Privacy Policy of Exactag GmbH

 

1. Information about the Collection of Personal Data and the contact data of the Controller

In this privacy policy, we, Exactag GmbH, would like to inform you how we process personal data. We are aware how important the processing of personal data is for the user and therefore fully comply with applicable law. The protection of your privacy is of utmost importance to us. For this reason, compliance with the legal requirements on data privacy is, for us, a matter of course. Personal data, according to the GDPR, refers to any information about personal or factual circumstances of an identified or identifiable person. This includes information and details such as your name, home address or other postal address, telephone number and also your email address.

The Contact and Controller according to the GDPR is:

Exactag GmbH
Wanheimer St. 68
40468 Düsseldorf
Germany
privacy@exactag.com

The Controller, as defined in the GDPR, is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

 

2. Data Protection Officer

You may contact our data protection officer, legal counsel Ms Verena Limbacher, at privacy@exactag.com

 

3. Which Personal Data do we collect during a visit to our Website(s)?

 

3.1. Log Files

 a. Purposes and Means of the Data Processing

Every time you access our website(s), usage data is transferred through your specific web browser and stored in the form of protocol files (known as server log files). The datasets stored in this way contain the following data:

• The domain from which the user is accessing the website
• Date and time of access
• IP address of the accessing computer
• Website(s) which the user is visiting in the context of the offering
• Amount of data transferred, browser type and version
• Operating system used, name of the internet service provider
• Indication of whether access was successful

These logfile datasets are analyzed to identify and resolve errors, and to control server workloads. We do not analyze your personal data for any other purposes in this context.

b. Legal Basis of the Data Processing

Legal basis for the processing of your personal data in relation to the provision of our website(s) and the creation of log files are our legitimate interests – Art. 6(1)(1) lit. f) of the GDPR.

c. Retention Period

Your personal data will be deleted within 30 days of collection.

d. Right to Object/Remove

The collection of your personal data for the provision of the website(s) and the storage of your personal data in log files is strictly necessary for the operation of the website(s). Therefore, there is no right to object.

 

3.2. Cookies

 a. Purposes and Means of the Data Processing

Cookies are small files that your browser stores on your computer in a directory designated specifically for this purpose. These cookies can be used e.g. to find out whether you have already visited a website. There are session cookies and persistent cookies:

• Session cookies will be immediately deleted the moment your browser is closed.
• Persistent cookies remain on your device (the retention period differs depending on the specific cookie) and allow us or our partners (partner cookies) to reidentify your browser during your next visit.

The purpose of some cookies is to simplify the use of the website(s) – so-called necessary cookies. Some features of our website(s) do not work without such necessary cookies. The user data collected through such necessary cookies are not used to create user profiles.

Other cookies, e.g. our partner cookies, are intended to render our service more attractive to you. If we work together with such partners, we will inform you about the use of such partner cookies and the extent of the information collected in the following paragraphs in more detail.

b. Legal Basis of the Data Processing

Insofar as cookies implemented by us also process personal data, such data processing is subject to your consent in accordance with Art. 6(1)(1) lit. a) of the GDPR.

c. Retention Period

Your personal data will be deleted if it is not necessary anymore to fulfil the purpose of their collection, in particular, if the cookies are deactivated. As set out above, session cookies will be immediately deleted the moment your browser is closed.

d. Right to Object/Remove

Most browsers accept cookies automatically. You may set your browser in a way that no cookies are stored or need prior explicit consent before storage. In addition, you may delete cookies that have been set at any time.

You may find your respective browser settings under the following links:

Internet Explorer: https://support.microsoft.com/de-de/microsoft-edge/cookies-in-microsoft-edge-löschen-63947406-40ac-c3b8-57b9-2a946a29ae09

Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen

Chrome: https://support.google.com/chrome/answer/95647?hl=de&hlrm=en

Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac

Opera: https://help.opera.com/en/latest/security-and-privacy/#clearBrowsingData

Another possibility to deactivate cookies in relation to usage-based advertising is offered by the preference manager of the DDOW, https://www.meine-cookies.org/cookies_verwalten/praeferenzmanager-beta.html, as well as by the preference  management of YourOnlineChoices, https://www.youronlinechoices.com/de/praferenzmanagement/

Please note that the deactivation of cookies might restrict the use of our website(s).

 

3.3. CMP (Cookiebot)

 a. Purposes and Means of the Data Processing

We use the services of the CMP Cookiebot, provided by Cybot A/S, Havnegade 39, 1058 Copenhague, Denmark (Cybot). This allows us to collect and manage the consent of the website user. The following data will be processed using cookies:

• Your IP address (the last 3 digits will be set to ‚0’)
• Date and time of the consent
• Browser information
• URL from which the consent has been sent
• An anonymous, random and encrypted key of the consent status of the end user as proof of the consent

The key and the consent status will be stored for 12 months in the browser using the cookie “CookieConsent“. This allows us to keep your cookie preference for ensuing page requests. Proof of your consent can be shown using the key.

