Privacy Policy

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

NEXT Munich GmbH
Birkenleiten 43
81543 Munich
info@next-munich.com, +49 89 41111580

If you have any questions regarding data protection, you can also contact our Data Protection Officer directly:

David Heimburger, Attorney-at-Law
dh@davidheimburger.de, +49 40 22863648

We strive to use inclusive language throughout this website. In some cases, however, we use the masculine form of certain terms—for example, user—to improve readability. Wherever a masculine form is used, it is intended to refer to people of all genders.

Below is an overview of the general rights you are entitled to under the General Data Protection Regulation (GDPR) in relation to the personal data we process. For the definitions of the legal terms used, please refer to Article 4 of the GDPR. If anything remains unclear, please do not hesitate to contact us.

Under the GDPR, you have the following rights:

• Right to withdraw consent: You may withdraw any consent you have given for the processing or sharing of your personal data at any time with future effect (Article 7(3) GDPR).
• Right to object: Where the legal basis for processing your personal data is our legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right to object to the processing in accordance with Article 21 GDPR. If the processing relates to direct marketing, you do not need to provide any reasons for your objection. In all other cases, you must state reasons relating to your particular situation.
• Right to rectification: If we hold inaccurate personal data about you, you have the right to request that it be corrected (Article 16 GDPR).
• Right of access: You have the right to request information about the personal data we process about you (Article 15 GDPR and Section 34 of the German Federal Data Protection Act (BDSG)).
• Right to erasure and restriction of processing: You may request the deletion of your personal data or the restriction of its processing, provided there are no overriding legal retention obligations preventing us from doing so (Articles 17 and 18 GDPR, and Section 35 BDSG).
• Right to data portability: You may request that we provide the personal data you have supplied to us in a machine-readable format so that it can be transferred to a third party (Article 20 GDPR).
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority for data protection, such as the Bavarian State Office for Data Protection Supervision, if you believe that the processing of your personal data infringes applicable data protection law.

Any processing of personal data requires a legal basis that permits us to carry out that processing. The applicable legal basis depends primarily on the purpose for which the data is processed. Whether processing is lawful under a particular legal basis also depends on the specific scope of the processing and the measures we have implemented to protect your personal data.

The legal bases for processing personal data are set out in Article 6(1) GDPR and, for special categories of personal data such as health data, in Article 9(2) GDPR. These provisions identify the performance or preparation of contractual obligations, compliance with legal obligations, and the fulfilment of other legitimate responsibilities as the primary legal bases for processing personal data. In addition, we process personal data where we have a legitimate interest in doing so, provided that, in the specific circumstances, your interests or fundamental rights and freedoms do not override those interests. Where one of these legal bases applies, no additional consent is required.

Personal data may also be processed on the basis of your consent (Article 7 GDPR). In the case of children under the age of 16 using information society services (such as websites, online games, or social media platforms), processing may take place only with the consent of the child and the authorisation of a parent or legal guardian, as required by Article 8 GDPR.

Please note that none of our services is intended for persons under the age of 16.

In some cases, our obligation to obtain your consent arises not only under the GDPR but also under the German Telecommunications Digital Services Data Protection Act (TDDDG) or the German Act Against Unfair Competition (UWG). We have taken the requirements of these laws into account, even where they are not explicitly referred to in the following sections.

Where personal data is transferred to a country outside the European Economic Area (EEA), we ensure that an appropriate level of data protection is maintained in accordance with Articles 44 to 49 GDPR. In data protection law, such a transfer is referred to as a transfer to a third country.

Cookies are a specific type of text file that your browser stores on your device when you visit a website. A cookie can contain different types of information. In some cases, it stores only a simple value such as "yes" or "no" ("true" or "false") or a country code such as "de" for the German language. In other cases, it stores a string of characters that allows your browser to be uniquely identified when you revisit the website (a so-called cookie ID).

The legal basis for setting cookies is governed not only by the GDPR but primarily by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). This provision distinguishes between cookies that are strictly necessary for the operation of a website (essential cookies) and those that are not. Essential cookies may be set without your consent. Non-essential cookies, however, always require your consent, even where this would not be necessary under the GDPR (for example, where the processing is based on a legitimate interest or where no personal data is processed).

Before storing any non-essential cookies on your device, we will ask for your consent in accordance with the requirements of Section 25 TDDDG.

The purpose of each individual cookie, as well as the corresponding legal basis for its use under the GDPR, is explained in the descriptions of the individual processing activities below.

