Dirk Wiegand
Interim Manager

+49 (0) 151 42 67 69 40
dw@wiegand-interim.com
wiegand-interim.com

1. General Information on Data Processing and Legal Bases

1.1. This privacy policy informs you about the nature, scope, and purpose of the processing of personal data within our online offering and the associated websites, functions, and content (hereinafter collectively referred to as “online offering” or “website”). The privacy policy applies regardless of the domains, systems, platforms, and devices used (e.g., desktop or mobile) on which the online offering is operated.

1.2. The terms used, such as “personal data” or its “processing,” refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

2. Types of Data Processed / Categories of Data Subjects

2.1. The personal data of users processed within the scope of this online offering include:

• Inventory data (e.g., names and addresses of customers),
• Contact data (e.g., email, phone numbers),
• Communication data,
• Contract data (e.g., services used, names of case handlers, payment information),
• Usage data (e.g., the visited pages of our online offering, interest in our products)
• Meta/communication data (e.g., device information, IP addresses) and
• Content data (e.g., entries in the contact form).

2.2. The term “user” encompasses all categories of data subjects. These include our business partners, customers, prospective customers, and other visitors to our online offering. The terms used are to be understood as gender-neutral.

2.3. We process users’ personal data only in compliance with the relevant data protection regulations. This means that user data is processed only if there is a legal permission, particularly when data processing is necessary for the provision of our contractual services (e.g., order processing) and online services, or is legally required, if user consent has been given, or based on our legitimate interests (i.e., interest in the analysis, optimization, and economic operation and security of our online offering within the meaning of Art. 6 para. 1 lit. f. GDPR, especially for audience measurement, creation of profiles for advertising and marketing purposes, as well as the collection of access data and the use of third-party services).

2.4. We point out that the legal basis for consent is Art. 6 para. 1 lit. a. and Art. 7 GDPR, the legal basis for processing for the fulfillment of our services and the implementation of contractual measures is Art. 6 para. 1 lit. b. GDPR, the legal basis for processing for the fulfillment of our legal obligations is Art. 6 para. 1 lit. c. GDPR, and the legal basis for processing for the protection of our legitimate interests is Art. 6 para. 1 lit. f. GDPR.

2.5. The following persons are affected by data processing:

• Contractual and business partners,
• Users of our online offering,
• Prospective customers who are interested in our online offering or contact us for other reasons, and
• Customers.

3. Security Measures

In accordance with Art. 32 GDPR, we implement appropriate organizational, contractual, and technical security measures corresponding to the state of the art, taking into account the implementation costs and the nature, scope, circumstances, and purposes of data processing, as well as the varying likelihood and severity of the risk to the rights and freedoms, to ensure an adequate level of protection for your data. We hereby ensure compliance with the provisions of data protection laws and protect this data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons.

3.1. Security measures include, in particular, the encrypted transmission of data between your browser and our server. You can recognize such encrypted connections by the URL in your browser’s address bar beginning with “https://”. This is a communication protocol that allows data to be transmitted securely against eavesdropping through transport encryption.

4. Disclosure of Data to Third Parties and Third-Party Providers

4.1. Data is only disclosed to third parties within the framework of legal requirements. We only disclose user data to third parties if, for example, this is necessary for contractual purposes based on Art. 6 para. 1 lit. b GDPR, or based on legitimate interests pursuant to Art. 6 para. 1 lit. f. GDPR for the economic and effective operation of our business.

4.2. We only engage subcontractors for the provision of our services if we have taken appropriate legal precautions and corresponding technical and organizational measures to ensure the protection of processed personal data in accordance with the relevant legal provisions.

4.3. If content, tools, or other means described in this privacy policy are used by other providers (hereinafter collectively referred to as “third-party providers”), we observe the legal requirements and, in particular, conclude corresponding contracts or agreements with the recipients of your data that serve to protect your data.

4.4. If we use a third-party provider whose registered office is located in a third country (outside the European Union (EU) or the European Economic Area), it can be assumed that data transfer to the third-party provider’s countries of establishment takes place. Data is only transferred to third countries if an adequate level of data protection, user consent, or another legal permission exists.