If you activate the service function “Collective Consent” to activate consent for several websites with only one end user consent, the service will additionally store a separate, random, unique ID with your consent. If all criteria listed below are fulfilled, the key will be stored in the third-party cookie „CookieConsentBulkTicket“ in your browser in encrypted form:

• You activate the Collective Consent function as a service configuration.
• You allow third-party cookies in your browser settings.
• You have deactivated “Do not follow” in your browser settings.
• You accept all or at least some defined types of cookies when you give your consent.

b. Legal Basis of the Data Processing

The processing is necessary to fulfil a legal obligation (Art. 7(1) of the GDPR) that we have to comply with (Art. 6(1)(1) lit. c) of the GDPR).

c. Retention Period

Your personal data will be continuously deleted after 12 months or immediately after termination of the agreement between us and Cybot.

d. Right to Object/Remove

You can object at any time to the collection, processing and storage by Cybot or remove it. You may find further information about the possibility to object or remove under: https://www.cookiebot.com/de/privacy-policy/.

Please note that we cannot ensure the functionality of our website(s) without the processing by Cookiebot.

 

3.4. Contact with the user, Marketing (HubSpot)

 a. Purposes and Means of the Data Processing

We use the service of HubSpot in relation to our contact form and to distribute marketing materials and company information (e.g. our newsletter). We process the following data provided by you for these purposes:

• Distribution of marketing materials and company information: email address
• Contacting you (and eventual distribution of marketing materials and company information): First name and surname, email address, employer, job title

HubSpot is a software company from the US with a branch office in Ireland (HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland). You’ll find more information about the cookies used by HubSpot here: https://knowledge.hubspot.com/de/reports/what-cookies-does-hubspot-set-in-a-visitor-s-browser as well as https://knowledge.hubspot.com/de/account/hubspot-cookie-security-and-privacy.

b. Legal Basis of the Data Processing

The legal basis for the processing is your consent, according to Art. 6(1)(1) lit. a) of the GDPR.

 

c. Retention Period

Subject to any mandatory legal retention periods, your personal data will be deleted if it is not necessary any more to fulfil the purpose of their collection, at the latest upon termination of our business relationship with HubSpot.

 

d. Right to Object/Remove

You can object at any time to the collection, processing and storage by HubSpot or remove it. You may find further information about the possibility to object or remove under: https://legal.hubspot.com/de/privacy-policy.

 

e. Processing and Transfer of the Data to a Third Country

We have executed a data processing agreement with HubSpot to comply with applicable law. Data processing may take place outside the scope of the application of European law. An eventual transfer of personal data to the US takes place on the basis of the standard contractual clauses.

 

3.5. Lead Gen Forms (LinkedIn)

 a. Purposes and Means of the Data Processing

We use Lead Gen Forms as part of our efforts to acquire new customers. Lead Gen Forms are advertisements in social networks that enable the integration of contact forms in sponsored content. We use the Lead Gen Forms services of LinkedIn (LinkedIn Lead Gen Forms) to be able to address interested parties more precisely. LinkedIn uses forms for lead generation and functions and content of LinkedIn can be integrated. If you are a member of the LinkedIn platform, LinkedIn can assign the accessing of the above-mentioned content and functions to the profiles of the LinkedIn users.

b. Legal Basis of the Data Processing

The legal basis for the processing is your consent, according to Art. 6(1)(1) lit. a) of the GDPR.

c. Retention Period

We store the data you provide to us via Lead Gen Forms until it is no longer required to achieve the purpose for which it was collected. After that, the personal data is deleted unless there are legal retention periods to the contrary.

On LinkedIn, the lead data is automatically deleted after 90 days. For more information on how LinkedIn uses your data, please see LinkedIn’s privacy policy at:

https://www.linkedin.com/legal/privacy-policy.

d. Right to Object/Remove

You have the option at any time to terminate the processing of your personal data in relation to the Lead Gen Forms service by revoking the consent you have given. You can find more information on this under section 4 of this privacy policy. You can also object to or eliminate the collection, processing and storage by LinkedIn at any time by setting an opt-out cookie: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Further information on data protection and Lead Gen Ads from LinkedIn can be found here: https://www.linkedin.com/legal/privacy-policy or https://business.linkedin.com/de-de/marketing-solutions/native-advertising/lead-gen-ads as well as under https://www.linkedin.com/help/linkedin/answer/87150/linkedin-marketing-solutions-und-die-datenschutz-grundverordnung-dsgvo-?lang=en.

e. Processing and Transfer of the Data to a Third Country

We have executed a data processing agreement with LinkedIn to comply with applicable law. Data processing may take place outside the scope of the application of European law. An eventual transfer of personal data to the US takes place on the basis of the standard contractual clauses.