You have several options for preventing cookies from being stored on your device:

• In most cases, when you visit one of our websites, you can use our consent management platform to decide which cookies you wish to accept and which you do not. In some cases, however, we may only be able to offer you the option of accepting or rejecting all cookies, or specific groups of cookies.
• You can configure your browser so that it never accepts cookies. Please note that completely disabling cookies is likely to prevent certain website functions from working properly, including features you may wish to use or that do not require your consent.
• You can browse websites in your browser's private or incognito mode. Private browsing also prevents cookies from being permanently stored in your browser or automatically deletes them when the session ends.
• Some browsers and browser extensions allow you to define more detailed default settings, enabling you to specify which types of cookies should generally be accepted and which should be blocked.
• As a special case, Google provides a browser add-on that prevents various Google cookies from being set. The add-on is available here: https://tools.google.com/dlpage/gaoptout?hl=de

6.1. Visiting Our Website

6.1.1. Providing Our Website

Description: In order for our web server to make our website available to your browser, it must process technical information about the device, browser, and internet connection you use to access it. This information is commonly referred to as a log file or web log. These are the same types of data that are inevitably transmitted whenever you visit any website. The most important of these is your IP address, which the web server uses to send the requested website content back to your device.

Categories of Data: IP address used to access our website, Date and time of access, Website content requested by your browser, Type and version of your internet browser, Type and version of your operating system.

Recipients (including third-country transfers, where applicable): Our hosting provider, which is contractually bound to comply with data protection requirements under a data processing agreement, is located within the EEA. In the event of attacks on our website, data may be shared with forensic specialists and law enforcement authorities engaged by us. No transfer to a third country takes place.

Purpose and Legal Basis: The purpose of this processing is to provide our website and, where necessary, to investigate unauthorised access to our systems (for example, following a cyberattack). The legal basis is our legitimate interest, as operating a website would not be possible without collecting web log data. In the event of an attack, we also have a legitimate interest in providing investigators with the information necessary to determine how the attack occurred.

Retention Period: 7 days.

6.1.2. Contact Form

Description: Our website provides a contact form through which you can send us messages. Technically, the information you enter is transmitted to us as an email, even if you have not provided your own email address as the sender.

Once you submit your message, the data processing is equivalent to sending an email to our central contact address. While you are visiting our website and entering information into the contact form, the data processing is equivalent to visiting any other page on our website.

Categories of Data: See the processing activities "Providing Our Website" and "Email Mailbox".

Recipients (including third-country transfers, where applicable):
See the processing activities "Providing Our Website" and "Email Mailbox".

Purpose and Legal Basis: To provide a contact form as an additional means of contacting us. Depending on the nature of your enquiry, the legal basis is either the performance of pre-contractual measures or our legitimate interests.

Retention Period: See the processing activities "Providing Our Website" and "Email Mailbox".

6.1.3. Navigation Features (Google Maps)

Description: Our website integrates Google Maps, a mapping service provided by Google. These interactive maps allow you to view our location and obtain directions from your current location to us.

When you access the map through your browser, the embedded Google Maps feature transmits your IP address to Google and, unless you have disabled location sharing on your device, your current location. If you are signed in to your Google Account when accessing the page, Google will also be able to identify you through your personal account.

We do not receive any personal data about you from Google Maps.

You can prevent your location from being transmitted to Google by disabling your browser's access to your device's location services in your device settings. If you have a Google Account, you can also delete the location data that Google has stored about you.

We are unable to provide details about Google's processing of your personal data. Please refer to Google's Privacy Policy for further information:
https://policies.google.com/privacy

Additional information about Google Maps is available at:
https://www.google.com/intl/de_de/help/terms_maps.html

Although we do not receive any data from Google, Google considers our use of its mapping service to constitute joint controllership, as both Google and we have an interest in providing the service. Accordingly, we have entered into a Joint Controller Agreement with Google, which is available (in English only) at:
https://privacy.google.com/intl/de/businesses/mapscontrollerterms/

Google is solely responsible for the operation of Google Maps. We are responsible only for integrating Google Maps into our website.

Categories of Data: Your device's IP address, Your device's location, unless location sharing has been disabled on your device, Date and time of access, Google Maps content accessed and features used (e.g. route planning).

Recipients (including third-country transfers, where applicable): Google LLC, represented in Europe by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Where Google transfers personal data to third countries, it ensures an equivalent level of data protection in accordance with EU standards by entering into the European Commission's Standard Contractual Clauses.

Purpose and Legal Basis:
Google Maps is integrated to help you find and navigate to our location. The legal basis for transferring personal data to Google is our legitimate interest, as the navigation feature provides useful information about our location, while you can largely restrict Google's data collection through your cookie preferences.

Retention Period: The retention period is determined by Google. We are unable to delete this data because we do not collect any personal data through the use of Google Maps.