5. Provision of Contractual Services

5.1. We process inventory data (e.g., names and addresses as well as contact data of users), contract data (e.g., services used, names of contact persons, payment information) for the purpose of fulfilling our contractual obligations and services pursuant to Art. 6 para. 1 lit. b. GDPR. We inform contractual partners which data is required for the aforementioned purposes before or during data collection, e.g., in online forms, through special markings (e.g., colors) or symbols (e.g., asterisks or similar), or personally. Within the framework of applicable law, we only disclose this data to third parties insofar as this is necessary for the aforementioned purposes or for the fulfillment of legal obligations, or with your consent (e.g., to involved telecommunication, transport, and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities).

5.2. We delete the data after the expiry of statutory warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account, e.g., as long as it must be retained for legal archiving reasons (e.g., for tax purposes, usually 10 years). Data disclosed to us by the contractual partner within the framework of a contractual relationship will be deleted by us in accordance with the contract’s provisions, generally after the fulfillment of contractual services.

6. Contacting Us

6.1. When contacting us (via contact form or email), user data is processed for handling the contact request and its processing pursuant to Art. 6 para. 1 lit. b GDPR. In this context, we only process the data that we require to handle your request.

6.2. User data may be stored in our Customer Relationship Management system (“CRM system”) or comparable inquiry organization.

7. Web Hosting

7.1. To be able to provide our online offering securely and efficiently, we use the services of one or more web hosting providers, from whose servers (or servers managed by them) the online offering can be accessed. For these purposes, we may utilize infrastructure and platform services, computing capacity, storage space, and database services, as well as security services and technical maintenance services.

7.2. Based on our legitimate interests within the meaning of Art. 6 para. 1 lit. f. GDPR, we collect data on every access to the server on which this service is located (so-called server log files). The access data includes the name of the accessed website, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address, and the requesting provider.

7.3. Log file information is stored for security reasons (e.g., for the clarification of abuse or fraudulent acts) for a maximum duration of seven days and then deleted. Data whose further retention is necessary for evidentiary purposes is exempt from deletion until the final clarification of the respective incident.

7.4. Web hosting services also include the sending, receiving, and storage of emails. For these purposes, the addresses of recipients and senders, as well as other information related to email dispatch (e.g., the involved providers), including the content of the respective emails, are processed. Even if our email communication features transport encryption, these are not encrypted on the servers from which they are sent and received. The content of email communication is therefore generally susceptible to manipulation.

8. Cookies & Audience Measurement

8.1. When you visit our website, information in the form of a cookie may be stored on your computer. Cookies are information transferred from our web server or third-party web servers to users’ web browsers and stored there for later retrieval. Most browsers are set to automatically accept cookies. We would like to point out that the use of our online offering is only possible to a limited extent without cookies. In particular, the use of your customer account is generally not possible, as the use of cookies is technically essential for this. However, you can also prevent the setting of certain cookies (e.g., third-party cookies) via your browser, for example, if you wish to prevent web tracking. Further information on this can be found in your browser’s help function. Further information on third-party cookies that are set or processed when you visit our website can be found in the following privacy policy, provided we use them. The term cookies also includes other technologies that perform the same functions as cookies (e.g., when user data is stored using pseudonymous online identifiers, also referred to as a “user ID”).

• A distinction is made between cookies set by the website operator when visiting a website (also known as “first-party cookies”) and cookies set by third-party providers (also known as “third-party cookies”). We only have technical control over the former. We further differentiate between the following cookies.
• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offering and closed their browser.
• Persistent cookies: Persistent cookies remain stored even after the browser is closed. For example, the login status can be saved, or preferred content can be displayed directly when the user revisits a website. Similarly, user interests, which are used for audience measurement or marketing purposes, can be stored in such a cookie.
• Necessary (also: essential or strictly required) cookies: Cookies can be strictly necessary for the operation of a website (e.g., to save logins or other user input or for security reasons).
• Statistics, marketing, and personalization cookies: Furthermore, cookies are generally also used for audience measurement and when a user’s interests or behavior (e.g., viewing certain content, using functions, etc.) are stored in a user profile on individual web pages. Such profiles serve, for example, to display content to users that matches their potential interests. This process is also referred to as “tracking,” i.e., tracing the potential interests of users. We will inform you separately about the use of “tracking” technologies in our privacy policy or when obtaining consent.

8.2. We use “session cookies,” which are stored only for the duration of the current visit to our online presence (e.g., to enable the storage of your login status or the shopping cart function and thus the use of our online offering at all). A randomly generated unique identification number, a so-called session ID, is stored in a session cookie. A cookie also contains information about its origin and storage period. These cookies cannot store any other data. Session cookies are deleted when you have finished using our online offering and, for example, log out or close the browser.

