Privacy policy

We are pleased to have you visit to our website. In the following we would like to inform you of how your data is handled in accordance with Article 13 of the General Data Protection Regulation (GDPR).

If you give us your consent for processing your data, you have the option of retrieving it at any time, including the time of consent giving, as well as viewing the consent history at the following link: https://www.openpromos.com/agreementverify

1 Data controller

PROMOS consult Projektmanagement, Organisation und Service GmbH & Co. KG. (PROMOS) is responsible for the data processing described below as per data protection regulations.

If you have any questions or concerns about data protection, including requests for information, corrections, deletions or other data protection issues, please contact our data protection contact exclusively at the following e-mail address: datenschutz@promos-consult.de

Please note that only enquiries relating to data protection issues will be processed at this address. For general contact enquiries, please use our contact form.

2 Server log files

When you visit our website, our web server stores standardised information on your device and browser in a log file. We process this data in order to analyse errors on our server and attempted misuse. The following details are recorded:

• The name of the accessed website,
• The date and time of the query,
• The amount of data transferred,
• A notification of successful retrieval,
• The IP address of the requesting computer,
• The specific address of the page you visit on our website,
• The type and version of browser and the operating system used,
• If applicable, the URL of the previously visited website

We cannot identify you using this data, as the log data is only evaluated anonymously. Log data is regularly deleted in a timely manner, but after 90 days at the latest. The legal basis for this data processing is our legitimate interest within the meaning of Article 6(1)(f) GDPR.

3 SSL or TLS encryption

This website uses SSL or TLS encryption for security reasons and to safeguard the transmission of personal data and other confidential content (e.g. enquiries to the data controller). You can recognise an encrypted connection by the string “https://” and the lock symbol in your browser address bar.

4 Matomo

We use the open-source software Matomo (formerly Piwik) on our website to analyse the reach of our content in our own interest. We use this data to determine user behaviour and to optimise website use.

Matomo is operated exclusively on its own server. No data is passed on to third parties.

As a user, you remain anonymous. We carry out our reach analysis with anonymised data by creating pseudonymous user profiles. Cookies are used for this. The IP address is shortened immediately after collection and before storage.

You can decide below whether you object to the described use of Matomo. If you revoke the reach analysis with Matomo, a Matomo deactivation cookie will be stored in your browser (“opt-out” cookie). Please note that your browser must accept cookies for this. If you delete the deactivation cookie, you may have to revoke it again here.

6 Third-party providers

In order to provide and continuously improve our services, we rely on the services of various third parties through which personal data can also be processed.

For example, we use tracking technology on our website to assess, evaluate and continuously improve our website. This also allows us to protect our users and partners by identifying and defending against fraud and security risks.

6.1 Google Maps

We use Google Maps on our website. This is a service from Google Ireland Ltd (hereinafter referred to as “Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

In order to prevent Google from automatically loading content when you visit our website, we will first show only locally saved preview images of maps. This does not send Google any information. Content from Google will only be loaded after you have clicked on the preview image. This informs Google that you have visited our site and sends Google technically required usage data.

As part of Google Maps, your data may be transmitted to Google Ireland Ltd and Google LLC (USA). Data processing can therefore take place outside the EU or EEA. With regard to Google LLC, an appropriate level of data protection cannot be assumed due to processing in the United States. Consequently, there is a risk that authorities may access the data for security and surveillance purposes without informing you and with no way for you to file an appeal. We have no control over whether and to what extent Google processes your data for its own purposes or links it to other user profiles of you.

The data processing is conducted based on your consent in accordance with Article 6(1)(a) GDPR. By clicking on the preview image, you give us your consent to load content from Google. You can revoke your consent at any time. To do so, please follow this link Privacy settings  and make the appropriate settings in our banner. The transfer of data to third countries shall be conducted in accordance with Article 49(1)(a) GDPR.

7 Facebook / Instagram fan page

We operate a Facebook fan page and Instagram fan page to raise awareness about topics related to everyday work, employees and career opportunities at PROMOS on Facebook and Instagram and to interact and communicate with you as visitors and users of these pages.

This is a service offered by Facebook Ireland Ltd (hereinafter referred to as “Facebook”), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

7.1 Shared responsibility

We are jointly responsible with Facebook for the operation of our Facebook and Instagram pages in accordance with Article 26 GDPR. To this end, we have concluded an agreement with Facebook regarding who will fulfil which data protection obligations. This agreement can be found here: (https://www.facebook.com/legal/terms/page_controller_addendum).

As per this agreement, Facebook is primarily responsible for providing the data subject with information on the joint processing and for enabling them to exercise their data protection rights.

We nevertheless provide details about your visit to our fan page here.

