The following privacy policy is intended to inform you about the types of your personal data (hereinafter also referred to briefly as “data”) that we process, for what purposes, and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offering”).
The terms used are not gender-specific.
Controller
The controller responsible for data processing on this website is:
HR Metrics Consulting GmbH
Managing Director Christian Fritz
Ellen-Gottlieb-Straße 4
79106 Freiburg
Phone: +49 157 321 3112 7
Email: info@hr-metrics.de
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g., names, email addresses, etc.).
Relevant Legal Bases
Below we share the legal bases of the General Data Protection Regulation (GDPR) on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or establishment. Should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.
Consent (Art. 6(1)(a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Legal obligation (Art. 6(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
Legitimate interests (Art. 6(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
Security Measures
In accordance with legal requirements and taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
The measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data as well as access to, input of, disclosure of, ensuring availability of, and segregation of data. Furthermore, we have established procedures to ensure the exercise of data subject rights, deletion of data, and responses to data threats.
Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software, and procedures in accordance with the principle of data protection through technology design and through data protection-friendly default settings.
SSL encryption (https): To protect your data transmitted via our online offering, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.
Transmission and Disclosure of Personal Data
In the course of our processing of personal data, it may occur that the data is transmitted to other entities, companies, legally independent organizational units, or persons, or that it is disclosed to them. Recipients of this data may include, for example, payment institutions in the context of payment transactions, service providers commissioned with IT tasks, or providers of services and content that are integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.
Data Processing in Third Countries
If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if processing takes place in the context of using third-party services or disclosing or transmitting data to other persons, entities, or companies, this is done only in accordance with legal requirements.
Subject to express consent or contractually or legally required transmission, we process or have the data processed only in third countries with a recognized level of data protection or on the basis of special guarantees, such as contractual obligations through so-called standard contractual clauses of the EU Commission, the existence of certifications, or binding internal data protection regulations (Art. 44 to 49 GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).
Use of Cookies
Cookies are text files that contain data from visited websites or domains and are stored by a browser on the user’s computer. A cookie primarily serves to store information about a user during or after their visit within an online offering. Stored information may include, for example, language settings on a website, login status, a shopping cart, or the point at which a video was watched. The term cookies also includes other technologies that perform the same functions as cookies (e.g., when user information is stored using pseudonymous online identifiers, also referred to as “user IDs”).
The following cookie types and functions are distinguished:
Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user leaves an online offering and closes their browser.
Permanent cookies: Permanent cookies remain stored even after the browser is closed. For example, the login status can be saved or preferred content can be displayed directly when the user revisits a website. Likewise, the interests of users, which are used for reach measurement or marketing purposes, can be stored in such a cookie.
First-party cookies: First-party cookies are set by us ourselves.
Third-party cookies: Third-party cookies are mainly used by advertisers (so-called third parties) to process user information.
Necessary (also: essential or strictly necessary) cookies: Cookies may be strictly necessary for the operation of a website (e.g., to store logins or other user inputs or for security reasons).
Statistics, marketing, and personalization cookies: Furthermore, cookies are generally also used in the context of reach measurement and when a user’s interests or behavior (e.g., viewing certain content, using functions, etc.) are stored in a user profile on individual websites. Such profiles are used to show users, for example, content that corresponds to their potential interests. This process is also referred to as “tracking,” i.e., tracking the potential interests of users. Insofar as we use cookies or “tracking” technologies, we will inform you separately in our privacy policy or in the context of obtaining consent.
To manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents, we use the “Real Cookie Banner” consent tool. Details on how “Real Cookie Banner” works can be found at https://devowl.io/de/rcb/datenverarbeitung/.
The legal bases for the processing of personal data in this context are Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.
The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.
General information on withdrawal and objection (opt-out): Depending on whether the processing is based on consent or legal permission, you have the option at any time to withdraw consent given or to object to the processing of your data by cookie technologies (collectively referred to as “opt-out”). You can initially declare your objection by means of your browser settings, for example, by deactivating the use of cookies (which may also limit the functionality of our online offering). An objection to the use of cookies for online marketing purposes can also be declared by means of a variety of services, especially in the case of tracking, via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/. In addition, you can receive further objection notices in the context of the information on the service providers and cookies used.
Processing of Personal Data and Purposes of Processing
Contractual and business services: We process data of our contractual and business partners, e.g., customers and prospects (collectively referred to as “contractual partners”) in the context of contractual and comparable legal relationships as well as associated measures and in the context of communication with the contractual partners (or pre-contractually), e.g., to respond to inquiries.
We process this data to fulfill our contractual obligations, to safeguard our rights, and for the purposes of the administrative tasks associated with this information as well as business organization. We disclose the data of contractual partners to third parties only to the extent required for the aforementioned purposes or to fulfill legal obligations or with the consent of the contractual partners (e.g., to participating telecommunications, transport, and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). Contractual partners will be informed about further forms of processing, e.g., for marketing purposes, within this privacy policy.
We inform contractual partners which data is required for the aforementioned purposes before or during data collection, e.g., in online forms, through special marking (e.g., colors) or symbols (e.g., asterisks, etc.), or personally.
We delete the data after the expiry of statutory warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account, e.g., as long as it must be retained for legal reasons of archiving (e.g., for tax purposes generally 10 years). We delete data disclosed to us by the contractual partner in the context of an order in accordance with the specifications of the order, generally after the end of the order.
Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.
Contact
When contacting us (e.g., via contact form, email, telephone, or via social media), the information of the inquiring persons is processed to the extent necessary to respond to the contact inquiries and any requested measures.