 

3.6. Usage of Your Data for Web Analysis and Tracking (Google Analytics)

We use – as almost all website owners – tracking software as analysis tools to determine the frequency of usage and the number of users on our website(s).

a. Purposes and Means of the Data Processing

To optimise our website(s) and our offer, we use Google Analytics, a web analytics service provided by Google Ireland Limited, a company registered in Ireland (Register-No.: 368047) having its seat in Gordon House, Barrow Street, Dublin 4, Ireland („Google“). Google Analytics uses so-called „Cookies“files that are stored on your PC and allow an analysis of the usage of our website(s) by you. The information about the usage of our website(s) created by the cookie (including your IP address) is transferred to a server of Google located in the US and is stored there. In the event IP anonymisation is activated on the website(s), your IP address will be truncated by Google in the member states of the EU/EEA before transfer. Only in exceptional cases will the entire IP address be transferred by Google to a server in the US and will only be truncated there.

On our behalf, Google will use such information to evaluate your use of the website(s), to compile reports on the website activities for us and to provide services related to the usage of the website and the internet to us. The IP address transferred from your browser as part of the Google Analytics service will not be mingled with other data of Google.

b. Legal Basis of the Data Processing

The legal basis for the processing is your consent, according to Art. 6(1)(1) lit. a) of the GDPR.

c. Retention Period

Your personal data will be deleted as soon as it is not necessary any more to fulfil the purpose of their collection or if you have revoked your consent.

d. Right to Object/Remove

You can prevent the storage of cookies by changing the settings in your browser accordingly; in this case, please note that you may not use all functionalities of the website(s). In addition, you may prevent the collection of the data by the cookie relating to your usage of the website(s) (including your IP address) as well as the processing of such data by Google by downloading and installing the browser plugin available under the following link https://tools.google.com/dlpage/gaoptout?hl=en. As an alternative to the browser add-on or as part of browsers on mobile devices, please click this link to prevent the detection by Google Analytics on this website(s) in the future (the opt-out only works in this browser and only for this domain). An opt-out cookie will thereby be implemented on your device. If you delete your cookies in this browser, you need to click on the link again. You may find further information related hereto under https://tools.google.com/dlpage/gaoptout?hl=en as well as under https://marketingplatform.google.com/intl/de/about/analytics/ (general information about Google Analytics and data protection).

Please note that Google Analytics has been extended with the code „gat._anonymizeIp();“ on the website(s) to ensure an anonymised detection of IP addresses (so-called IP masking).

e. Processing and Transfer of the Data to a Third Country

We have executed a data processing agreement with Google to comply with applicable law. Data processing may take place outside the scope of the application of European law. A transfer of personal data to the US is made on this basis of the standard contractual clauses.

 

3.7. Usage of your Data for usage-related Advertising (Google Ads)

 We have allowed Google to collect usage data through Google Ads (f/k/a Google Adwords) to optimise advertising according to your usage interests.

a.  Purposes and Means of the Data Processing

We use Google Ads Conversion to draw attention to our attractive offers on external websites with the help of advertising materials (so-called Google Ads). In relation to the data of the advertising campaigns, we can evaluate how successful the advertising is in order to show advertisements that (1) are of interest to you, (2) allow us to model our website(s) so that they of greater interest to you, and (3) to achieve a fair calculation of advertising costs.

Such advertising materials will be delivered by Google via a so-called „Ad Server“. We use Ad Server cookies in this regard, that allow you to measure defined parameters to measure success, such as the display of advertisements or clicks. If you are directed by a Google advertisement to our website(s), Google Ads will store a cookie in your device. Such cookies usually store the Unique Cookie-ID, number of Ad Impressions per Placement (Frequency), last Impression (relevant for Post-View-Conversions), as well as opt-out information as analysis parameters.

Such cookies allow Google to reidentify your internet browser. We do not collect and process personal data during such advertising. We only receive statistical reports from Google. These reports allow us to assess the efficiency of the advertising. We do not receive any additional data regarding the placement of advertising materials, and we are not able to identify the user with the help of the reports.

Your browser will automatically set up a direct connection with the Google server through the used marketing tools. We do not have control over the extent and the further use of the data that is collected by Google via this tool and inform you according to our current knowledge: Through the implementation of Ads Conversion, Google receives the information that (1) you have visited the respective part of our internet presence, or (2) that you clicked on one of our advertisements. If you have registered with a service of Google, Google may assign your visit to your account. Even if you are not registered with Google or you did not log in, Google might get to know your IP address and eventually store it.

