Privacy Policy of Exactag GmbH

 

1. Information about the Collection of Personal Data and the Controller

In this privacy policy, we, Exactag GmbH, would like to inform you how we process personal data. We are aware how important the processing of personal data is for the user and therefore fully comply with applicable law. The protection of your privacy is of outmost importance for us. For this reason, compliance with the legal requirements on data privacy is, for us, a matter of course. Personal data according to the GDPR refers to any information about personal or factual circumstances of an identified or identifiable person. This includes information and details such as your name, home address or other postal address, telephone number and also your email address.

 

The Contact and Controller according to the GDPR is:
Exactag GmbH
Wanheimer St. 68
40468 Düsseldorf
Germany
privacy@exactag.com

 

The Controller as defined in the GDPR is the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data.

 

2. Data Protection Officer

You may contact our data protection officer, legal counsel Ms. Verena Limbacher, under privacy@exactag.com

 

3. Which Personal Data does Exactag collect during a Visit of its Website?

 

3.1 Log Files

a. Purposes and Means of the Data Processing

Every time you access our website(s), usage data are transferred through your specific web browser and stored in the form of protocol files (known as server log files). The datasets stored in this way contain the following data:

 

  • The domain from which the user is accessing the website
  • Date and time of access
  • IP address of the accessing computer
  • Website(s) which the user is visiting in the context of the offering
  • Amount of data transferred; browser type and version
  • Operating system used; name of internet service provider
  • Indication of whether access was successful

 

These logfile datasets are analysed to identify and resolve errors, and to control server workloads. We do not analyse the abovementioned personal data for any other purposes in this context.

 

b. Legal Basis of the Data Processing

Legal basis for the processing of personal data in relation to the provision of our website(s) and the creation of log files are our legitimate interests – Art. 6(1)(1) lit. f) of the GDPR.

 

c. Retention Period

Your personal data will be deleted within 30 days upon collection.

 

d. Right to Object/Remove

The collection of your personal data is for the provision of the website(s) and the storage of your personal data in log files is strictly necessary for the operation of the website(s). Therefore, there is no right to object.

 

3.2 Cookies

a. Purposes and Means of the Data Processing

Cookies are small files that your browser stores on your PC in a directory designated specifically for this purpose. These cookies can be used e.g. to find out whether you have already visited a website. There are session cookies and persistent cookies:

 

  • Session cookies will be immediately deleted in the moment your browser is closed.
  • Persistent cookies remain on your device (the retention period differs depending on the specific cookie) and allow us or our partners (partner cookies) to reidentify your browser during your next visit.

 

The purpose of some cookies is to simplify the use of the website(s) – so called necessary cookies. Some features of our website(s) do not work without such necessary cookies. The user data collected through such necessary cookies are not use to create user profiles.

 

Other cookies, e.g. our partner cookies, are intended to render our service more attractive to you. If we work together with such partners, we will inform you about the use of such partner cookies and the extent of the information collected in the following paragraph in more detail.

 

b. Legal Basis of the Data Processing

Insofar as cookies implemented by us also process personal data, such data processing is subject to your consent in accordance with Art. 6(1)(1) lit. a) of the GDPR.

 

c. Retention Period

Your personal data will be deleted if they are not necessary any more to fulfil the purpose of their collection, in particular if the cookies are deactivated. As set out above, session cookies will be immediately deleted in the moment your browser is closed.

 

d. Right to Object/Remove

Most of the browsers accept cookies automatically. You may set your browser in a way that no cookies are store or need prior explicit consent before storage. In addition, you may delete cookies that have been set at any time

 

You may find your respective browser settings under the following links:

 

Internet Explorer: https://support.microsoft.com/de-de/microsoft-edge/cookies-in-microsoft-edge-löschen-63947406-40ac-c3b8-57b9-2a946a29ae09

Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen

Chrome: https://support.google.com/chrome/answer/95647?hl=de&hlrm=en

Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac

Opera: https://help.opera.com/en/latest/web-preferences/#cookies

 

Another possibility to deactivate cookies in relation of usage-based adverting offers the preference manager of the BVDW, www.meine-cookies.org/cookies_verwalten/praeferenzmanager-beta.html, as well as the preference  management of YourOnlineChoices, www.youronlinechoices.com/de/praferenzmanagement/

 

Please note that the deactivation of cookies might restrict the use of our website(s).

