate interests of our company or a third party, and if the interests, fundamental rights, and freedoms of the data subject do not prevail over the first interest, Art. 6 (1) (f) GDPR is the legal basis for processing.
The personal data of the data subject will be stored for as long as the purpose continues.
- General access to our Platforms
With each access to our Platforms, we automatically collect data and information from the accessing device and store this data and information in the log files of the server. We may collect (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system accesses our website (known as referrers), (4) the sub-web pages that are accessed on our website (5) the date and time of access to the website, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system and (8) other similar data and information used to defend any attacks against our IT systems. For security purposes, i.e. to be able to reconstruct an eventual attack against our Platforms, we store such data including the IP address for 14 days and then anonymize or delete such data. The IP address is required during the connection to transfer the contents of our Platform to your device. The legal basis for the processing and storage of the IP address is a legitimate interest as per Article 6 (1) (f) GDPR. The legitimate interest for the transmission of the IP address is that it is required to display the contents of the website; without transmission of the IP address it is not possible to display the content of the Platform. The legimtiate interest for the temporary storage are our security interests.
- Optimization of search and recommendation functions
We may also store information about your usage patterns on our Platforms in order to create statistical models to make our Platforms more user-friendly and, in particular, to optimize the functionalities to search for and recommend suitable job advertisements. In this context we also save your IP address in a pseudonymized form (that means that a natural person can no longer be identified based purely on the information in the statistical model) to exclude automated accesses (bots) to our Platforms when creating the statistical models. Legal basis for this purpose is Art. 6 (1) GDPR. Our legitimate interest is to ensure the functionality of the statistical model to improve our services. The IP address is deleted after one year.
- Contact form and e-mail contact
Our Platforms provide contact forms that can be used to contact us electronically. By clicking the “Send” button, you consent to the transmission to us of the data entered in the input form. In addition, we save the date and time of your contact. Alternatively, contact via the e-mail address provided is possible. In this case, the user’s personal data transmitted along with e-mail and our response will be stored. The personal data voluntarily transmitted to us in this context is used to process your inquiry and to contact you as needed. The legal basis for the transmission of the data is Art. 6 (1) (a) GDPR. The data will be used for this purpose until the specific conversation with you has ended. The conversation will be deemed ended when it can be inferred from the circumstances that the relevant facts have been conclusively clarified.
- Use of data processors for hosting and securing our platforms, administrative, troubleshooting, and support services
We use data processors, which we list below, to provide our services. The legal basis for using these data processors is legitimate interest under Art. 6 (1) (f) GDPR. The legitimate interest lies in the execution of our business activities, particularly to provide the services described elsewhere in this Data Protection Policy. No conflicting interest is apparent because we have entered into a data processing agreement with the respective processors under Art. 28 GDPR.
We use data processors to host our Platforms and for back-up services, meaning that personal data that is stored on our platforms is transferred to these data processors. These data processors are Amazon Webservices, Inc., 410 Terry Drive Ave North, WA 98109-5210 Seattle, USA (who processes data solely in the EU), StepStone GmbH, Axel-Springer-Str. 65, 10969 Berlin, Germany, StepStone Continental Europe GmbH, Völklinger Straße 1, 40219 Düsseldorf, Germany and StepStone N.V., Koningsstraat 47 Rue Royale, 1000 Brussels Belgium. These data processors will store the data for the same duration as it is stored on our Platforms for the various purposes defined in this Data Protection Policy.
- Administrative, troubleshooting, and support services
We use StepStone Services sp. z o.o., ul. Domaniewska 50, 02-672 Warsaw, Poland, for administrative, troubleshooting, and support services, and which may consequently also have access to your personal data. Generally StepStone Services sp. z o.o should not store any personal data. This will only be done in exceptional cases, e.g. if needed to rectify technical issues. In such cases personal data will only be stored to the extent and for the duration that is necessary.
