Data protection statement for visitors of this website

Please read this privacy policy carefully. It applies to all services, additional services, programs, information, advertising measures and products provided on apsolut's website or in our other publications.

If we want to be successful in our business activities, we depend on the trust of our users. Data protection is therefore of the utmost importance for apsolut, our customers and cooperation partners. The obligations regarding user data protection set out below form the basis of apsolut's business activities at all times.

Further data protection information for

• candidates
• customers
• survey participants
• visitors of the apsolut Facebook page

§1 Information on the collection of personal data

(1) In the following, we inform you about the collection of personal data when using our website. Personal data are all data that can be related to you personally, e.g. name, address, e-mail addresses, user behavior.

(2) In accordance with Art. 4 Para. 7 EU General Data Protection Regulation (GDPR), the responsible party is

apsolut GmbH
Oelmühlenstr. 30
33604 Bielefeld
Germany

e-mail: info@ap-solut.com

(see our imprint).

You can reach our data protection officer at:

Bugl & Kollegen GmbH
Eifelstraße 55
93057 Regensburg
Germany

e-mail: kontakt@buglundkollegen.de

(3) When you contact us by e-mail or via contact form, we will store the data you provide (your e-mail address, if applicable, your name and your telephone number in order to answer your questions. The legal basis for the processing of the data is our legitimate interest in answering your request in accordance with Art. 6 para. 1 lit. f GDPR. If your contact is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR. When received in this context, we delete incoming data after storage is no longer required or restrict its processing if required for statutory retention.

(4) If we use contracted service providers for individual functions of our offer or wish to use your data for advertising purposes, we will inform you in detail about the respective processes below. We will also state the specified criteria for the storage period.

§2 Your rights

You have the following rights towards us with regard to your personal data:

(1) Right to information according to Art. 15 GDPR: The person concerned may request confirmation from the person responsible as to whether their personal data are being processed. If this is the case, the person concerned has the right to certain information regarding this personal data.

(2) Right of correction according to Art. 16 GDPR: The person concerned   has the right to request the immediate rectification of incorrect personal data concerning him/her by the person responsible. Taking into account the purposes of the data processing, the person concerned has the right to request the completion of incomplete personal data.

(3) Right of deletion in accordance with Art. 17 GDPR: The person concerned has the right to demand from the person responsible that personal data relating to him/her be deleted immediately, and the person responsible is in principle obliged to delete personal data immediately. However, there are personal data that are exempt from this deletion obligation and where we are even obliged ny other laws to continue storing them.

(4) Right to restricted data processing in accordance with Art. 18 GDPR: The data subject shall have the right to request the person responsible to restrict processing, provided that certain prerequisites are met.

(5) Right of objection according to Art. 21 GDPR: The person concerned has the right to object at any time, for any particular reasons, to the processing of his/her personal data which has been carried out on the basis of Article 6 Para. 1 letter e of the GDPR (data processing in the public interest) and Article 6 paragraph 1 letter f of the GDPR (data processing based on a balancing of interests); this also applies to profiling according to Art. 4 No. 4 GDPR based on this provision.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate reasons for processing that outweigh your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.

If you wish to exercise your right of objection, simply send an e-mail to privacy@ap-solut.com

 

(6) Right of revocation in the case of consent in accordance with Art. 7 para. 3 GDPR: The person concerned has the right to revoke his or her consent at any time. Revocation of consent shall not affect the legality of the processing carried out on the basis of the consent until revocation.

(7) Rightof complaint to the competent supervisory authority: If you are of the opinion that our processing of your personal data is unlawful or that we violate data protection law for other reasons, you can file a complaint to our competent supervisory authority.

The competent supervisory authority for data protection issues in North Rhine-Westphalia can be found under the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

§3 Hosting

(1) The hosting services we use serve to provide the following services: Infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services as well as technical maintenance services which we use for the purpose of operating this online offer.