6.1.4. Video Streaming (Vimeo)

Description:
Our website displays videos using the Vimeo video player. We use the Vimeo player with the Do Not Track parameter enabled, meaning that Vimeo does not place cookies in your browser when you access the player and refrains from using the general tracking measures it would otherwise employ.

As the technical provider of the video hosting service, Vimeo processes the standard web log data that your device transmits when accessing streamed content, such as your IP address.

We do not receive any information from Vimeo regarding your use of the video player. Vimeo is solely responsible for this data processing. We provide this information because our website links to the external Vimeo service through the embedded video player.

For further information on how Vimeo processes your personal data, please refer to Vimeo's Privacy Policy:
https://vimeo.com/privacy

Information about Vimeo's Do Not Track feature is available at:
https://vimeo.zendesk.com/hc/de/articles/360001494447-Verwendung-von-Player-Parametern

Categories of Data: IP address used to access the Vimeo player, Date and time of access, Videos viewed, Sharing functions used to recommend a video, Type and version of your internet browser, Type and version of your operating system, Further details are available in Vimeo's Privacy Policy.

Recipients (including third-country transfers, where applicable): Vimeo.com, Inc., 555 West 18th Street, New York, NY 10011, USA. Vimeo processes personal data in the United States. To safeguard these transfers, we have entered into the European Commission's Standard Contractual Clauses (Controller-to-Controller) with Vimeo, ensuring a level of data protection equivalent to EU standards.

Purpose and Legal Basis: We use the Vimeo player to provide high-quality video streaming on our website. The legal basis for processing web log and streaming data is our legitimate interest, as online streaming services cannot be provided without processing the technical web log data required for their operation.

Retention Period: The retention period is determined by Vimeo. We do not store or process any personal data relating to your use of Vimeo and are therefore unable to delete such data.

6.1.5. Website Usage Analytics

Description: Our website uses Plausible Analytics, a privacy-focused web analytics service that does not use cookies. Plausible generates a so-called digital fingerprint based on the technical characteristics of your web browser, your IP address, and an additional random value. This fingerprint is stored for 24 hours to group your activity within that period (typically during a single visit to our website) into one continuous session. Once the fingerprint is automatically deleted after 24 hours, Plausible can no longer recognise you, as a new random value is generated and a new identifier is assigned.

On our behalf, Plausible uses the collected information to generate statistical reports on activity on our website, the geographical origin of visitors, and the technical characteristics of the devices used to access our website.

We do not disclose any data collected through Plausible to third parties. In particular, we do not combine this data with information from advertising networks or use it for marketing purposes in any other way.

Further information about Plausible is available at:
https://plausible.io/data-policy

Categories of Data: IP address used to access the internet, Location or country and internet service provider derived from the IP address, Date and time of access, Pages and other content viewed or clicked on within our website, Type and version of your web browser, Type and version of your operating system, Referring and subsequent webpages visited, A digital fingerprint based on a random value that remains valid for only 24 hours.

Recipients (including third-country transfers, where applicable): Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Plausible acts as our data processor under a Data Processing Agreement in accordance with Article 28 GDPR. The information collected is processed and stored on servers located within the European Economic Area (EEA). No transfers to third countries take place.

Purpose and Legal Basis: The purpose of this website usage analysis is to help us improve our online services based on the insights gained from visitor statistics.

The legal basis for this processing is our legitimate interest. This is justified because the personal reference of the collected data is limited to a digital fingerprint that is valid for only 24 hours, and we do not combine this information with any other datasets.

Retention Period: 24 hours per digital fingerprint. No other personal data is stored.

6.2. Our Social Media Profiles

6.2.1. LinkedIn

Description:
We operate a company profile on LinkedIn. Our LinkedIn profile enables us to present our organisation on the platform, communicate with you via LinkedIn, and promote our services and offerings through advertisements on the platform.

LinkedIn provides us with analytics relating to the use of our company profile. These insights help us understand how effective our individual communication activities are.

For further details about LinkedIn's processing of personal data, please refer to LinkedIn's Privacy Policy: https://www.linkedin.com/legal/privacy-policy

Categories of Data: LinkedIn username, Comments, reactions ("Likes"), and page views on LinkedIn, Date and time of the relevant activity.

Recipients (including third-country transfers, where applicable): LinkedIn Corporation, represented in Europe by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Where personal data is transferred to third countries, LinkedIn ensures an equivalent level of data protection by entering into the European Commission's Standard Contractual Clauses.

Purpose and Legal Basis: To analyse user activity on our LinkedIn profile. The legal basis for this processing is your consent, which you provided as part of your LinkedIn registration.

Retention Period: The retention period is determined by LinkedIn.