- Sending of e-mails and other messages
For the sending of e-mails and messages through other electronic channels we use the services of Selligent GmbH, Atelierstraße 12, 81671 Munich, Germany, as a data processor, who in turn uses the following subcontractors
- Selligent Benelux NV, Kempische Steenweg, 305 box 401 Belgium
- Selligent International, Avenue de Finlande 2 box 2, 1420 Braine-L’Alleud, Belgium
- Selligent France SA, 20 Place des Vins de France RCS, 75012 Paris, France
- Selligent SA, 1420 Braine-l’Alleud, 2 avenue de Finlande, Belgium
- Selligent Iberica S.L.U, Caille Enrique Granados 86-88, Planta 3 °, 0008 Barcelona, Spain
- Selligent Ltd, Second Floor, 45 Folgate Street, London E1 6GL, United Kingdom
Accordingly, these parties may also be provided with your personal data in the course of data processing commissioned by us. It will be stored there for a period that is otherwise lawful for purposes under this Data Protection Policy, i.e. in particular for the contractual communications in the course of contracts with you or otherwise for promotional communications.
The legal basis for our use of Selligent is a legitimate interest under Art. 6 (1) sentence 1 f GDPR, namely the execution of our business purposes in the course of the processes described elsewhere in this Data Protection Policy. No conflicting interest is apparent in this respect, in particular due to the fact that we have entered into a data processing agreement with Selligent.
- Proxy caching and web application firewall
We use Akamai Technologies GmbH, Parkring 20-22, 85748 Garching, Germany and Akamai Technologies, Inc., 150 Broadway, Cambridge, 02142 MA, USA as data processors for the purposes of proxy caching and web application firewall services. That means that any visit to our websites is routed through the servers of Akamai, meaning that the user will not be connected directly to our servers but to those of Akamai and Akamai will then request the content from our servers and will deliver it to the user. Proxy caching in this context means that Akamai will cache selected content (but not personal data) for a period of 24 hours, so that this can be delivered faster to you. The web application firewall means that Akamai will try to identify malicious web traffic and will prevent it from accessing our websites. Akamai does not store any personal data, but any dataflows between our servers and the user will be routed through Akamai, so that this can also include personal data. Data transferred to Akamai Technologies, Inc is transferred outside the EU and the EEA. This is permissible under Art. 45 GDPR because Akamai Technologies, Inc is Privacy Shield certified and thus an adequate level of protection exists according to the Implementing Decision of the Commission (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016D1250&from=DE). The certification can be viewed at https://www.privacyshield.gov/participant?id=a2zt0000000Gn4RAAS&status=Active.
With respect to Akamai, the additional legitimate interest in the context of the legal basis is that we thereby are also implementing technical and organizational measures to protect our Platforms and the personal data stored on them.
In specific cases we use the reCAPTCHA service https://www.google.com/recaptcha/intro/ by Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA, (“Google”) based on a legitimate interest (i.e. the interest to ensure the correctness of data, avoidance of automatic registrations / orders by so-called bots, and economical operation of our online offering within the meaning of Art. 6 (1) f) GDPR).
Google is certified under the Privacy Shield Agreement and thus warrants that it complies with European privacy legislation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
We use re-Captcha to distinguish whether an input is made by a human or abusively by automated, mechanical processing. The query in this context includes the sending of the IP address and any other data required by Google for the reCAPTCHA service to Google. Your input will be transmitted to Google and analyzed for this purpose.
For more information about Google reCAPTCHA and Google’s Data Protection Policy, please visit the following links: https://www.google.com/intl/en/policies/privacy/ and https://www.google.com/recaptcha/intro/android. html.
- Cookies and similar technology
Some of the cookies we use are deleted at the end of the browser session, i.e. when you close your browser (known as session cookies). Other cookies are kept on your end device and enable us or our partner companies to recognize your browser on the next visit (persistent cookies).
If not specifically stated below, you can view the exact retention period of a given cookie by displaying the cookie in your browser.
You can set your browser up such that you are notified when a cookie is set and can decide individually whether to accept them or whether you opt out of accepting cookies for specific cases or generally. If you opt out of accepting cookies, the functionality of our website may be limited. We deal with specific cookies or similar technology below.