(2) In doing so, we or our hosting provider process inventory data, contact data, content data, contract data, usage data, metadata and communication data of customers, interested parties and visitors of this online offer on the basis of our legitimate interests in an efficient and secure provision of this online offer in accordance with Art. 6 Para. 1 lit. f GDPR in conjunction with Art. 28 GDPR (conclusion of a processing agreement).

§4 Visiting the website

When using the website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we only collect personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website and to ensure its stability and security:

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access Status/HTTP Status Code
• Amount of data transferred in each case
• Website from which the request comes
• Browser
• Operating system and its interface
• Language and version of the browser software

We collect and store this data for a limited period of time due to our legitimate interest in order to derive personal data in the event of unauthorized access or attempts to access local servers (Art. 6 para. 1 lit. f GDPR).

§5 Use of cookies

On our websites, we use cookies and similar functions to process terminal device information and personal data of our users. Cookies are small text files that are stored on your hard drive in accordance with the browser you are using, and which provide the party setting the cookie (in this case, us) with certain information. They serve to make the Internet offer as a whole more user-friendly and effective.

We distinguish between three categories of cookies: essential cookies, without which the functionality of our website would be limited, and optional cookies for the integration of external elements, as well as the statistical analysis of cookies. Information on the individual functions, the recipients of the data and the storage duration can be found under "Privacy settings".

The use of essential cookies is possible without the consent of the website visitor and is subject to a legitimate interest of operating and optimizing our website and services according to Art. 6 (1) lit f GDPR. The use of optional and analytical cookies is subject to the consent of the website visitor pursuant to Art. 6 para. 1 lit a GDPR. This consent is voluntary, not required for the use of our website and can be revoked at any time under "Privacy settings". You can accept, reject or consent to all or individual functions at the click of a button in the cookie settings under "Privacy settings".

For details on the essential cookies used on this website, please refer to the following table:

§6 Use of Google Analytics

(1) This website uses Google Analytics, a web analytics service provided by Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland. Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, due to the activation of IP anonymisation on these websites, your IP address will be shortened by Google beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.

(2) On behalf of the operator of this website, Google will use this information to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage.

The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. The purpose of the data processing is to analyse the use of the website and to compile reports on activities on the website. Based on the use of the website and the Internet, further associated services are then to be provided.

(3) We use Google Analytics to analyse and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user. The legal basis for the use of Google Analytics is provided in Art. 6 para. 1 lit. a GDPR.

§7 Integration of YouTube videos

(1) We have integrated YouTube videos into our online presence, which are stored at http://www.YouTube.com and can be played directly from our website. These are all integrated in "extended privacy mode", which means that no data about you as a user is transferred to YouTube if you do not play the videos. Only when you give your consent and play the videos will the data mentioned in Paragraph 2 be transferred. We have no influence on this data transfer.

(2) By visiting the website, YouTube receives the information that you have called up the corresponding subpage of our website. In addition, the data mentioned in §4 of this statement is transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in at Google, your data will be assigned directly to your account. If you do not want your data to be synchronised with your YouTube profile, you have to log out before activating the button. YouTube stores your data as user profiles and uses them for the purpose of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) for the purpose of providing need-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right. The legal basis for the use of YouTube is Art. 6 para. 1 lit. a GDPR.

(3) Third Party Provider Information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

(4) You can also change the use of cookies by adjusting your browser software accordingly or in the cookie settings.

(5) Further information on the purpose and scope of data collection and its processing by the provider can be found in the provider's data protection declarations. There you will also find further information on your rights and settings to protect your privacy: https://policies.google.com/privacy?hl=en-US/intl/de/policies/privacy.

§8 Integration of Vimeo videos

(1) We have integrated Vimeo videos into our online offering, which are stored on http://www.vimeo.com and can be played directly from our website.

(2) By playing the videos, Vimeo receives the information that you have accessed the corresponding subpage of our website.  In addition, the data mentioned under §4 of this declaration is transmitted. This occurs regardless of whether Vimeo provides a user account through which you are logged in or whether no user account exists. Vimeo stores your data as user profiles and may use them for the purposes of advertising, market research and/or customising its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide customised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Vimeo to exercise this right.