The response to contact inquiries in the context of contractual or pre-contractual relationships is carried out to fulfill our contractual obligations or to respond to (pre-)contractual inquiries and otherwise on the basis of legitimate interests in responding to the inquiries.
Provision of the Online Offering and Web Hosting
In order to provide our online offering securely and efficiently, we use the services of one or more web hosting providers, from whose servers (or servers managed by them) the online offering can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space, and database services as well as security services and technical maintenance services.
The data processed in the context of providing the hosting offering may include all information concerning the users of our online offering that arises in the context of use and communication. This regularly includes the IP address, which is necessary to deliver the content of online offerings to browsers, and all inputs made within our online offering or from websites.
Collection of access data and log files: We ourselves (or our web hosting provider) collect data on every access to the server (so-called server log files). The server log files may include the address and name of the web pages and files accessed, date and time of access, data volumes transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), and generally IP addresses and the requesting provider.
The server log files can be used, on the one hand, for security purposes, e.g., to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure the utilization of the servers and their stability.
Services and service providers used:
Strato AG
Otto-Ostrowski-Straße 7
10249 Berlin
Website: https://www.strato.de
Privacy policy: https://www.strato.de/datenschutz/
Presences on Social Networks
We maintain online presences within social networks and process data of users in this context in order to communicate with users active there or to offer information about us.
We point out that user data may be processed outside the territory of the European Union. This may result in risks for users because, for example, the enforcement of users’ rights could be made more difficult. With regard to US providers that are certified under the Privacy Shield or offer comparable guarantees of a secure level of data protection, we point out that they thereby commit to comply with the data protection standards of the EU.
Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, user profiles can be created based on usage behavior and the resulting interests of users. The user profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are generally stored on the users’ computers, in which the usage behavior and interests of the users are stored. Furthermore, data may also be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).
For a detailed description of the respective forms of processing and the opt-out options, we refer to the privacy policies and information provided by the operators of the respective networks.
Also in the case of requests for information and the assertion of data subject rights, we point out that these can be asserted most effectively with the providers. Only the providers have access to the users’ data and can take appropriate measures directly and provide information. Should you still need assistance, you can contact us.
Services and service providers used:
LinkedIn; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland;
Privacy policy: https://www.linkedin.com/legal/privacy-policy
Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
Planning, Organization, and Auxiliary Tools
We use services, platforms, and software of other providers (hereinafter referred to as “third-party providers”) for the purposes of organization, administration, planning, and provision of our services. When selecting third-party providers and their services, we comply with legal requirements.
In this context, personal data may be processed and stored on the servers of third-party providers. This may affect various data that we process in accordance with this privacy policy. This data may include, in particular, master data and contact data of users, data on transactions, contracts, other processes, and their content.
If users are referred to third-party providers or their software or platforms in the context of communication, business, or other relationships with us, the third-party providers may process usage data and metadata for security purposes, service optimization, or marketing purposes. We therefore ask that you observe the privacy notices of the respective third-party providers.
Services and service providers used:
Microsoft Teams: Software for video conferencing; Service provider: Microsoft Corporation, Redmond, WA 98052-6399, USA;
Website: https://www.microsoft.com;
Privacy policy: https://privacy.microsoft.com/de-de/privacystatement
Deletion of Data
The data processed by us will be deleted in accordance with legal requirements as soon as consent for processing is revoked or other permissions cease to apply (e.g., if the purpose of processing this data has ceased to apply or it is not required for the purpose).
If the data is not deleted because it is required for other and legally permissible purposes, its processing will be restricted to these purposes. That is, the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the assertion, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person.
Further information on the deletion of personal data may also be provided in the context of the individual privacy notices of this privacy policy.
Amendment and Update of the Privacy Policy
We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require your cooperation (e.g., consent) or other individual notification.
If we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time and please check the information before contacting us.
Rights of Data Subjects
You have the right:
1) pursuant to Art. 7(3) GDPR to revoke your consent once given to us at any time. This has the consequence that we may not continue the data processing based on this consent for the future;
2) pursuant to Art. 15 GDPR to request information about your personal data processed by us. In particular, you may request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, deletion, restriction of processing, or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected from us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;
3) pursuant to Art. 16 GDPR to request the immediate rectification of inaccurate or completion of your personal data stored by us;
4) pursuant to Art. 17 GDPR to request the deletion of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the assertion, exercise, or defense of legal claims;
5) pursuant to Art. 18 GDPR to request the restriction of the processing of your personal data, insofar as the accuracy of the data is contested by you, the processing is unlawful but you refuse its deletion and we no longer need the data, but you require it for the assertion, exercise, or defense of legal claims, or you have lodged an objection to the processing pursuant to Art. 21 GDPR;
6) pursuant to Art. 20 GDPR to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format or to request the transmission to another controller;
7) pursuant to Art. 21 GDPR the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6(1)(e) GDPR (data processing in the public interest) and Article 6(1)(f) GDPR (data processing on the basis of a balancing of interests); this also applies to profiling based on this provision pursuant to Article 4(4) GDPR. If you lodge an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defense of legal claims.
If your objection is directed against processing of data for the purpose of direct marketing, we will cease processing immediately. In this case, the indication of a particular situation is not required. This also applies to profiling insofar as it is related to such direct marketing. If you wish to exercise your right to object, an email to info@hr-metrics.de is sufficient.
8) pursuant to Art. 77 GDPR to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters for this purpose.
Amendment and Update of this Privacy Policy
We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require your cooperation (e.g., consent) or other individual notification.
If we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time and please check the information before contacting us.