- Technically necessary cookies
We use technical cookies. These are cookies that are merely required to collect certain information on our Platforms to provide a service required or wanted by you as user. This extends to navigation or session cookies that enable smooth navigation and use of the website (and for instance permit access to the restricted area); analysis cookies that are set directly by us to collect aggregated information about the number of users and their behavior; functional cookies that provide you with navigation by certain selected criteria as part of a service optimization (e.g. selected language, purchase of selected products).
The legal basis for these cookies is a legitimate interest under Art. 6 (1) sentence 1 f GDPR, namely pursuance of our business purposes.
- Cookies and technologies that we use via third party providers
In our apps we use technology from Google Firebase (Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA, “Google”) with various functionalities.
Firebase Analytics enables the analysis of the use of our apps. This completely aonymized information about the use of our app is collected and transmitted to Google and stored there. Google uses the advertising ID of the device. Google will use this information to evaluate the use of our app and to provide us with other services related to the use of apps. In Device Settings, you can restrict the use of the Advertising ID (iOS: Privacy / Advertising / No Ad Tracking, Android: Account / Google / View). Google Analytics for Firebase (Google Inc.). We also use Firebase Remote Config, which allows us to run A / B tests and customize the behavior and appearance of the app without having to download a new version. Personal data is not stored.
Google Inc. is certified under the Privacy Shield Agreement, which provides a guarantee to comply with European privacy legislation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active). Subcontractors that Google can use can be found here: https://firebase.google.com/terms/subprocessors.
The legal basis for the use of data analysis and the use of Firebase is a legitimate interest (ie interest in the analysis, optimization and economic operation of our apps) within the meaning of Art. 6 (1) (f) GDPR).
You can opt-out of using Firebase at any time by changing the setting of the slider for anonymous statistics in the app under “Settings”.
- Google Conversion Tracking
On the grounds of our legitimate interests (i.e. interest in the analysis, optimization, and economical operation of our online offering within the meaning of Art. 6 (1) (f) GDPR), we use the marketing and remarketing services (for short: “Google Marketing Services”) of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, (“Google”).
Google is certified under the Privacy Shield Agreement and thus warrants that it complies with European privacy legislation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
The Google Marketing Services enable us to display advertisements for and on our website in a more targeted manner to so that users are only shown advertisements that they may be interested in. If a user sees e.g. advertisements for products that he or she was interested in on other websites, this is referred to as “remarketing”. For this purpose, when our websites and other websites are accessed on which Google Marketing Services are active, Google directly executes a Google code and what are termed (re)marketing tags (invisible graphics or code, also known as “web beacons”) are integrated into the website. These are used to store an individual cookie, i.e. a small file on the user’s device (comparable technologies may also be used instead of cookies). The cookies may be set by various domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com, or googleadservices.com. This file records which websites the user searches for, the content he or she is interested in and which offers he or she has clicked. It also stores technical information on the browser and operating system, referring websites, time of visit, and other information on the use of the online offering. Similarly, the user’s IP address is recorded, whereby in the context of Google Analytics we state that the IP address is shortened in within Member States of the European Union or in other signatory states of the Agreement on the European Economic Area. Only in exceptional cases is it transferred in full to a Google server in the USA and shortened there. The IP address is not merged with the user’s data within other Google offerings. Google may also combine the above information with information from other sources. If the user subsequently visits other websites, tailored advertisements can be displayed depending on his or her interests.
The user’s data is processed in a pseudonimyzed form as part of the Google Marketing Services. This means that Google stores and processes e.g. not the user’s name or e-mail address, but instead processes the relevant data based on the cookie within pseudonymized user profiles. This means that, from Google’s perspective, the advertisements are not managed and displayed for a specifically identifiable person, but for the holder of the cookie, irrespective of who the holder of this cookie is. This does not apply if a user has expressly permitted Google to process the data without this pseudonymization. The information about the user collected by Google Marketing Services is transferred to Google and stored on Google’s servers in the USA.
The Google Marketing Services deployed by us include the “Google AdWords” online advertising program. Google AdWords supplies every AdWords customer with a different “conversion cookie”. This means that cookies cannot be traced via the websites of AdWords customers. The information obtained using the cookie enables conversion statistics for AdWords customers to be produced who have opted for conversion tracking. The AdWords customers are notified of the total number of users who clicked their advertisement and were forwarded to a page containing a conversion tracking tag. However, they are not given any information that could be used to personally identify users.