(3) Further information on the purpose and scope of data collection and its processing by Vimeo can be found in Vimeo's privacy policy. There you will also find further information about your rights and setting options to protect your privacy: https://vimeo.com/privacy. Vimeo also processes your personal data in the USA. In order to establish an appropriate level of data protection, we have agreed to standard data protection clauses with Vimeo. The legal basis for the use of Vimeo is Art. 6 para. 1 lit. a GDPR.

§9 Integration of Google Maps

(1) On this website we use the service of Google Maps. This allows us to display interactive maps directly on the website and enables you to use the map function conveniently.

(2) By visiting the website, Google receives the information that you have called up the corresponding subpage of our website. In addition, the data mentioned in § 4 of this statement will be transmitted. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in at Google, your data will be assigned directly to your account. If you do not want, your data to be synchronised to your Google profile, you must log out before activating the button. Google stores your data as user profiles and uses them for the purposes of advertising, market research and/or demand driven design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide need-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right. The legal basis for the use of Google Maps is Art. 6 para. 1 lit. a GDPR.

(3) Information of the third party provider: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland.

For further information on the purpose and scope of data collection and its processing by the provider, please refer to the provider's privacy policy. There you will also find further information on your rights and settings to protect your privacy: http://www.google.de/intl/de/policies/privacy.

§10 Use of SoundCloud

What is SoundCloud?
We use functions (widgets) of the social media network SoundCloud of the company SoundCloud Limited, Rheinsberger Str. 76/77, 10115 Berlin, Germany on our website. You can recognise the widgets by the familiar orange logo. By using functions such as playing music, data is transmitted to SoundCloud, stored and analysed.

The social media network SoundCloud is an online music platform that serves the exchange and distribution of audio files. On SoundCloud, musicians or podcasters offer their audio files for download. In addition, SoundCloud can also be used to integrate audio files into other websites. Typical for SoundCloud are the graphic representations of the audio files in wave form and the comment bar. This allows registered users to listen to and comment on music tracks or podcasts at any time.

Why do we use SoundCloud on our website?
Our goal is to provide you with the best possible service on our website. Through the embedded SoundCloud playback function, we can deliver acoustic content to you directly and free of charge. You don't have to follow any link first to listen to an audio file, but can start right away via our website.

What data is stored on SoundCloud?
As soon as you visit one of our websites that has a widget (like or share button or play function) built in, your browser connects to a SoundCloud server. In the process, data from you may be transferred to SoundCloud, managed and stored there. For example, SoundCloud recognises in this way your IP address and which page (in this case ours) you visited and when. If you have a SoundCloud account and are logged in while browsing our website, the collected data will be directly assigned to your account. You can only prevent this by logging out of SoundCloud while you are on our website. In addition to the information mentioned above, data about your user behaviour is also stored in the cookies. For example, whenever you click a button, play or pause a piece of music, this information is stored in the cookies. The widget or SoundCloud is thus able to recognise you and sometimes the widget is also used to deliver personalised content to you. SoundCloud not only uses its own cookies, but also cookies from third-party providers such as Facebook or Google Analytics. These cookies serve the company to get more information about your behaviour on external websites and its own platform. We, as the website operator, do not receive any information about your user behaviour through the cookies used by SoundCloud. The data transfer and therefore also the information about technical devices and your behaviour on the website takes place between you and SoundCloud.

How long and where is the data stored?
In principle, the collected data remains stored at SoundCloud as long as a user account exists or as long as it is necessary for SoundCloud to achieve its business objectives. Exactly how long data is stored changes depending on the context and legal obligations. Even if you do not have an account and personal data has been stored, you have the right to request data deletion.

How can I delete my data or prevent data storage?
If you have a SoundCloud account, you can manage data processing or delete your entire account via "Settings". But you can also manage, delete or deactivate cookies in your browser exactly according to your needs. The approach always depends on the browser you use. If you decide to delete or deactivate cookies, please note that all functions may then no longer be available.