 

3.3 CMP (Cookiebot)

a. Purposes and Means of the Data Processing

We use the services of the CMP Cookiebot, provided by Cybot A/S, Havnegade 39, 1058 Copenhague, Denmark (Cybot). This allows us to collect and manage consent of the website user. The following data will be processed using cookies:

 

  • Your IP address (the last 3 digits will be set to ‚0’)
  • Date and Time of your consent
  • Browser information
  • URL, from which the consent has been sent
  • An anonymous, random and encrypted key of the consent status of the end user as proof of the consent

 

The key and the consent status will be stored for 12 month in the browser using the cookie “CookieConsent“. This allows to keep your cookie preference for ensuing a page requests. Proof of your consent can be shown using the key.

 

If you activate the service function “Collective Consent”, to activate consent for several websites with only one end user consent, the service will additionally store a separate, random, unique ID with your consent. If all criteria are fulfilled, the key will be stored in the third party cookie „CookieConsentBulkTicket“ in your browser in encrypted form:

 

  • You activate the Collective Consent function as service configuration.
  • You allow third party cookies in your browser settings.
  • You have deactivated “Do not follow” in your browser settings.
  • You accept all or at least some defined types of cookies, when you give your consent.

 

b. Legal Basis of the Data Processing

The processing is necessary to fulfil a legal obligation (Art. 7(1) of the GDPR), that we have to comply with (Art. 6(1)(1) lit. c) of the GDPR).

 

c. Retention Period

Your personal data will be continuously deleted after 12 month or immediately after termination of the agreement between us and Cybot.

 

d. Right to Object/Remove

You can object at any time to the collection, processing and storage by Cybot or remove it. You may find further information about the possibility to object or remove under: https://www.cookiebot.com/de/privacy-policy/.

 

Please note that we cannot ensure the functionality of our website(s) without the processing by Cookiebot.

 

3.4 Contact with the user, Marketing (HubSpot)

a. Purposes and Means of the Data Processing

We use the HubSpot in relation to our contact form and to distribute marketing materials and company information (e.g. our newsletter). We process the following data provided by you for these purposes:

 

  • Distribution of marketing materials and company information: mail address
  • Contacting you (and eventual distribution of marketing materials and company information): First name and surname, email address, employer, job title

 

HubSpot is a software company from the US with a branch office in Ireland (HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland). You’ll find more information about the cookies used by HubSpot here: https://knowledge.hubspot.com/de/reports/what-cookies-does-hubspot-set-in-a-visitor-s-browser as well as https://knowledge.hubspot.com/de/account/hubspot-cookie-security-and-privacy.

 

b. Legal Basis of the Data Processing

The legal basis for the processing is your consent according to Art. 6(1)(1) lit. a) of the GDPR.

 

c. Retention Period

Subject to any mandatory legal retention periods, your personal data will be deleted, if they are not necessary any more to fulfil the purpose of their collection, at the latest upon termination of our business relationship with HubSpot.

 

d. Right to Object/Remove

You can object at any time to the collection, processing and storage by HubSpot or remove it. You may find further information about the possibility to object or remove under: https://legal.hubspot.com/de/privacy-policy.

 

e. Processing and Transfer of the Data to a Third Country

We have executed a data processing agreement with HubSpot to comply with applicable law. Data processing may take place outside the EU/EEA. A transfer of personal data to the US is made on this basis of the standard contractual clauses.

  

 

3.5 Usage of Your Data for Web Analysis and Tracking (Google Analytics)

We use – as almost all website owners – tracking software as analysis tools, to determine the frequency of usage and the number of users on our website(s).

 

a. Purposes and Means of the Data Processing

To optimise our website(s) and our offer, we use Google Analytics, a web analytics service provided by Google Ireland Limited, a company registered in Ireland (Register-No.: 368047) having its seat in Gordon House, Barrow Street, Dublin 4, Ireland („Google“). Google Analytics use so called „Cookies“, files that are stored on your PC and allow an analysis of the usage of our website(s) by you. The information about the usage of our website(s) created by the cookie (including your IP address) are transferred to a server of Google located in the US and are stored there. In the event IP anonymisation is activated on the website(s), your IP address will be truncated by Google in the member states of the EU/EEA before transfer. Only in exceptional cases will the entire IP address be transferred by Google to a server in the US and will only be truncated there.