7.2 Data collected by Facebook or Instagram:

If you use Facebook or Instagram, Facebook will collect the data described in the Facebook Data Policy or Instagram Data Policy. This includes:

• Registration data such as user name, password, e-mail address
• Profile information such as first and last name, phone number, picture
• Log file information such as web request, IP address, browser type, landing pages, pages viewed
• Device ID
• Metadata such as hashtags, geotags, comments

If you do not use Facebook or Instagram, the site may still store cookies, small text files, in your browser that can track your user behaviour. Facebook’s user data is generally also processed for market research and advertising purposes. User behaviour (including during visits to our social media sites) is used to create complex user profiles that Facebook can use to deliver personalised ads to the visitor within Facebook and on other sites. Please also refer to the respective privacy policies for more information.

7.3 Our data collection and legal basis

We can use statistics provided by Facebook to analyse how people use our Facebook and Instagram fan pages. This allows us to continually improve our Instagram content.

For this purpose, Facebook saves our fan page cookie on your device and collects so-called insights data about how you use our fan page:

• Information about your visit to our Facebook fan page (your IP address, last visited website, file name, URL)
• Information about your Facebook interactions with our content, such as through “likes”
• If applicable, your comments will be saved with a time indication

Each of these Facebook cookies has a unique cookie ID.

Based on the data processing performed by Facebook, it is possible to obtain statistical data from Facebook in line with our shared responsibility in accordance with Article 26 GDPR. However, we only use this Facebook fan page to draw attention to our company and to contact you as a visitor and user of this Facebook fan page. In addition, it is not possible to identify you individually using the Insights function or the statistics provided by Facebook at any time during your visit to our fan page. In any case, we as page controllers do not make any decisions regarding the processing of data and all other information pursuant to Article 13 GDPR, such as the storage period of cookies on user devices. The primary responsibility for the processing of the data lies with Facebook.

When using Facebook, your data may be sent to Facebook Inc. (USA). Data processing can therefore take place outside the EU or EEA. With regard to Facebook Inc., an appropriate level of data protection therefore cannot be assumed due to processing in the United States. There is a risk that authorities may access the data for security and surveillance purposes without informing you and with no way for you to file an appeal. We have no control over whether and to what extent Facebook processes your data for its own purposes or links it to other user profiles of you.

This fan page is operated on the basis of our legitimate interests within the meaning of Article 6(1)(f) GDPR to provide a modern and supportive option to share information and interact with our users and visitors. If you object to the embedding, we recommend that you do not use our fan page in the future. The transfer of data to third countries shall be conducted in accordance with Article 49(1)(a) GDPR.

Information about Facebook’s contact options, advertising settings and data use policies is available at https://en-gb.facebook.com/privacy/explanation

For more information about our shared responsibility with Facebook, visit  https://www.facebook.com/legal/terms/page_controller_addendum

8 YouTube videos

We embed YouTube videos on our website. YouTube is a subsidiary of Google Ireland Ltd (hereinafter referred to as “Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Visiting our pages with embedded videos loads content from the video provider. This informs YouTube that you have visited our site and sends YouTube technically required usage data.

We use YouTube videos with Privacy Enhanced Mode activated. According to YouTube, Privacy Enhanced Mode does not set cookies and only sends data to the YouTube server when you actually start playing a video.

When you use YouTube, your data may be transmitted to Google Ireland Ltd and Google LLC (USA). Data processing can therefore take place outside the EU or EEA. With regard to Google LLC, an appropriate level of data protection cannot be assumed due to processing in the United States. Consequently, there is a risk that authorities may access the data for security and surveillance purposes without informing you and with no way for you to file an appeal. We have no control over whether and to what extent Google processes your data for its own purposes or links it to other user profiles of you.

The data processing is conducted based on your consent in accordance with Article 6(1)(a) GDPR. By clicking on a video, you give us your consent to load content from Google. The transfer of data to third countries shall be conducted in accordance with Article 49(1)(a) GDPR. You can revoke your consent at any time. To do so, please follow this link Privacy settings  and make the appropriate settings in our banner.

9 Newsletter

You can subscribe to our newsletter on our website to receive information. The information you voluntarily provide to us for this purpose will only be used for sending the newsletter. The legal basis for our data processing is your consent in accordance with Article 6(1)(a) GDPR. You can unsubscribe from our newsletter at any time by using the unsubscribe link included in each newsletter. This simultaneously revokes your consent to receive correspondence from the mailing service provider and to the statistical analyses. It is unfortunately not possible to individually revoke your consent to correspondence from the mailing service provider or to the statistical analyses. You will find a link to unsubscribe from the newsletter at the end of each newsletter.

10 Contact form

A contact form is available on our website which you can use to get in touch with us electronically. If you contact us via our contact form or via personal message, the data entered in the input form will be transmitted to us and stored.

The fields marked with * are mandatory. For us to transfer this data, we must confirm that you have reviewed the privacy policy. We use this data to answer your query in accordance with Article 6(1)(f) GDPR. Article 6(1)(b) GDPR may also serve as the legal basis if your enquiry involves the performance of pre-contractual measures.

Fields that are not marked with * are purely voluntary information. The processing of data that you voluntarily enter in the form is conducted in accordance with Article 6(1)(a) GDPR. You may revoke your consent at any time with future effect.