Legal basis
We only use the embedded SoundCloud elements insofar as you have given your consent (Art. 6 para. 1 lit. a DSGVO/GDPR). SoundCloud also sets cookies in your browser to store data. That is why we recommend that you view the privacy policy or cookie policy of the respective service provider.

§11 Use of Google Tag Manager

(1) We use the Google Tag Manager on our website.

(2) The Google Tag Manager allows us to integrate various codes and services on our website in an ordered and simplified way. The Google Tag Manager implements the tags or "triggers" the integrated tags. When triggering a tag, Google may process information (including personal data).

In particular, the following personal data is processed by the Google Tag Manager:

• Online tags (including cookie identifiers)
• IP address

(3) You can find more detailed information about the Google Tag Manager on the websites https://www.google.de/tagmanager/use-policy.html and https://www.google.com/intlde/policies/privacy/index.html under the section "Data we receive as a result of your use of our services".

(4) Furthermore, we have concluded a contract with Google for the use of the Google Tag Manager for order processing. Google processes the data on our behalf to trigger the deposited tags and to display the services on our website. Google may transfer this information to third parties if required by law or if third parties process this data on behalf of Google. The legal basis for the use of Google Tag Manager is Art. 6 para. 1 lit. a GDPR.

(5) If you have deactivated individual tracking services (e.g. by rejecting a cookie), the deactivation will remain in effect for all tracking tags concerned which are integrated by the Google Tag Manager.

(6) By integrating the Google Tag Manager, we pursue the purpose of being able to integrate various services in a simplified and clear manner. Furthermore, the integration of the Google Tag Manager optimizes the loading times of the different services.

(7) Third party provider information: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland.

§12 Use of Google Optimize

(1) We use Google Optimize on our website, which is a service linked to Google Analytics. Through so-called A/B tests, the use of different variants of our website is analysed. This allows us to better understand the concerns of our users and design the website accordingly to be more user-friendly. We only use Google Optimize if you have given us your express consent to do so via the cookie banner.

(2) Google Optimize uses so-called "cookies", which enable an analysis of your use of the website. The information generated by the cookie about your use of this website (including your IP address) is transmitted to a Google server and saved there. IP anonymisation has been activated on this website so that the user's IP address is shortened beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating the use of the website by users, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator.

(3) Further information on Google Optimize can be found at https://policies.google.com/privacy.

§13 Use of LinkedIn Analytics and LinkedIn Ads

(1) This website uses the conversion tracking technology and the retargeting function of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. With the help of this technology, visitors to this website can be shown personalised advertisements on LinkedIn. Furthermore, it is possible to create anonymous reports on the performance of the adverts and information on website interaction. For this purpose, the LinkedIn Insight tag is integrated on this website, which establishes a connection to the LinkedIn server if you visit this website and are logged into your LinkedIn account at the same time.
In LinkedIn's privacy policy at https://www.linkedin.com/legal/privacy-policy you will find further information on data collection and use as well as the options and rights to protect your privacy. If you are logged in to LinkedIn, you can deactivate data collection at any time by clicking on the following link: https://www.linkedin.com/psettings/enhanced-advertising.

(2) The legal basis for the use of LinkedIn Analytics and LinkedIn Ads is your consent pursuant to Art. 6 para. 1 lit a GDPR.

§14 Use of Google Fonts

We do not use "Google Web Fonts" (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to display fonts on this website.

However, when using Google services used on this website, such as Google Maps or YouTube, it may happen that fonts from the Google Fonts offer are loaded as part of such a service. We have no influence on this.

The privacy policy of the library operator Google can be found here: https://www.google.com/policies/privacy/.

§15 Online presence in social media

We maintain online presences within social networks in order to inform the users active there about our services and to communicate directly via the platforms, if they are interested. We are currently represented in the following networks:

• Facebook
• Xing
• LinkedIn
• Instagram

All of our social media channels can only be accessed by website visitors via an external link. We do not use any plug-ins or other interfaces on our website that offer the respective networks for embedding the offers on websites.