6.3. Customers

6.3.1. Customer Database (CRM)

Description: We maintain your data in our customer database as part of our Customer Relationship Management (CRM) system. The CRM stores your contractual information as well as the history of your customer relationship with us.

Categories of Data: Contact details (name, email address, telephone number, postal address), Order information (services provided, payment and delivery terms, invoices), Appointments, Communication history, Marketing consents.

Recipients (including third-country transfers, where applicable): Our CRM service provider, which processes data on our behalf under a Data Processing Agreement and is contractually bound to comply with applicable data protection requirements, is located within the European Economic Area (EEA). No transfers to third countries take place.

Purpose and Legal Basis: We use a CRM system to enable comprehensive management of our customer relationships, from the initial enquiry through to invoicing. The legal basis for this processing is our legitimate interest, as the use of a CRM system improves the quality of our services while increasing operational efficiency and reducing costs.

Retention Period: We retain your customer record for up to six years after the end of our most recent contact with you. This enables us to comply with the statutory retention requirements for business correspondence under commercial law.

6.3.2. Invoicing

Description: Where we issue an invoice to you, personal data is processed if the invoice recipient is a natural person (such as a sole trader or a partner in a partnership) or if you are named as the contact person on the invoice. We prepare our invoices internally and store them within our accounting system.

Categories of Data: Name, Postal address, Invoice date, Customer number and invoice number, Invoice amount, Invoice details.

Recipients (including third-country transfers, where applicable): None.

Purpose and Legal Basis: To issue invoices. The legal basis for this processing is the performance of a contract.

Retention Period: Invoices are retained for 10 years in accordance with statutory tax law requirements governing the retention of accounting records.

6.4. Marketing Communications

6.4.1. Telephone Marketing (B2B)

Description:
Where we have an express or implied consent to contact a prospective business customer (B2B) by telephone, we may contact you by phone to present our services (telephone marketing). In the case of business customers, we assume implied consent where you have previously contacted us and, for example, provided your telephone number when downloading a white paper or subscribing to our newsletter.

The details of these telephone calls are subject to the processing activities "Customer Database (CRM)" and "Telephone Calls".

Categories of Data: Name, Telephone number, Company/organisation, Marketing consent status, White paper download details, Date and time of the initial contact.

Recipients (including third-country transfers, where applicable): See the processing activities "Customer Database (CRM)" and "Telephone Calls".

Purpose and Legal Basis: To introduce our services and pricing to prospective business customers by telephone where express or implied consent to receive such calls exists. The legal basis is implied consent within the meaning of Section 7(2)(2) of the German Act Against Unfair Competition (UWG).

Retention Period: See the processing activities "Customer Database (CRM)" and "Telephone Calls".

6.5. Suppliers and Service Providers

Description:
As a customer, we process the personal data of our suppliers and service providers who operate as sole traders or partnerships, as well as the personal data of our contact persons within such organisations, in order to communicate with you regarding the performance of the relevant contract.

In addition to this communication, your personal data is typically processed as part of the separate processing activities described under our "General Infrastructure" (see below).

Categories of Data: Contact details, Contractual data, Invoice data.

Recipients (including third-country transfers, where applicable): Tax advisers, auditors, and legal advisers acting in their capacity as professional advisers subject to statutory duties of confidentiality.

Purpose and Legal Basis: To ensure the proper administration of our business operations. The legal bases for this processing are the performance of a contract, compliance with legal obligations, and our legitimate interests.

Retention Period: Invoice data is retained for 10 years in accordance with tax law requirements. Contractual data is retained for varying periods depending on the nature of the contract. For example, where copyright is involved, retention periods may extend to 70 years after the death of the author.

6.6. Recruitment

6.6.1. Job Applications

Description: When you apply for a position with us, we process your application documents solely for the purpose of deciding whether to offer you employment. Access to your application is restricted to those individuals who are reasonably involved in the recruitment decision.

If you are offered a position, your application documents will become part of your personnel file. If your application is unsuccessful, we will either ask for your consent to include your details in our candidate pool or return or securely destroy your application documents once the period during which claims may be brought under anti-discrimination legislation has expired.

Categories of Data: Name and contact details (email address, telephone number, postal address), Photograph, Profile URL on professional networking platforms (e.g. Xing), Information contained in your cover letter, CV, references, and certificates, Educational qualifications and professional credentials, Notes taken during telephone and in-person interviews, Where applicable, results of recruitment or aptitude tests.

Recipients (including third-country transfers, where applicable): None.