8.3. If users do not want cookies to be stored on their computer, they are requested to deactivate the corresponding option in their browser’s system settings. Stored cookies can be deleted in the browser’s system settings.

8.4. The legal basis on which we process your personal data with the help of cookies depends on whether we ask for your consent. If this is the case and you consent to the use of cookies, the legal basis for processing your data is the declared consent. Otherwise, data processed with the help of cookies will be processed based on our legitimate interests (e.g., in the economic operation of our online offering and its improvement) or, if the use of cookies is necessary to fulfill our contractual obligations.

Depending on whether the processing is based on consent or legal permission, you have the option at any time to revoke a given consent or to object to the processing of your data by cookie technologies (“opt-out”). You can initially declare your opt-out via your browser settings by objecting to the setting of cookies in your browser’s system settings. An objection to the use of cookies for online marketing purposes can also be declared via a variety of services, especially in the case of tracking, through the websites https://optout.aboutads.info and https://www.youronlinechoices.com/. In addition, you can receive further objection notices within the scope of the information on the service providers and cookies used.

Before we process data or have it processed in connection with the use of cookies, we ask users for consent, which can be revoked at any time. Until consent has been given, only cookies that are necessary for the operation of our online offering will be used. Their use is based on our interest and the users’ interest in the expected functionality of our online offering. This includes usage data (e.g., visited web pages, interest in content, access times), meta/communication data (e.g., device information, IP addresses). Users of our online offering are affected by this processing. The processing takes place on the legal basis of consent (Art. 6 para. 1 sentence 1 lit. a GDPR) or legitimate interests within the meaning of Art. 6 para. 1 sentence 1 lit. f. GDPR.

9. Integration of Videos

9.1. We use videos to display the submitted contributions. Since local video hosting is not powerful enough, in individual cases, we rely on external video providers. We use the services of Vimeo, Inc., West 18th Street, New York 10011, USA (“Vimeo”).

9.2. By integrating the videos, the provider’s servers are accessed. For the associated use of data, we refer to the respective data protection notices of the provider. Vimeo’s data protection notices can be accessed via the following link: https://vimeo.com/privacy.

9.3. The legal basis for the integration of videos and the associated transmission of personal data for registered users of our offering is Art. 6 para. 1 lit. b GDPR. The integration is necessary because no comparable video solution is currently available to provide protected videos.

9.4. For non-registered users, the legal basis for the transmission of personal data is Art. 6 para. 1 lit. f. GDPR.

9.5. To ensure an adequate level of data protection when transferring data to the USA, we have concluded the so-called Standard Contractual Clauses with the provider of Vimeo. As a further protective measure, we generally embed videos in the “Do Not Track” variant, so that the scope of transmitted personal data is reduced to a minimum.

9.6. Alternatively, we can also use the YouTube service. Videos from the “YouTube” platform of the third-party provider Google. The video is embedded in our website, but still hosted on the YouTube platform. When the video is played, a connection is established with YouTube. The privacy policy can be found here: https://www.google.com/policies/privacy/ and you can find an opt-out here: https://www.google.com/settings/ads/. We have with Google

10. Integration of services and third-party content

10.1. Within our online offer, we use content or service offers from third-party providers on the basis of our legitimate interests (i.e. interest in the analysis, optimization and economic operation of our online offer within the meaning of Art. 6 Para. 1 lit. f. GDPR) or on the basis of your consent (Art. 6 Para. 1 lit. a GDPR) in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as “content”). This is done to provide our online offer and to create a user-friendliness of our online offer. This always presupposes that the third-party providers of this content perceive the IP address of the users, since they could not send the content to their browser without the IP address. The IP address is therefore required for the presentation of this content. We endeavor to only use content whose respective providers use the IP address only to deliver the content. Third-party providers can also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in third party cookies on the user’s device and contain, among other things, technical information about the browser and operating system, referring websites, visiting time and other information on the use of our online offer, as well as being linked to such information from other sources.