We have no influence on the data collection and its further use by the social networks. For example, we have no knowledge of the extent to which, where and for how long the data is stored, the extent to which the networks comply with existing deletion obligations, what evaluations and links are made with the data and to whom the data is passed on. We therefore explicitly point out that user data (e.g. personal information, IP address) is stored and used for business purposes by the network operators in accordance with their data usage guidelines.

We process users' data in social media insofar as they contact and communicate with us via comments or direct messages. The legal basis for the processing of user data is Art. 6 para. 1 lit. b and f GDPR.

No functions and contents within our online offering are integrated with Xing, offered by New Work SE, Dammtorstraße 29-32, 20354 Hamburg, Germany. The Xing channels can only be accessed via an external link. If visitors to our website are members of the Xing platform, Xing can assign can link the user's social media profile to his/her Xing profile, if he/she is logged in. We would like to point out that we have no influence on the content, scope of use of the data collected by Xing. For further information on this matter, please go to the Xing privacy policy: https://www.xing.com/app/share?op=data_protection.

Within our online presence, no functions and contents of the LinkedIn service, offered by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, are integrated. The LinkedIn channels can only be accessed via an external link. If visitors to our website are members of the LinkedIn platform, LinkedIn can link the user to his/her LinkedIn profile if he/she is logged in. We would like to point out that we have no influence on the content, scope of use of the data collected by LinkedIn. For further information in this regard, we refer to the LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv.

You can access the social media network Facebook and Instagram via external links on our website. All functions in the social media network are offered by Meta Platforms Ltd., 4 Grand Canal Square, Dublin 2, Ireland. The social media channels are only accessible via an external link. If you are logged into Facebook or Instagram with your own profile and access our social media channel, Meta can associate your visit with your logged in profile. If you do not want your account to be associated with your IP address, please log out of your Facebook and/or Instagram account before using our website.

For more information about the processing of your data, please refer to Meta's privacy policy: https://www.facebook.com/privacy/policy/?entry_point=facebook_page_footer and to our data policy for visitors* to the apsolut Facebook page.

§16 Registration for Events & Webinars

a. Nature and purpose of the data processing
The data is processed solely for the purpose of offering and conducting events and webinars.

Before the event or webinar takes place
When you register for an event/webinar, we process the data you provide for registration and communication. Your name, email and company name will be stored. All other data is voluntary and can be provided optionally. Name and e-mail address are forwarded to a software platform for online webinars and stored there throughout the duration of the event and subsequent evaluation of participation. If we hold the event/webinar with a co-organising partner, the co-organisers will also have access to the event/webinar data including participant data. Upon registration, you will be informed of this circumstance and the respective obligation to inform will be made available to you.

During the delivery of a webinar
Information on meeting metadata
When you participate in the webinar, so-called meeting metadata is processed. These are the following categories of data: Topic, description (optional), participant IP address, device/hardware information, location, language settings, operating system.
For technical reasons, this data must be processed with regard to the respective webinar.
Data categories when dialling in with the telephone
When dialling in by telephone, details of the incoming and outgoing telephone number, country name, start and end time are processed. If necessary, further connection data such as the IP address can be stored in the case Voice-over-IP (VOIP) is used.
For technical reasons, it is necessary for this data to be processed with regard to the respective webinar.
Text data processing
If you use a chat, question or survey function in the webinar, this content data is processed for the purpose of communication within the webinar. In addition, the chat history is stored in a text file that reflects the name, first name (or a pseudonym) and the text of the chat message. This data will only be processed for the purpose of following up on the content of the webinar and will only be used in anonymised form for internal analysis purposes.
Audio and video data processing
Our webinars are always recorded. If you participate with verbal contributions and/or also use the video function to enable visual transmission of your image, this personal data will be processed for the purpose of communication within the webinar. It is up to you to use these functions. Only if you activate the microphone or the camera of your terminal device yourself, can the aforementioned data processing take place.
Data processing when recording webinars
Webinars are always recorded. If you have joined via video or microphone function and we use this recording for downloading for third parties or similar, we will obtain your consent for this. You can see at any time whether a recording is taking place: This is usually indicated to you by the red Record button in the software. In addition, we verbally point out a recording at the beginning.
Processing of photo and video recordings at on-site events
During our on-site events, there is the possibility that photo and/or video recordings will be made. These recordings may also be published on our website and/or social media channels. Before the start of the events, we will again specifically point out the taking and possible publication. We process this data on the basis of our legitimate interest, and you have the right to object at any time. To do so, please contact the photographer/videographer.