Purpose and Legal Basis: To assess applications and make recruitment decisions. The legal basis for this processing is the implementation of pre-contractual measures in preparation for entering into an employment contract and, following the conclusion of the recruitment process, our legitimate interest in defending against any claims relating to unsuccessful applications.

Retention Period: 6 months after the conclusion of the recruitment process.

6.6.2. Candidate Pool

Description:
If we are unable to offer you a suitable position at the present time but would like to consider you for future vacancies, we will ask for your consent to retain your application documents beyond the conclusion of the current recruitment process. If we have not contacted you within two years, we will either request your consent again to continue retaining your application or return or securely delete your application documents.

Categories of Data: Name and contact details (email address, telephone number, postal address), Photograph, Profile URL on professional networking platforms (e.g. Xing), Information contained in your cover letter, CV, references, and certificates, Educational qualifications and professional credentials, Notes taken during telephone and in-person interviews, Where applicable, results of recruitment or aptitude tests.

Recipients (including third-country transfers, where applicable): None.

Purpose and Legal Basis: To consider you for future employment opportunities. The legal basis for this processing is your consent.

Retention Period: 2 years from the date of our last contact with you or from the date you last gave your consent.

6.7. General Infrastructure

6.7.1. Email Mailbox, Contact Directory and Calendar.

Description: We use Microsoft 365 Exchange accounts for our email, contact directory, and calendar, which manage these categories of data within a single integrated system. Emails that you send to us or receive from us, your contact details, and appointments involving you are stored both on the servers of our hosting provider and as local copies on the devices connected to our Microsoft 365 accounts.

Further information about Microsoft's processing of personal data is available at:
https://privacy.microsoft.com/en-gb/privacystatement

Categories of Data: Name, Contact details (email address, telephone number, postal address, fax number), Your company, Your company's business sector, Your job title, Your area of responsibility, Date, time, place, and circumstances of our contact with you, Where applicable, notes regarding your availability or the business matters discussed, Date and time an email was sent or received, Email content (text, documents, images, and other attachments), Other standard email metadata.

Recipients (including third-country transfers, where applicable): Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft processes personal data on our behalf under a Data Processing Agreement. Where Microsoft Ireland transfers personal data to Microsoft Corporation in the United States or to other Microsoft group companies, Microsoft ensures an equivalent level of data protection by entering into the European Commission's Standard Contractual Clauses.

Purpose and Legal Basis: To provide synchronised email, calendar, and contact directory services. The legal basis for this processing is our legitimate interest, as participation in modern business operations would not be reasonably efficient without such a digital infrastructure.

Retention Period: We retain emails and related records only for as long as necessary to fulfil the relevant purpose. Retention periods therefore vary depending on the content of an email, the nature of the business relationship with a contact, or the context of a calendar entry.

For example, where an email relates to the preparation or conclusion of a contract, it is retained for six years in accordance with the statutory retention requirements for business correspondence under the German Commercial Code (HGB).

6.7.2. Telephone Calls

Description: When we speak by telephone, our cloud-based telephone system or our mobile phones record your telephone number together with the date and time of the call.

Where the content of the conversation makes it appropriate, we create a record of the call and store it in the relevant location, for example in our Customer Database (CRM) or, in the case of applicants and employees, within our HR records. Where appropriate, we may also add your contact details to our contact directory for future communication.

Calls are recorded only in exceptional circumstances and only after we have obtained your explicit consent.

Categories of Data: Telephone number, Date and time of the call, Where applicable, the content of the conversation.

Recipients (including third-country transfers, where applicable): Our mobile network providers and the provider of our cloud-based telephone system, both of which are subject to the telecommunications confidentiality obligations under the German Telecommunications Digital Services Data Protection Act (TDDDG). The provider of our telephone system is an EU-based company that forms part of a US corporate group. Where personal data is transferred to third countries within this group, the provider ensures an equivalent level of data protection by entering into the European Commission's Standard Contractual Clauses.

Purpose and Legal Basis: To communicate with you by telephone. Depending on the subject matter of the conversation, the legal basis is either the implementation or performance of a contract or our legitimate interest in communicating with you.

Retention Period: The retention period depends on the content of the conversation. In some cases, call notes may be subject to the statutory six-year retention period for business correspondence under the German Commercial Code (HGB).

6.7.3. Postal Correspondence

Description: If you send us a letter, we will generally respond in writing by preparing a reply on our computer and storing it as a digital file. We frequently scan incoming correspondence in order to archive it as part of our digital document management system. The specific processing of personal data contained in our correspondence depends on the subject matter of the communication and the applicable statutory retention requirements. Where appropriate, we may also add your contact details to our contact directory for future communication.

Categories of Data: Name and postal address, Personal data contained in the correspondence, such as additional contact details included in your letterhead, enquiries, orders, quotations, complaints, or other matters raised in your correspondence.

