PRIVACY

Controller

The party responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is:

BKP Compliant GmbH
Heilig-Geist-Gasse 398
D-84028 Landshut

Link to Legal Notice: https://www.bkp-compliant.com/impressum

Data Protection Officer

You can reach our Data Protection Officer at:

Bugl & Kollegen Gesellschaft für Datenschutz und Informationssicherheit mbH
Alexander Bugl
Eifelstraße 55
93057 Regensburg
Germany

Email: kontakt@buglundkollegen.de

As a data subject, you have the following rights under the EU General Data Protection Regulation (GDPR):

Right of access (Art. 15 GDPR)

You have the right to request information about which of your personal data is stored, the purpose for which it is processed, which recipients received it or to whom it is disclosed, and how long it is stored.

Right to rectification (Art. 16 GDPR)

You may request the immediate rectification of inaccurate or the completion of incomplete personal data.

Right to erasure (‘right to be forgotten’) (Art. 17 GDPR)

Under certain conditions, you can request the erasure of your personal data, e.g., if it is no longer necessary for the purposes for which it was collected or if you have withdrawn your consent.

Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of the processing of your personal data, for example, if you contest the accuracy of the data or if the processing is unlawful, but you request restriction instead of erasure.

Right to data portability (Art. 20 GDPR)

You may request that the personal data concerning you, which you have provided to us, be transmitted to you in a structured, commonly used, and machine-readable format—or that we transfer this data directly to another controller.

Right to object (Art. 21 GDPR)

You have the right to object at any time to the processing of your personal data, provided that the processing is based on the legitimate interests of our company or on a task carried out in the public interest. In the event of a justified objection, we will cease processing unless there are compelling legitimate grounds for the processing.

Withdrawal of consent (Art. 7 GDPR)

If you have given us your consent, you can withdraw it at any time for the future without giving reasons.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

Hosting and Server Log Files

The servers for our website are operated by the provider Amazon Web Services USA. We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR. The legal basis for the use of external hosting is the fulfillment of a contract with our potential and existing customers pursuant to Art. 6(1)(b) GDPR, as well as our legitimate interest in the secure and high-performance provision of our website pursuant to Art. 6(1)(f) GDPR.

Every time our website is accessed, our system’s web server collects information from the device used. The following data is collected by us:

  • Information about the browser type
  • Operating system of the user’s device
  • Date and time of access
  • The previous website from which the user reached our websites (referrer)

We only collect IP addresses in anonymized form; therefore, we do not store any personal data in our log files within the meaning of the GDPR.

decareto Privacy Widget

We use the “decareto Privacy Widget” service on our website to create and manage our privacy notices. The provider is decareto GmbH, Mittelweg 144, 20148 Hamburg, Germany (“decareto”). As part of the service provision, decareto uses the content delivery network bunny.net from the sub-processor BunnyWay d.o.o. (Slovenia) to deliver content reliably and quickly.

The legal basis for the use of the decareto Privacy Widget is the fulfillment of a legal obligation pursuant to Art. 6(1)(c) GDPR.

The legal basis for the use of bunny.net is decareto’s legitimate interest in the error-free delivery of the privacy notices. The data processed by decareto Privacy Widget and bunny.net includes your IP address and browser information. The services do not set cookies. Data is not stored in log files.

The purpose of the data processing is the reliable provision of our privacy notices.

Further information on the privacy policy of decareto Privacy Widget can be found at: https://decareto.com/privacy/

Contacting Us

You have the option to contact us by email, telephone, contact form, or letter, which may involve the processing of personal data. We process your data to handle and process your inquiry. We will not pass on your data to third parties without your consent.

The legal basis for the processing is our legitimate interest in the effective handling of your inquiry pursuant to Art. 6(1)(f) GDPR.

When contacting us by email, we store your email address and the information contained in the email. In the case of the contact form, your IP address is also recorded in pseudonymized form in addition to the information in the contact form. In the case of contact by letter, your sender address and the content of the letter are stored. When contacting us by telephone, we collect personal data depending on the individual case.

We store your data until you request us to delete it or the purpose of processing (handling your inquiry) has been fulfilled.

Social Media Profiles

We maintain online profiles on the following social networks (hereinafter “Social Media”) to communicate with customers, interested parties, and the public, and to draw attention to our services:

  • Instagram (Meta Platforms, Inc.)
  • Facebook (Meta Platforms, Inc.)
  • X (formerly Twitter; X Corp.)
  • LinkedIn (LinkedIn Ireland Unlimited Company)
  • Xing (New Work SE)

For the scope and purpose of data processing, we refer to the respective applicable privacy policies of the networks:

  • Instagram: (https://privacycenter.instagram.com/policy)
  • Facebook: (https://www.facebook.com/privacy/policy/?entry_point=facebook_page_footer)
  • X (Twitter): (https://x.com/en/privacy)
  • LinkedIn: (https://www.linkedin.com/legal/privacy-policy?)
  • Xing: (https://privacy.xing.com/en/privacy-policy)

Processing is carried out on the basis of Art. 6(1)(f) GDPR, as we have a legitimate interest in modern public relations. If consent is required, processing is carried out on the basis of Art. 6(1)(a) GDPR.

If you transmit additional data to the services (e.g., personal messages), your consent is generally required for this. Please note that we have no influence on the data processing by social media providers. For questions or to exercise your data subject rights (e.g., access, erasure), please contact the respective platform operator directly.

You can subscribe to or unsubscribe from our social media profiles at any time. If you do not want social media service operators to collect data about your visit to our profiles, please use the deactivation options (e.g., logging out, ad tracker blocking) in your user account or install appropriate browser add-ons.

Applications

If you apply for a job with us, your personal data will be processed. The legal basis for the processing is Art. 6(1)(b) GDPR in connection with the implementation of pre-contractual measures. Should your data be required for the defense of legal claims after the application process has been completed, the processing is based on our legitimate interest in an obligation to provide evidence pursuant to Art. 6(1)(f) GDPR, for example in connection with the General Equal Treatment Act.

We process the data that you have transmitted to us as part of your application and that we need to check your suitability for the position concerned.

The purposes of the processing are the management of your application, assessment of your suitability for the open position, and contacting you in connection with your application or with possible alternative positions.

We delete your data after six months. If you have agreed to be included in the applicant pool, we will delete it after two years. If your application leads to employment, we will store your data for the duration of your employment with us.