b. Legal basis of the processing
The legal basis for data processing when conducting events and webinars is Art. 6 (1) lit. b GDPR, insofar as the webinars/events are conducted within the scope of contractual relationships. If there is no contractual relationship, the legal basis is Art. 6 para. 1 lit. f GDPR. Also in this case, it is the legitimate interest of our company to conduct effective and secure webinars/events.

c. Data categories
Are described in more detail under a.

d. Recipient
Provider of the corresponding webinar software, within the scope of order processing and, if applicable, cooperation partners who conduct the events and webinars with us.

e. Storage periods
All data relating to the webinar/event will be deleted no later than 6 months after the event, unless there are statutory retention obligations or you have given us your consent for further processing.

f. Third country transfer
Processing also takes place outside the European Union (EU) or the European Economic Area (EEA). Depending on the provider of the webinar software, this provider may be located in a so-called unsafe third country. As a result, this provider had to guarantee us compliance with an adequate level of protection within the meaning of Art. 44 et seq. GDPR. This adequate level of protection is guaranteed by the use of the so-called EU standard contractual clauses.

g. Automated decision making and profiling
As a responsible company, we do not use automatic decision-making or profiling for this data processing.

§17 Chatbot

We also use the chatbot software SAP Conversational AI. The service provider is SAP Deutschland SE & CO. KG, Hasso-Plattner-Ring 7, 69190 Walldorf, Germany.

We process your personal data in order to provide you with the service of our chatbot. In the chatbot, apsolut answers users' frequently asked questions about technologies in the areas of Conversational Artificial Intelligence (CAI) and Robotic Process Automation (RPA).

The data processing is based on your express consent pursuant to Art. Art. 6 para. 1 lit a GDPR. Your personal data will only be stored by us for as long as is necessary to achieve the purposes for which this personal data was collected or until you have withdrawn your consent.

Your data will be stored on servers of SAP Deutschland SE & CO. KG in Germany.
However, as SAP is fundamentally a US company, data transfer to the USA cannot be completely ruled out. SAP uses so-called standard contractual clauses (= Art. 46. para. 2 and 3 GDPR) as the basis for data processing for recipients based in third countries or for a transfer of data there. Standard Contractual Clauses (SCC) are template contracts provided by the EU Commission and are intended to ensure that your data comply with European data protection standards even if they are transferred to third countries (such as the USA) and stored there. Through these clauses, SAP is bound to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA.

For more information on SAP's data processing and standard contractual clauses, please visit https://www.sap.com/documents/2021/06/84516981-e97d-0010-bca6-c68f7e60039b.html.

To learn more about the data processed through the use of SAP Conversational AI, please see the Privacy Policy at https://www.sap.com/about/legal/privacy.html.

§18 Processing of your data in the context of automated decision-making / profiling

In principle, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. In particular, these decisions may not regularly be based on special categories of personal data pursuant to Art. 9 (1) GDPR. We do not use any corresponding decision-making processes within the scope of our website and the associated data processing.