Recipients (including third-country transfers, where applicable): Postal service providers. Personal data is transferred to third countries only where correspondence is sent to an address outside the European Economic Area (EEA). In such cases, data protection is safeguarded through international agreements governing postal confidentiality.

Purpose and Legal Basis: To communicate with you by post. Depending on the subject matter of the correspondence, the legal basis is either the implementation or performance of a contract or our legitimate interest in corresponding with you.

Retention Period: The retention period depends on the content of the correspondence. As a general rule, business correspondence must be retained for six years in accordance with the German Commercial Code (HGB).

6.7.4. Video Conferences

Description: Where we organise video conferences, these are conducted using external service providers that act as telecommunications providers and are therefore subject to the data protection requirements of the German Telecommunications Digital Services Data Protection Act (TDDDG). We primarily use Microsoft as our video conferencing provider and Microsoft Teams as the corresponding application.

The scope of the data processing depends on the features of the conferencing tool that you choose to use. You may participate with or without video and audio, with or without a profile picture, background image, raised hand, or chat activity. In some cases, you may also choose your own display name.

Access to your camera and microphone is only granted with your explicit permission.

Before any meeting is recorded, all participants are asked for their consent or, where appropriate, their agreement through inactivity. If a recording is made, the meeting may also be transcribed automatically or manually.

Please note that every participant is technically able to create screenshots or recordings, in whole or in part, using means outside the conferencing platform. Making such recordings without the consent of all participants constitutes a breach of data protection obligations by the individual concerned and, where that individual is not one of our employees, falls outside our responsibility. Secretly recording spoken conversations may constitute a criminal offence under Section 201 of the German Criminal Code (StGB). We reserve the right to take legal action against any person who uses their participation in a video conference in a manner that infringes data protection rights.

Further information about Microsoft's processing of personal data is available at:
https://privacy.microsoft.com/en-gb/privacystatement

Categories of Data: Username, Email address, Participation times, Video and audio streams, Video and audio recordings (only with your consent), Audio transcripts (only where a recording has been made), Chat messages and hand-raising status, Profile information (profile picture, contact details, background image), Telephone number (where joining by telephone), Log data (IP address, device identifiers, activity history).

Recipients (including third-country transfers, where applicable): Providers of video conferencing systems that are subject to the German Telecommunications Digital Services Data Protection Act (TDDDG). Where these providers transfer personal data to third countries, they ensure an equivalent level of data protection by entering into the European Commission's Standard Contractual Clauses.

Our primary provider is Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft processes personal data on our behalf under a Data Processing Agreement. Where Microsoft Ireland transfers personal data to Microsoft Corporation in the United States or to other Microsoft group companies, Microsoft ensures an equivalent level of data protection through the European Commission's Standard Contractual Clauses.

Purpose and Legal Basis: To enable participation in video conferences. The legal basis for the processing is our legitimate interest, as video conferencing cannot function without a minimum level of personal data processing. Where meetings are recorded, the legal basis is your consent.

Retention Period: Where no recording is made, all personal data is deleted once the video conference has ended. If a recording is made, it will be deleted as soon as the purpose for which it was created has been fulfilled.

6.7.5. Collaboration – Digital Collaboration (Teams)

Description: We use Microsoft Teams as our digital collaboration platform. Teams allows us to create dedicated channels for individual groups or projects. Within these channels, users can communicate via text, store files, collaborate on Microsoft Office documents, add comments, and make notes. The core functionality of Teams can also be extended through additional applications and widgets, for example to enable shared task planning and task assignment.

To collaborate using Microsoft Teams, the Teams application must be installed on your mobile device or desktop/laptop computer. Responsibility for downloading and installing the Teams application lies with Microsoft, not with us. By downloading the Teams application, you establish a separate legal relationship directly with Microsoft.

A Microsoft 365 account is not required to use Microsoft Teams. You may participate as a guest without registering with Microsoft. If you do use a Microsoft 365 account, responsibility for that account rests with you or with the organisation that has provided it to you. Through your Microsoft 365 account, you may manage your profile, including your profile picture and additional contact details.

Communication between your device and the Microsoft Teams servers requires Microsoft to process the IP address from which you access Teams. In addition, Microsoft's servers process the types of technical data that are routinely generated when using digital services.

Further information about Microsoft's processing of personal data is available at:
https://privacy.microsoft.com/en-gb/privacystatement

Categories of Data: Username, Posts and messages published in Teams channels, Files stored, edited, or shared within Microsoft Teams, Profile information (profile picture, contact details), Additional data, such as your IP address and email address, is processed by Microsoft under its own responsibility.