We use the remarketing functionality within the Google Ads service. We can display advertisements to visitors of our website(s) on other websites within the Google advertising network (in Google Search or on YouTube, so-called „Google Ads“ or on other websites) based on their interests. We analyse the interaction of the user on our website(s) for this purpose, e.g. the offer a user was interested in, to be able to display to users targeted advertising after they have visited our website(s). Google stores cookies on the device of users for such purpose that visit defined Google services or websites in the Google Display Network. Such cookies are used to register the visits of such use. The purpose of such cookies is the unambiguous identification of a web browser on a defined device and not the identification of an individual.

b. Legal Basis of the Data Processing

The legal basis for the processing is your consent, according to Art. 6(1)(1) lit. a) of the GDPR.

c. Retention Period

Your personal data will be deleted at the latest after 180 days or if you have revoked your consent.

d. Right to Object/Remove

You can deactivate this Google tool through your cookie settings https://myactivity.google.com/product/search/controls.

e. Processing and Transfer of the Data to a Third Country

We have executed a data processing agreement with Google to comply with applicable law. Data processing may take place outside the scope of the application of European law. A transfer of personal data to the US is made on this basis of the standard contractual clauses.

 

3.8. Recruiting (Personio)

 a. Purposes and Means of the Data Processing

If you apply to us electronically, i.e. via email or using our online form, we will collect and process your personal data for the purpose of executing the application process and preparing contracts.

By submitting an application via our recruitment website, you express your interest in taking up work with us. In this context, you transmit personal data, which we will use and store exclusively for the purpose of your job search/application process. In particular, the following data is collected during this process:

• Name (first and last names)
• Email address
• Phone number
• LinkedIn profile (optional)
• Channel through which you found us

Furthermore, you can choose to upload expressive documents such as a cover letter, your CV and reference letters. These may contain additional personal data such as date of birth, address etc.

Only authorized HR staff and/or staff involved in the application process have access to your data.

b. Legal Basis of the Data Processing

The legal basis for the processing is your consent, according to Art. 6(1)(1) lit. a) of the GDPR.

c. Retention Period

Your data will be stored for a period of 90 days after the application process has been concluded. This is usually done to fulfil legal requirements and/or defending ourselves against any claims arising from legal provisions. After this period, we are obligated to delete or anonymize your data. In case of anonymization, the data will only be available to us in the form of so-called metadata, without any direct personal reference, for statistical analysis (for example, share of male and/or female applicants, number of applications per specified period of time etc.).

Should you be offered and accept a position with us during the application process, we will store the personal data collected as part of the application process for at least the duration of your employment. You may find more details in this regard in our privacy policy for employees.

d. Right to Object/Remove

You can terminate the processing of your personal data in relation to the recruiting at any time by objecting to such processing. You may find further information related thereto in Section 4 below of this privacy policy.

 

4. Your Rights, Contact Data, Amendments to the Privacy Policy

 

a. Rights of the Data Subject

Right to access, rectification, right to object, to complaint, erasure and blockage.

• You have the right to request information about whether and which personal data is processed by our company. You also have the right to demand that your personal data is rectified or amended.
• Under certain circumstances, you have the right to request that your personal data should be deleted.
• Under certain circumstances, you have the right to demand that the processing of your personal data should be restricted.
• You can withdraw your consent to the processing and use of your data completely or partially at any time with future effect.
• You have the right to obtain your personal data in a common, structured and mechanically readable format.
• If you have any questions, comments, complaints, or requests in connection with our statement on data protection and the processing of your personal data, you can also contact our data protection officer.

RIGHT TO COMPLAIN: You also have the right to complain to the responsible supervisory authority if you believe that the processing of your personal data is in violation of the legislation.

b. Contact

You may contact us at: privacy@exactag.com.

c. How we respond to your inquiries in relation to Data Protection

We will disclose information we store in relation to you upon request. To access, update or delete information about you, please contact us as set out above and inform us how you found out about us. We will react to your inquiry without undue delay.

d. Necessity of Obligation to provide Data

Insofar as not explicitly set out upon collection, providing data is not necessary or mandatory.

e. Amendments to this Privacy Policy

We reserve the right to amend this privacy policy at any time with immediate effect.

—————————-

Appendix

List of sites on wich our clients use our software solutions:

• at.bahn.de
• at.bahn.com
• m.floraprima.de
• xtg.lampenwelt.de
• xtg.luminaire.fr
• xtg.lights.co.uk
• tr.yfood.eu
• cj.esprit.de
• xtg.payback.de
• track.baldur-garten.de
• attr.eurowings.com
• et.stage-entertainment.de
• mextg.ikea.com

 

———————————–

Date of this Privacy Policy
5 February 2023