11 Online application

In the course of your online application, i.e. via e-mail or using our online form, we collect and process your personal data for the purpose of executing the application process and preparing contracts. By submitting an application via our recruitment website, you transmit the following data:

• Name (first and last name)
• e-mail address
• telephone number
• Linkedin profile (optional)
• channel through which you found us

Furthermore, you can choose to upload expressive documents such as a cover letter, your CV and reference letters. These may contain additional personal data such as date of birth, address etc.

Your data will initially only be processed for the execution and verification of the application process. The legal basis for this is Article 88(1) GDPR in connection with Article 26(1) sentence 1 of the German Federal Data Protection Act (BDSG). We generally do not require any special categories of personal data (e.g. information about a serious disability) in the application process within the meaning of Article 9 GDPR. However, if you voluntarily provide us with such data, the processing is carried out on the legal basis of Article 9(2)(b) GDPR in connection with Article 26(3) BDSG.

Should the application process result in your employment by us, we shall subsequently process your data in accordance with Article 88 GDPR within the meaning of Article 26 BDSG to implement the employment relationship with you.

11.1 Data deletion

We store your personal data as long as this is necessary to make a decision regarding your application. If you are not ultimately hired, your personal data and application documents will be deleted six months after the end of the application process unless longer storage is legally required or permitted (e.g. for the assertion, exercise or defence of legal claims for the duration of a legal dispute, travel expense settlement, etc.). After this period, the data will only be available to us in the form of so-called metadata, without any direct personal reference, for statistical analysis (for example, share of male and/or female applicants, number of applications per specific period of time etc.).

If you have not been hired, we reserve the right to store your data for 12 months after the application process has been concluded for the purpose of adding it to our talent pool in order to consider you in our selection of candidates for suitable vacancies in the future. This includes, for example, applications for apprenticeships or internships. By accepting the data privacy statement., you consent to any further storage of your data as well as its inclusion in our talent pool.

If we hire you following the application process, we will store your data for the duration of your employment relationship with us. However, you will receive further information about the processing of your data within the employment relationship as soon as your employment with us begins.

11.2 Data recipient

We publish job offers on our website via Personio. This is an HR applicant management system from Personio GmbH, Rundfunkplatz 4, D-80335 Munich.

Personio is integrated by embedding the service on our website using an iFrame. When you load this iFrame, your respective browser may automatically transmit data, so-called server logs. As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. This includes the following information:

• Domain name of the accessed website,
• The type and version of browser and the operating system used,
• The IP address of the requesting computer,
• The date and time of the query.

This data is stored exclusively for technical reasons and the scope of this log process does not exceed the common log scope of any other site on the web. These access logs are stored for a period of up to 7 days. The legal basis for this is Article 6(1)sentence 1(f) GDPR. This ensures that Personio only transmits the information to servers within the EU. For more information about Personio’s privacy policy, please visit https://www.personio.com/privacy-policy/

12 Your rights as a data subject

With regard to the data processing listed here, you are entitled to various rights as a data subject as stipulated in the GDPR.

Right of access (Article 15 GDPR)

You have the right to obtain confirmation from the controller of whether it processes personal data relating to you.

Right to rectification (Article 16 GDPR)

You may immediately request that the controller correct inaccurate personal data concerning you.

Right to erasure (Article 17 GDPR)

You have the right to obtain from the controller the erasure of personal data concerning you without undue delay.

Right to restriction (Article 18 GDPR)

You have the right to obtain from the controller restriction of processing if one of the prerequisites listed in Article 18 GDPR applies.

Right to data portability (Article 20 GDPR)

You have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format provided that one of the prerequisites listed in Article 20 GDPR applies.

Right to withdrawal (Article 7 GDPR)

You have the right to withdraw your consent at any time in accordance with Article 7(3) GDPR. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right to object (Article 21 GDPR)

If data is collected on the basis of Article 6(1)(f) GDPR or Article 6(1)(e) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you.

Right to lodge a complaint (Article 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you additionally have the right to lodge a complaint with a supervisory authority. You can contact the data protection authority of your usual place of residence or our company headquarters for this purpose. The address of the supervisory authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit

Friedrichstr. 219

10969 Berlin

Phone: 030 13889-0

E-mail: mailbox@datenschutz-berlin.de

13 Data protection officer

Our external data protection officer will be happy to provide you with information regarding data protection via the following contact details:

Ali Tschakari, LL.M.

Albrechtstraße 10

D-10117 Berlin

E-mail: datenschutz@bitkom-consult.de

If you contact our data protection officer, please indicate the responsible department as named in the website publication details.

14 Final provisions

PROMOS reserves the right to amend this privacy policy at any time to ensure that it complies with current legal requirements or to accurately reflect service changes in the privacy policy, such as the introduction of new services or changes to the website. The new privacy policy will then apply when you visit this website again.

Status: November 2024