Additionally, we may deploy the “Google Tag Manager” to integrate and manage the Google analytics and marketing service within our website.
If you would like to opt out of interest-driven advertising from Google Marketing Services, you can use the settings and opt-out options provided by Google: http://www.google.com/advertisements/preferences.
We use the “Tealium Audience Stream”, a service by Tealium Inc., 11085 Torreyana Road, San Diego, CA 92121, USA (Tealium) within our website. This collects and stores data that we use to create pseudonymized user profiles. On our behalf, Tealium will use this information to structure your use of the website in line with your needs automatically and in real time and to display advertising. For this purpose, information including the following is collected: viewed and clicked advertisements, articles, advertising, visitor numbers, subject matter of the page, etc.
The pseudonymized user profiles are not merged with personal data about the bearer of the pseudonym without consent, which must be provided separately. Similarly, the IP address transmitted by your browser is not merged with the usage profiles.
Cookies are used is used to create the usage profiles, or similar technology for mobile end devices. The information generated by the cookie about your use of this website is stored exclusively in Germany. You can prevent the storage of the cookies by making a corresponding setting in your browser software; however, please note that if you do so you may not be able to use all functions of this website fully.
You may opt out of the data collection and storage for the purposes of web analysis and the placement of advertisements with future effect by following the instructions on http://tealium.com/de/privacy/.
The legal basis is a legitimate interest under Art. 6 (1) sentence 1 f GDPR, namely pursuance of our business purposes.
- Tealium iQ (Tag Management System)
This website uses a Tag Management System (TMS), a service from Tealium Inc., 11085 Torreyana Road, San Diego, CA 92121, USA (Tealium), for the dynamic customization of parts of the website. To enable this functionality, a cookie called utag_main is set. The TMS is needed for us to provide our services and can therefore not be deactivated. The cookie has a term of twelve months.
Data transferred to Tealium is transferred to the USA and thus to a country outside the EU and the EEA. This is permissible under Art. 45 GDPR because Tealium is Privacy Shield certified and thus an adequate level of protection exists according to the Implementing Decision of the Commission (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016D1250&from=DE). The certification can be viewed at https://www.privacyshield.gov/participant?id=a2zt0000000TSaYAAW&status=Active.
The legal basis is a legitimate interest under Art. 6 (1) sentence 1 f GDPR, namely pursuance of our business purposes.
We use Adobe Analytics, a web-analytics tool from Adobe Systems Software Ireland Limited, that enables us to optimize our services in line with your requirements.
No personal data is stored because of the anonymization.
As a user of our websites you of course have the option to block cookies at any time in your browser settings. You can opt out of any future recording of your user behavior on the Platform at any time; click the following link for instructions on how to deactivate cookies on your computer: https://www.adobe.com/privacy/opt-out.html.
The legal basis for processing this data is a legitimate interest under Art. 6 (1) (f) GDPR. The legitimate interest as defined by Art. 6 (1) (f) GDPR that we are pursuing by processing the data described above is our interest in structuring our offerings in a user- and demand-driven manner. No conflicting interest is apparent, especially because you may opt out at any time.
- Recipients or categories of recipients of personal data
We engage data prozessors so that they can receive personal data.