On behalf of the operator of this website, Google will use such information to evaluate your use of the website(s), to compile reports on the website activities for the website operators and to provide services related to the usage of the website and the internet to the website operator. The IP address transferred from your browser as part of the Google Analytics service will not be mingled with other data of.

 

b. Legal Basis of the Data Processing

The legal basis for the processing is your consent according to Art. 6(1)(1) lit. a) of the GDPR.

 

c. Retention Period

Your personal data will be deleted, if they are not necessary any more to fulfil the purpose of their collection or if you have revoked your consent.

 

d. Right to Object/Remove

You can prevent the storage of cookies by changing the settings in your browser accordingly; in this case, please note that you may not use all functionalities of the website(s). In addition, you may prevent the collection of the data by the cookie relating to your usage of the website(s) (including your IP address) as well as the processing of such data by Google by downloading and installing the browser plugin available under the following link tools.google.com/dlpage/gaoptout?hl=de. As an alternative to the browser add-on or as part of browsers on mobile devices, please click this link to prevent the detection by Google Analytics on this website(s) in the future (the opt-out only works in this browser and only for this domain). An opt-out cookie will thereby by implemented on your device. If you delete your cookies in this browser, you need to click on the link again. You may find further information related hereto under tools.google.com/dlpage/gaoptout?hl=de as well as under www.google.com/intl/de/analytics/privacyoverview.html (general information about Google Analytics and data protection).

 

Please note that Google Analytics has been extended with the code „gat._anonymizeIp();“ on the website(s) to ensure an anonymised detection of IP addresses (so called IP masking).

 

e. Processing and Transfer of the Data to a Third Country

We have executed a data processing agreement with HubSpot to comply with applicable law. Data processing may take place outside the EU/EEA. A transfer of personal data to the US is made on this basis of the standard contractual clauses.

 

3.6 Usage of your Data for usage-related Advertising (Google Ads)

We have allowed Google to collect usage data through Google Ads (f/k/a Google Adwords), to optimise advertising according to your usage interests.

 

a. Purposes and Means of the Data Processing

We use Google Ads Conversion to draw attention to our attractive offers on external websites with the help of advertising materials (so called Google Ads). In relation to the data of the advertising campaigns, we can evaluate how successful the advertising is in order to show your advertisements that (1) are of interest to you, (2) allow us to model our website(s) so that they of greater interest to you, and (3) to achieve a fair calculation of advertising costs.

 

Such advertising materials will be delivered by Google via so called „Ad Server“. We use Ad Server cookies in this regard, that allow you to measure defined parameters to measure success such as the display of advertisements or clicks. If you are directed by a Goole advertisement to our website(s), Google Ads will store a cookie in your device. Such cookie usually stores the Unique Cookie-ID, number of Ad Impressions per Placement (Frequency), last Impression (relevant for Post-View-Conversions) as well as Opt-out information as analysis parameters.

 

Such cookies allow Google to reidentify your internet browser. We do not collect and process personal data during such advertising. We only receive statistical reports from Google. These reports allow us to assess the efficiency of the advertising. We do not receive any additional data regarding the placement of advertising materials and we are not able to identify the user with the help of the reports.

Your browser will automatically set up a direct connection with the Google server through the used marketing tools. We do not have control over the extent and the further use of the data that are collected by Google via this tool and inform you according to our current knowledge: Through the implementation of Ads Conversion Google receives the information, that (1) you have visited the respective part of our internet presence, or (2) that you clicked on one of our advertisements. If you have registered with a service of Google, Google may assign your visit to your account. Even if you are not registered with Google or you did not log in, Google might get to know your IP address and eventually store it.