§19 WHISTLEBLOWER MESSAGE AND CASE LOGIN

This information is relevant for whistleblowers who have not opted for anonymous reporting and for persons concerned who are named in the report.

a) Type and purpose of processing
Some personal data may be collected during the whistleblower report and the case login. If the whistleblower has not opted for an anonymous report, their personal data will be used to process the case. The personal data of a data subject contained in the whistleblower report may also be processed and used to clarify and process the facts of the case. If the whistleblower has submitted a report, they can log in via the case login with a case number and password.

b) Legal basis
The portal is provided and the case is processed on the basis of a legal obligation (Art. 6 para. 1 lit. c GDPR) and within the scope of our legitimate interest (Art. 6 para. 1 lit. f GDPR). The processing of the referring person's personal data is based on voluntary consent (Art. 6 para. 1 lit. a GDPR).

c) Data categories
Whistleblower: Whistleblower: e-mail address, telephone number, first name, surname, your concern, possibly other data that the whistleblower sends us unsolicited

Persons concerned: The information may vary depending on the whistleblower report. Usually at least name details.

d) Source of the data
Whistleblower

e) Recipient
The recipients of the data are the Whistleblower Ombudsman Office {external/internal} and BKP Compliant GmbH (https://www.whistleblowing-compliant.eu/) and Proof Point development GmbH (https://www.conida.com) as processors.

f) Storage periods
Data will only be processed in this context for as long as the relevant purpose exists. It will then be deleted, provided there are no statutory retention obligations to the contrary.

g) Legal / contractual requirement
The provision of the whistleblower's personal data is voluntary.

h) Transfer to third countries
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).

i) Automated decision-making and profiling
As a responsible company, we do not use automated decision-making or profiling for this data processing.

§20 Use of New Relic

Our website uses the monitoring tool New Relic, a service of New Relic, Inc, 188 Spear Street, Suite 1000 San Francisco, CA 94105, USA. New Relic enables us to monitor and analyse the performance and availability of our website in order to offer you the best possible user experience.

What data is collected?

New Relic collects information about the use of our website, including:
- IP address
- Browser type and version
- operating system
- Referrer URL (the previously visited page)
- Host name of the accessing computer
- Time of the server request

This data is usually transferred to a New Relic server in the USA and stored there.

Purpose of data processing

Data is collected and processed for the purpose of monitoring and improving the performance of our website. This enables us to identify and rectify any problems in order to optimise the availability and speed of our website.

Legal basis

The legal basis for the use of New Relic is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke this consent at any time with effect for the future.

Data transfer to the USA

The transfer of data to New Relic's servers in the USA takes place on the basis of New Relic's registration under the data protection agreement between the EU and the USA in order to ensure an adequate level of data protection.

Revocation of consent

You have the right to withdraw your consent to the processing of your personal data at any time. To do this, you can make the appropriate settings in your browser to prevent the collection and processing of data by New Relic or revoke your consent via our cookie banner.

Further information on data protection at New Relic can be found in New Relic's privacy policy at https://newrelic.com/termsandconditions/privacy.

§21 Use of Cloudflare

Our website uses the Cloudflare Content Delivery Network (CDN), a service provided by Cloudflare, Inc, 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare ensures faster and more secure delivery of our website by distributing content via globally distributed servers.

What data is collected?

When using Cloudflare, various information is collected and processed, including:

-    IP address of the requesting device
-    System configuration information
-    Information about the data traffic between your device and our website (e.g. which pages are accessed)
-    Aggregated data on the performance and use of our website

This data is usually transferred to Cloudflare servers in various countries, including the USA, and stored there.

Purpose of data processing

Cloudflare processes the data for the following purposes:

-    Improving the loading times and availability of our website
-    Protecting our website from attacks and unauthorised access (e.g. DDoS attacks)
-    Optimising the general performance and security of the website

Legal basis

The legal basis for the use of Cloudflare is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure and efficient provision and protection of our website.

Data transfer to the USA

The transfer of data to Cloudflare's servers in the USA takes place on the basis of Cloudflare's registration under the data protection agreement between the EU and the USA in order to ensure an adequate level of data protection.

Revocation of consent

You have the right to object to the processing of your personal data. To do this, you can make the appropriate settings in your browser or block the use of Cloudflare using suitable browser add-ons. Please note, however, that this may impair the functionality and performance of our website.

Further information on data protection at Cloudflare can be found in Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/.