Recipients (including third-country transfers, where applicable): Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft processes personal data on our behalf under a Data Processing Agreement. Where Microsoft Ireland transfers personal data to Microsoft Corporation in the United States or to other Microsoft group companies, Microsoft ensures an equivalent level of data protection through the European Commission's Standard Contractual Clauses.

Purpose and Legal Basis: To provide a digital collaboration platform. Depending on the nature of the collaboration, the legal basis is either the implementation or performance of a contract or our legitimate interest in communicating and collaborating with you efficiently.

Retention Period: Individual Teams channels and the files stored within them are deleted once the purpose for which they were created or stored has been fulfilled. If your Microsoft 365 account is deleted, your name associated with posts or file metadata within Teams will be replaced with "Unknown".

6.7.6. CCTV Surveillance

Description: CCTV cameras are installed within our business premises because we develop and test customer applications that rely on video surveillance technology. The cameras continuously record the areas within their field of view, 24 hours a day.

Categories of Data: CCTV recordings

Recipients (including third-country transfers, where applicable): None.

Purpose and Legal Basis: The CCTV system is used to prevent and investigate threats to the health and safety of our employees, as well as offences against the property of our organisation and our employees. It also serves to prevent unauthorised access to areas of our premises that require a particularly high level of security and, where unauthorised access occurs, to assist in investigating the incident. The legal basis for this processing is our legitimate interest, which arises from the specific security risks and heightened security requirements applicable to our organisation.

Retention Period: CCTV recordings are automatically deleted from our servers after 72 hours.

6.7.7. Financial Accounting

Description:
All payments are recorded in our financial accounting system. This includes documenting the identity of the payer or payee. Where the payer or payee is a legal entity, this may also include the names and contact details of the relevant contact persons.

In some cases, the payment reference may also reveal information about an individual or their activities, for example in connection with salary or fee payments, travel bookings, or expense reimbursements.

We use a cloud-based accounting system for our financial accounting.

Categories of Data: Name, Customer or supplier number, Bank account details or credit card information, Payment reference, Travel information (date, destination, accommodation, means of transport, costs), Business entertainment records (date, location/venue, attendees, purpose of the hospitality, costs), Information relating to other expenses (purchases, gifts).

Recipients (including third-country transfers, where applicable): Our tax adviser, who provides financial accounting services and is legally bound by professional confidentiality obligations. No transfers to third countries take place.

Purpose and Legal Basis: To manage and record all financial transactions. The legal basis for this processing is the performance of a contract and compliance with our legal obligations under tax and commercial law.

Retention Period: We retain financial accounting records for 10 years in accordance with statutory tax law requirements.

6.7.8. Payment Transactions

Description:
Payments made through our bank accounts or by credit card are recorded in our bank statements accordingly.

Categories of Data: Name, Bank account details, Date of payment, Payment amount, Payment reference (transaction description).

Recipients (including third-country transfers, where applicable): Our banking institutions, which are legally bound to maintain confidentiality under banking secrecy obligations and banking supervisory legislation. No transfers to third countries take place.

Purpose and Legal Basis: To facilitate cashless payment transactions. The legal basis for this processing is the performance of a contract.

Retention Period: We retain bank statements for 10 years in accordance with statutory tax law requirements.

6.7.9. IT Administration

Description: From time to time, we engage external service providers to administer, maintain, and support our information technology systems. These service providers do not process the personal data held by us for their own purposes. However, when maintaining databases or other IT systems, they may incidentally gain access to personal data. All such service providers are contractually bound to maintain confidentiality, with obligations appropriate to the sensitivity of the data to which they may have access.

Categories of Data: Any category of personal data.

Recipients (including third-country transfers, where applicable): IT service providers that are bound by a Data Processing Agreement or another appropriate confidentiality agreement ensuring compliance with applicable data protection requirements. No transfers to third countries take place.

Purpose and Legal Basis: To make use of qualified service providers for the professional administration and maintenance of our IT systems. The legal basis for this processing is our legitimate interest, as all service providers are subject to appropriate contractual confidentiality obligations.

Retention Period: No personal data is stored independently for this purpose.

6.7.10. File Storage

Description: In addition to storing personal data within the individual databases described above, we also store documents on our storage systems. These typically include Microsoft Office documents (Word, Excel, PowerPoint), PDF files, images, videos, layouts, and other text, spreadsheet, and presentation file formats, as well as any other file type required for our business operations.

The data protection requirements applicable to the content of these files depend on the respective processing purpose. Independently of the file content, the storage of files and their associated metadata (primarily information identifying the file creator) constitutes a separate processing activity. In particular, Microsoft Office documents contain personal metadata where multiple users collaborate on a document using comments, notes, or track changes.