We use the remarketing functionality within the Google Ads service. We can display advertisements to visitors of our website(s) on other websites within the Goole advertising network (in the Google Search or on YouTube, sog called „Google Ads“ or on other websites) based on their interests. We analyse the interaction of the user on our website(s) for this purpose, e.g. the offer a user was interested in, to be able to display to users targeted advertising after the have visited our website(s). Google stores cookies on the device of users for such purpose, that visit defined Google services or websites in the Google display network. Such cookies are used to register the visits of such use. The purpose of such cookies is the unambiguous identification of a web browser on a defined device and not the identification of an individual.

 

b. Legal Basis of the Data Processing

The legal basis for the processing is your consent according to Art. 6(1)(1) lit. a) of the GDPR.

 

c. Retention Period

Your personal data will be deleted at the latest after 180 days or if you have revoked your consent.

 

d. Right to Object/Remove

You can deactivate this Google tool through you cookie settings https://myactivity.google.com/product/search/controls.

 

3.7 Recruiting (Personio)

a. Purposes and Means of the Data Processing

If you apply to us electronically, i.e. via e-mail or using our online form, we will collect and process your personal data for the purpose of executing the application process and preparing contracts.

 

By submitting an application via our recruitment website, you express your interest in taking up work with us. In this context, you transmit personal data, which we will use and store exclusively for the purpose of your job search / application process. In particular, the following data is collected during this process:

 

  • Name (first and last names)
  • Email address
  • Phone number
  • LinkedIn profile (optional)
  • Channel through which you found us

 

Furthermore, you can choose to upload expressive documents such as a cover letter, your CV and reference letters. These may contain additional personal data such as date of birth, address etc.

 

Only authorized HR staff and/or staff involved in the application process have access to your data.

 

b. Legal Basis of the Data Processing

The legal basis for the processing is your consent according to Art. 6(1)(1) lit. a) of the GDPR.

 c. Retention Period

Your data will be stored for a period of 90 days after the application process has been concluded. This is usually done to fulfill legal requirements and/or defending ourselves against any claims arising from legal provisions. After this period, we are obligated to delete or anonymize your data. In case of anonymization, the data will only be available to us in the form of so-called metadata, without any direct personal reference, for statistical analysis (for example, share of male and/or female applicants, number of applications per specified period of time etc.).

 

Should you be offered and accept a position with us during the application process, we will store the personal data collected as part of the application process for at least the duration of your employment. You may find more details in this regard in our privacy policy for employees.

 

d. Right to Object/Remove

You can terminate the processing of your personal data in relation to the recruiting at any time by objecting to such processing. You may find further information related thereto in Section 4 of this privacy policy.

 

Your Rights, Contact Info, Amendments to the Privacy Policy

a. Rights of the Data Subject

Right to access, rectification, right to object, to complaint, erasure and blockage.

  • You have the right to request information about whether and which personal data is processed by our company. You also have the right to demand that your personal data is rectified or amended.
  • Under certain circumstances, you have the right to request that your personal data should be deleted.
  • Under certain circumstances, you have the right to demand that the processing of your personal data should be restricted.
  • You can withdraw your consent to the processing and use of your data completely or partially at any time with future effect.
  • You have the right to obtain your personal data in a common, structured and mechanically readable format.
  • If you have any questions, comments, complaints or requests in connection with our statement on data protection and the processing of your personal data, you can also contact our data protection officer in detail.

 

RIGHT TO COMPLAIN: You also have the right to complain to the responsible supervisory authority if you believe that the processing of your personal data is in violation of the legislation.

 

b. Contact

You may contact us under: privacy@exactag.com

 

c. Your notices to respond to your inquiries in relation to data protection

We will disclose information we store in relation to you upon request. To access, update or delete information about you, please contact us as set out above and inform us about the respective offer company). We will react to your inquiry without undue delay.

 

d. Necessity of Obligation to provide Data

Insofar as not explicitly set out upon collection, providing data is not necessary or mandatory.

 

e. Amendments to this Privacy Policy

We reserve the right to amend this privacy policy at any time with immediate effect.

 

4. Appendix

List of client sites on which our software solution is used

  • at.bahn.de
  • at.bahn.com
  • m.floraprima.de
  • xtg.lampenwelt.de
  • xtg.luminaire.fr
  • xtg.lights.co.uk
  • tr.yfood.eu

 

Date of this Privacy Policy

15 September 2022