For details about the particular job processors, see:
- 4Use of data processors for hosting and securing our platforms, administrative, troubleshooting, and support services
- 5 Cookies and similar technologies
- Transfer of personal data to third countries
Some of the data processors we use process data in third countries (non-EU or EEA countries), which may result in the transfer of personal data to such third countries. We only use such data processors in third countries if: (i) the third country either has an adequate level of data protection under Article 45 GDPR; or (ii) there are suitable guarantees within the meaning of Article 46 GDPR, in particular in the form of standard data protection clauses; In accordance with Art. 47 DSGVO, data processors have binding internal data protection regulations. For details on individual data processors processing data in third countries see:
- 4.3 Selligent, Inc
- 4.4 Proxy Caching und web application firewall
- 5.2 (2) Google Conversion Tracking
- 5.2 (3) Tealium Audience Stream
- 5.2 (4) Tealium iQ (Tag Management System)
- Rights of the data subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the data controller:
You may request confirmation from us as to whether we process personal data relating you. If such processing is taking place, you can request the following information from us:
- the purposes for which the personal data is being processed;
- the categories of personal data that are being processed;
- the recipient or categories of recipient to whom the personal data concerning you has been or will be disclosed;
- the envisaged period for which the personal data concerning you will be stored or, if no concrete information about this is possible, criteria used to determine that period;
- the existence of a right to rectification or erasure of the personal data concerning you, a right restrict the processing of the data by the controller or a right to object to this processing;
- the existence of a right to lodge a complaint with a supervisory authority;
- any available information about the origin of the data if the personal data was not collected from the data subject;
- the existence automated decision-making including profiling in accordance with Art. 22 (1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved and the scope and the intended effects of such processing for the data subject.
You have the right to request information about whether the personal data in question will be transferred to a third country or an international organization. In this context you can ask to be notified of the suitable safeguards in accordance with Art. 46 GDPR in the context of the transfer.
This right to information may be limited if it is likely to render impossible or seriously impair the achievements of the statistical purposes and the limitation is necessary for satisfying the statistical purposes.
You have a right to rectification and/or completion vis-à-vis the data controller if the personal data concerning you that is being processed is incorrect or incomplete. The data controller must perform the rectification without undue delay.
Your right to rectification may be limited if it is likely to render impossible or seriously impair the achievements of the statistical purposes and the limitation is necessary for satisfying the statistical purposes.
- Right to restriction of processing
If the following conditions are met, you can demand that the processing of the personal data concerning you is restricted:
- if you contest the accuracy of the personal data relating for you for a that enables us to review the accuracy of the personal data;
- the processing is unlawful and you oppose the erasure of the personal data and instead request a restriction of the use of the personal data;
- we no longer require the personal data for the purposes of the processing, but you need it to establish, exercise, or defend legal claims, or
- if you have objected to the processing in accordance with Art. 21 (1) GDPR and it has not yet been verified whether our legitimate reasons override yours.
If the processing of the personal data concerning you has been limited, this data – with the exception of being stored by you – may only be processed with your consent or for the purpose of establishing, exercising, or defending legal claims or to protect the rights of another natural or legal or on grounds of a compelling public interest of the EU or a Member State.
If a restriction of processing has been imposed in accordance with the above conditions, we will notify you before the restriction is lifted.
Your right to restrict processing may be limited if it is likely to render impossible or seriously impair the achievements of the statistical purposes and the limitation is necessary for satisfying the statistical purposes.
You may request that we erase the personal data concerning you without undue delay, and we are obliged to erase this data without undue delay where one of the following grounds applies:
- The personal data concerning you is no longer needed for the purposes for which it was collected or otherwise processed.
- You withdraw your consent upon which the processing was based pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, and no other legal ground for the processing applies.
- You object to the processing in accordance with Art. 21 (1) GDPR and no overriding legitimate grounds for the processing apply, or you raise an objection to the processing under Art. 21 (2) GDPR.
- The personal data concerning you has been processed unlawfully.
- The erasure of the personal data concerning you is required in order to comply with a legal obligation under EU law or the law of the Member States to which we are subject.
- The personal data concerning you is collected in the context of information society services pursuant to Art. 8 (1 ).
- Information to third parties
If we have published the personal data concerning you and we are obliged to delete it under Art. 17 (1) GDPR, we will take reasonable steps (including in terms of technical feasibility), taking account of the available technology and implementation costs, in order to notify the responsible data controller who is processing the data that you as a data subject have requested from them the erasure of all links to this personal data or copies or replications of this personal data.