We use Microsoft 365 as our cloud-based file storage solution (including Microsoft Teams, SharePoint, and OneDrive). Microsoft 365 includes Microsoft Graph, an automated analysis service that processes the metadata of stored files in order to improve their searchability and retrieval.

Further information about Microsoft's processing of personal data is available at:
https://privacy.microsoft.com/en-gb/privacystatement

Categories of Data: Any category of personal data, with a particular focus on file metadata, including: File creator identification, Identifiers of users who edit files (including comments and notes), Date and time of file creation, modification, and storage.

Recipients (including third-country transfers, where applicable): Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft processes personal data on our behalf under a Data Processing Agreement. Where Microsoft Ireland transfers personal data to Microsoft Corporation in the United States or to other Microsoft group companies, Microsoft ensures an equivalent level of data protection through the European Commission's Standard Contractual Clauses.

Purpose and Legal Basis: To store files securely in a high-performance data centre and to make use of modern search and indexing capabilities. The legal basis for this processing is our legitimate interest, as the processing is carried out by a processor acting on our behalf.

Retention Period: The retention period depends on the retention period applicable to the individual file.

6.7.11. Disposal of Data Storage Media and Documents

Description: The deletion and destruction of personal data also constitute forms of data processing. Paper documents containing personal data requiring protection are either shredded on our premises or disposed of securely through locked disposal containers provided by a professional document destruction service. The security level of the shredding process and the document destruction services used is appropriate to the risk and confidentiality classification of the documents concerned.

Storage media (such as hard drives from servers or computers, smartphones, tablets, USB drives, and memory cards) that have previously contained personal data requiring protection are securely erased by our IT administration using multiple overwriting procedures (at least three complete overwrites) when they are no longer required for storing such data. Alternatively, they are handed over to a professional storage media destruction service. The level of erasure or physical destruction applied is appropriate to the risk and confidentiality classification of the data previously stored on the medium.

Categories of Data: Any category of personal data.

Recipients (including third-country transfers, where applicable): Professional providers of document and data storage media destruction services that are contractually bound by Data Processing Agreements to comply with applicable data protection requirements. No transfers to third countries take place.

Purpose and Legal Basis: To ensure the secure deletion and destruction of personal data in a manner appropriate to the associated risks. The legal basis for this processing is compliance with our legal obligations under the GDPR, in particular the requirements relating to data minimisation and the deletion of personal data.

Retention Period: No personal data is retained beyond its deletion or destruction.

6.7.12. Legal Proceedings

Description: In the event of a legal dispute between you and us, we may disclose personal data relating to you and the circumstances of the dispute to legal advisers and, where necessary, to public authorities or courts.

Categories of Data: Name, Contact details, Information relating to the subject matter of the dispute.

Recipients (including third-country transfers, where applicable): Legal advisers, public authorities, courts, and enforcement officers. All recipients are either public authorities or professionals who are legally bound by statutory duties of confidentiality. No transfers to third countries take place.

Purpose and Legal Basis: To establish, exercise, or defend legal claims. The legal basis for this processing is our legitimate interest in obtaining legal advice and, where necessary, asserting or defending our rights before legal advisers, public authorities, or courts.

Retention Period: The recipients listed above process your personal data in accordance with their own legal obligations and only to the extent necessary for the performance of their respective duties.

We retain personal data relating to legal disputes until the proceedings have been finally concluded, including the expiry of all applicable limitation periods and deadlines for appeals or objections. Where there is a possibility of similar disputes arising with you or other individuals in the future, we may retain the documents essential to the proceedings for a longer period, where appropriate in anonymised form.

6.7.13. Data Protection Management

Description: Where you exercise your rights under data protection legislation, we document the related correspondence and the associated processes within our data protection management system.

Categories of Data: Name, Contact details, Information relating to your data protection request.

Recipients (including third-country transfers, where applicable): Our Data Protection Officer, who is legally bound by confidentiality obligations, is located within the European Economic Area (EEA). Our provider of the cloud-based data protection management system, which processes personal data on our behalf under a Data Processing Agreement, is also located within the EEA. No transfers to third countries take place.

Purpose and Legal Basis: To manage and document data protection requests and compliance activities. The legal basis for this processing is our legal obligation under the GDPR, in particular the accountability principle.

Retention Period: We retain personal data relating to legal disputes until the proceedings have been finally concluded, including the expiry of all applicable limitation periods and deadlines for appeals or objections. Where there is a possibility of similar disputes arising with you or other individuals in the future, we may retain the documents essential to the proceedings for a longer period, where appropriate in anonymised form.