10.2. The following presentation provides an overview of third-party providers and their content, along with links to their data protection declarations, which contain further information on the processing of data and, in some cases already mentioned here, options for objection (so-called opt-out):

• If our customers use the payment services of third parties (e.g. PayPal or instant bank transfer), the terms and conditions and the data protection notices of the respective third-party providers apply, which can be accessed within the respective websites or transaction applications.
• External fonts from Google Ireland., https://www.google.com/fonts (“Google Fonts”). Google Fonts are integrated by calling up a server at Google (usually in the USA). Data protection declaration: https://www.google.com/policies/privacy/. An opt-out: can be found here https://www.google.com/settings/ads/.
• Maps from the “Google Maps” service from the third-party provider Google. The privacy policy can be found here: https://www.google.com/policies/privacy/, An opt-out option can be found here: https://www.google.com/settings/ads/
• Our online offers use functions of the LinkedIn network. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Each time you access one of our pages that contains LinkedIn functions, a connection to LinkedIn’s servers is established. LinkedIn is informed that you have visited our website with your IP address. If you click the “Recommend button” from LinkedIn and are logged into your account on LinkedIn, LinkedIn can assign your visit to our website to you and your user account. We would like to point out that we, as the provider of the pages, have no knowledge of the content of the data transmitted or how it is used by LinkedIn. The privacy policy can be found here: https://www.linkedin.com/legal/privacy-policy and an opt-out is available here: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Functions of the Twitter service can be integrated within our online offer. These functions are offered by Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. By using Twitter and the “Re-Tweet” function, the websites you visit are linked to your Twitter account and made known to other users. Data is also transmitted to Twitter. We would like to point out that we, as the provider of the pages, have no knowledge of the content of the data transmitted or how it is used by Twitter. Twitter’s privacy policy can be found at http://twitter.com/privacy. You can change your data protection settings on Twitter in the account settings at http://twitter.com/account/settins.
• We use functions of the XING network. The provider is XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany. Each time you access one of our pages that contains Xing functions, a connection to Xing’s servers is established. To our knowledge, personal data is not stored in the process. In particular, no IP addresses are stored or user behavior is evaluated. Data protection declaration: https://www.xing.com/app/share?op=data_protection.

11. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

11.1. Right to information
You can request confirmation from the controller as to whether personal data relating to you is processed by us.

If such processing has taken place, you can request the following information from the controller:

• the purposes for which the personal data are processed;
• the categories of personal data that are processed;
• the recipients or categories of recipients to whom the personal data concerning you have been disclosed or will be disclosed;
• the planned duration of the storage of the personal data concerning you or, if specific information is not possible, criteria for determining the storage period;
• the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• all available information on the origin of the data if the personal data are not collected from the data subject;
• the existence of automated decision-making, including profiling, pursuant to Art. 22 Para. 1 and 4 GDPR and – at least in these cases – meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

You have the right to request information as to whether the personal data concerning you are transferred to a third country or to an international organization. In this context, you can request to be informed about the appropriate guarantees pursuant to Art. 46 GDPR in connection with the transfer.

11.2. Right to rectification
You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you are incorrect or incomplete. The controller must carry out the rectification without delay.

11.3. Right to restriction of processing
Under the following conditions, you can request the restriction of the processing of personal data concerning you:

• if you dispute the accuracy of the personal data concerning you for a period that enables the controller to verify the accuracy of the personal data;
• the processing is unlawful and you refuse the erasure of the personal data and instead request the restriction of the use of the personal data;
• the controller no longer needs the personal data for the purposes of the processing, but you need them for the assertion, exercise or defense of legal claims, or
• if you have lodged an objection to the processing pursuant to Art. 21 Para. 1 GDPR and it has not yet been determined whether the legitimate grounds of the controller outweigh your grounds.

If the processing of personal data concerning you has been restricted, this data – apart from its storage – may only be processed with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the Union or a member state.

If the restriction of processing has been restricted according to the above-mentioned requirements, you will be informed by the controller before the restriction is lifted.

11.4. Right to erasure
a) Obligation to erase
You can request the controller to erase the personal data concerning you without delay, and the controller is obliged to erase this data without delay if one of the following reasons applies:

• The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
• You revoke your consent on which the processing was based pursuant to Art. 6 Para. 1 lit. a or Art. 9 Para. 2 lit. a GDPR, and there is no other legal basis for the processing.
• You lodge an objection to the processing pursuant to Art. 21 Para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you lodge an objection to the processing pursuant to Art. 21 Para. 2 GDPR.
• The personal data concerning you have been processed unlawfully.
• The erasure of the personal data concerning you is necessary to fulfill a legal obligation under Union law or the law of the member states to which the controller is subject.
• The personal data concerning you were collected in relation to services offered by the information society pursuant to Art. 8 Para. 1 GDPR.