There is no right to erasure if the processing is necessary
- for the exercise of the right to the freedom of expression and information;
- to satisfy a legal obligation that requires the data to be processed under the law of the EU or the Member States to which the data controller is subject, or to perform a task that is carried out in the public interest or in the exercise of official authority vested in the data controller;
- on grounds of the public interest in the area of public health in accordance with Art. 9 (2) (h) and (i) as well as Art. 9 (3) GDPR;
- for archiving purposes in the public interest, academic or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR, provided the right specified under section a) is likely to render impossible or seriously impair the achievements of the objectives of this processing or
- to establish, exercise, or defend legal claims.
- Right to data portability
You have the right to the receive the personal data concerning you that you have provided to us in structured, commonly used, and machine-readable format. Further, you have the right to transmit this data to a different data controller without hindrance from us, provided
- the data processing is based on consent under Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR and
- the processing is being performed using automated means.
Further, in exercising this right you also have the right to have the personal data concerning you transferred directly from one data controller to another data controller, where technically feasible. This must not adversely affect other people’s rights and freedoms.
The right to data portability does not apply to the processing of personal data that is required for a task that is performed in the public interest or the exercise of official authority vested in us.
You have the right to object, on grounds relating to your specific situation to object, at any time to the processing of the personal data concerning you which is based on Art. 6 (1) (e) or (f) GDPR; this also applies to any profiling based on those provisions.
In this case we will stop processing the personal data concerning you unless we can provide compelling and legitimate grounds for the processing that override your interests, rights and freedoms, or the data is being processed for the purpose of establishing, exercising, or defending legal claims.
If the personal data concerning you is being processed for the purpose of conducting direct marketing, you have the right to object at any time to the processing of the personal data concerning you for such marketing; this also applies to any profiling connected to such direct marketing.
If you object to the data processing for the purposes of direct advertising, the personal data concerning you will no longer be processed for these purposes.
In the context of the use of information society services and Directive 2002/58/EC notwithstanding, you may exercise your right to object using automated means using technical specifications.
Where personal data is processed for statistical purposes pursuant to Art. 89 (1) GDPR, you, on grounds relating to your specific situation, have the right to object to personal data concerning your being processed.
Your right to object may be limited if it is likely to render impossible or seriously impair the achievements of the statistical purposes and the limitation is necessary for satisfying statistical purposes.
- Right to withdraw the declaration of consent under data-processing law
You have the right to withdraw your declaration of consent under data-processing law at any time. Withdrawing the consent has no bearing on the lawfulness of any processing performed up to the point of the revocation.
- Automated decision in individual cases including profiling
You have the right not to be subject to a decision that is based solely on automated processing – including profiling – that produces legal effects on you or is similarly significantly affects you. This does not apply if the decision
- is necessary for the entering into or performing a contract between you and the data controller,
- is authorized under legal provisions of the EU or the Member States to which the data controller is subject and these legal provisions contain adequate measures for safeguarding your rights and freedoms as well as your legitimate interests or
- is made with your explicit consent.
However, these decisions must not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) (a) or (g) applies and adequate safeguards to protect the rights and freedoms as well as your legitimate interests are in place.
As regards the cases stated in (1) and (3), we take adequate measures to your rights and freedoms as well as your legitimate interests, which include at least the right to have a person intervene on the data controller’s side, to present your own point of view, and to challenge a decision.
- Right to lodge a complaint with a supervisory authority
Notwithstanding any other administrative or judicial legal remedy, you have the right to lodge a complaint with a supervisory authority in the Member State of your place of residence, your workplace, or the place of the alleged breach if you are of the opinion that the processing of the personal data concerning you breaches the GDPR.
The supervisory body to which the complaint was submitted will notify the complainant of the status and outcomes of the complaint including the option of a judicial remedy under Art. 78 GDPR.
- No legal or contractual obligation to provide personal data; Consequence of non-provision
You have no legal or contractual obligation to provide personal data on our platform. However, you may not use all of the services we offer if you do not wish to provide the personal data requested on our platform.
- Amendment of the data protection policy; amendment of purpose
We reserve the right to amend this Data Protection Policy in consideration of stipulations under data-protection law. You will always be able to locate the current version here or another corresponding, easily locatable point of our website or app. If we are intending to process your data for other purposes, i.e. those for which it was collected, we will notify you about this in advance in compliance with the statutory provisions.