b) Information to third parties
If the controller has made the personal data concerning you public and is obliged to erase them pursuant to Art. 17 Para. 1 GDPR, he shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform data controllers who process the personal data that you as the data subject have requested them to erase all links to this personal data or copies or replications of this personal data.

c) Exceptions
The right to erasure does not exist if the processing is necessary

• to exercise the right to freedom of expression and information;
• to fulfill a legal obligation that requires processing under the law of the Union or of the member states to which the controller is subject, or to perform a task that is in the public interest or in the exercise of official authority that has been delegated to the controller;
• for reasons of public interest in the field of public health pursuant to Art. 9 Para. 2 lit. h and i and Art. 9 Para. 3 GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes pursuant to Art. 89 Para. 1 GDPR, insofar as the right mentioned under section a) is likely to render impossible or seriously impair the achievement of the objectives of this processing, or
• for the assertion, exercise or defense of legal claims.

11.5. Right to information
If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves to be impossible or involves disproportionate effort. You have the right to be informed about these recipients by the controller.

11.6. Right to data portability
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transfer this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

• the processing is based on consent pursuant to Art. 6 Para. 1 lit. a GDPR or Art. 9 Para. 2 lit. a GDPR or on a contract pursuant to Art. 6 Para. 1 lit. b GDPR and
• the processing is carried out using automated methods.

In exercising this right, you also have the right to have the personal data concerning you transferred directly from one controller to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be impaired by this.

The right to data portability does not apply to processing of personal data that is necessary for the performance of a task that is in the public interest or in the exercise of official authority that has been delegated to the controller.

11.7. Right to object
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you that is carried out on the basis of Art. 6 Para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions.

The controller no longer processes the personal data concerning you, unless he can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If the personal data concerning you are processed for the purpose of direct marketing, you have the right to object at any time to the processing of the personal data concerning you for the purpose of such marketing; this also applies to profiling, insofar as it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

You have the option of exercising your right to object by means of automated procedures using technical specifications in connection with the use of services of the information society – notwithstanding Directive 2002/58/EC.

11.8. Right to withdraw the declaration of consent under data protection law
You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

11.9. Automated decision-making in individual cases, including profiling
You have the right not to be subject to a decision based solely on automated processing – including profiling – that has legal effect on you or significantly impairs you in a similar way. This does not apply if the decision

• is necessary for the conclusion or performance of a contract between you and the controller,
• is permitted under Union or member state law to which the controller is subject and that law contains appropriate measures to safeguard your rights and freedoms and your legitimate interests, or
• is based on your explicit consent.

However, these decisions may not be based on special categories of personal data pursuant to Art. 9 Para. 1 GDPR, unless Art. 9 Para. 2 lit. a or g applies and appropriate measures have been taken to protect the rights and freedoms and your legitimate interests.

With regard to the cases mentioned in (1) and (3), the controller shall take appropriate measures to safeguard the rights and freedoms and your legitimate interests, which shall include at least the right to obtain the intervention of a person on the part of the controller, to state his own point of view and to contest the decision.

11.10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your place of residence, your place of work or the place of the alleged infringement, if you are of the opinion that the processing of personal data concerning you violates the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and the results of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

12. Deletion of Data

12.1. Data stored by us will be deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent its deletion. Deletion will also occur, in particular, if other permissible grounds cease to apply. If user data is not deleted because it is required for other legally permissible purposes, its processing will be restricted, i.e., the data will be blocked and not processed for other purposes. This applies, for example, to user data that must be retained for commercial or tax law reasons.

12.2. In accordance with legal requirements, data is retained for 6 years pursuant to Section 257 (1) of the German Commercial Code (HGB) (commercial books, inventories, opening balances, annual financial statements, commercial letters, booking vouchers, etc.) and for 10 years pursuant to Section 147 (1) of the German Tax Code (AO) (books, records, management reports, booking vouchers, commercial and business letters, documents relevant for taxation, etc.).

13. Right to Object

Users may object to the future processing of their personal data at any time in accordance with legal requirements. The objection may particularly be raised against processing for direct marketing purposes.

14. Amendments to the Privacy Policy

14.1. We reserve the right to amend the Privacy Policy to adapt it to changed legal situations, or in the event of changes to the service and data processing. However, this applies only with regard to declarations concerning data processing. If user consents are required or if parts of the Privacy Policy contain provisions of the contractual relationship with users, changes will only be made with the users’ consent.

14.2. Users are requested to regularly review the content of the Privacy Policy.