Jointly responsible under Article 26 GDPR

The following companies are jointly responsible under Article 26 GDPR

Hapeko Hanseatisches Personalkontor GmbH
Kleine Johannisstraße 10 · 20457 Hamburg
Fon +49 40. 822 99 11 80 · info@hapeko.de

Hanseatisches Personalkontor Baden-Württemberg GmbH
Riedheimer Str. 3 · 88677 Markdorf / Bodensee
Fon +49 7544. 95 31 70 · info@hapeko.de

Hanseatisches Personalkontor Bayern GmbH
Südliche Auffahrtsallee 29 · 80639 München
Fon +49 89. 954 70 96-10 · info@hapeko.de

Hanseatisches Personalkontor Nordwest GmbH
Herrenteichstraße 5 · 49074 Osnabrück
Fon +49 541. 58 05 78-40 · info@hapeko.de

Hanseatisches Personalkontor Bremen GmbH
Blumenthalstr. 8 · 28209 Bremen
Fon +49 421. 200 95 60 · info@hapeko.de

Hanseatisches Personalkontor Hannover & Kassel GmbH
Georgstr. 12 · 30159 Hannover
Fon +49 511. 763 50 68-0 · info@hapeko.de

HAPEKO Österreich GmbH
Max-Ott-Platz 6 A-5020 Salzburg
Fon +43 662 872 855 salzburg@hapeko.at

The above specified companies operate as jointly responsible parties in the range of HAPEKO Executive Consultants Deutschland respectively Executive Consultants Austria. They are independent companies that have joined forces under the name HAPEKO to become jointly active as executive consultants.

The companies are jointly responsible for the operation of the website (www.hapeko.de and www.hapeko.at) under data protection laws and take the decisions required to this end jointly. They have assigned the operation of the website to a contract processor. The information obligation under Article 13 GDPR for the collection of personal data in connection with the use of this website and the application documents submitted via it is carried out by Hapeko Hanseatisches Personalkontor GmbH. You can reach it via the above listed contact details and via the below-mentioned data protection law contact person.

If you apply via the website for an advertised vacancy, your application and your personal data are stored in a database. The database is operated jointly by the responsible parties to pursue common objectives. Access to the applications received for the vacancy is granted to the persons responsible who deal with processing the vacancy or must otherwise have knowledge for the purposes of further processing the application. An unsolicited application submitted via the website is accessible for each employee of the parties in charge who deals with the processing of such applications so that it can be verified in depth whether one of the parties in charge wishes to consider this application for the vacancy of a customer.

If personal data is not collected via this website, the party in charge of the collection is responsible for the fulfilment of the information obligations under articles 13, 14 GDPR.

If you wish to use the rights to which you are entitled under articles 15 seqq. GDPR (see at the end of the document), your central contact is Hapeko Hanseatisches Personalkontor GmbH. To this end, please contact the company by post via the management or by email at datenschutz@hapeko.de. Regardless of this, you may assert your rights within the framework of the GDPR and against each individual person in charge.

Contact details of the data protection officer
You can reach our data protection officer as follows:

Mauss Datenschutz
Neuer Wall 10
20354 Hamburg
datenschutz@datenschutzbeauftragter-hamburg.de

When we process personal data
We process personal data that you send us actively with your entries. Furthermore, we process personal data in an automatic manner on the basis of the use of our website. In the following cases, in particular, your personal data may be processed:

- Visit to our website;

- Creation of a profile;

- Application for a vacancy;

- Registration for an email newsletter;

- Initiation of contact with us;

- Analysis of who visits our website for what reasons and how it is used;

- Defence against attacks on the technical infrastructure;

For details, please see the explanations below.

Visit to our website
If you call up our website, the company tasked by us with the operation of the website processes and stores in addition to technical information on the end device used by you (operating system, screen resolution and other, non-personal features) as well as the browser (version, language settings), in particular the public IP address of the computer, with which you visit our website, including the date and time of access. The IP address is a unique numerical address under which your end device sends or retrieves data to and from the internet. We or our service provider are generally not aware of who is behind the IP address, unless you provide us with data during the use of our website that enables us to identify you.

Our service provider uses the processed, not individually-related data for statistical purposes so that we can understand what end devices are used with what settings to visit our website in order to optimise them for you, if applicable. These statistics do not contain any personal data. The legal basis for the creation of the statistics is Article 6 (1) (f) GDPR.

The IP address is also used to allow you to technically retrieve and use our website as well as to identify and defend it from attacks against our service provider or our website. Unfortunately, attacks repeatedly occur to inflict damage on the operators of websites or their users (e.g. prevent access to the website, spy on data, and disseminate malware (e.g. viruses) or other unlawful purposes). Such attacks would affect the intended function of the data centre of the company tasked by us, the use of our website or its function as well as the security of the users of our website. The processing of the IP addresses including the time of the access are carried out to defend against such attacks. With this processing, we aim to protect the legitimate interest to ensure the function of our website and to defend against unlawful attacks against us and the visitors to our website through our service provider. The legal basis for the processing is Article 6(1) (f) GDPR.

The stored IP data is (by anonymisation) deleted if they are no longer required for the identification or defence of an attack.

Application for a specific job opening
We advertise vacancies on behalf of the relevant client who wishes to fill the corresponding position and carry out parts of the application procedure. The services to be provided by us include, for instance, viewing application documents, conducting interviews with applicants, performing suitability tests as well as preselecting applicants who we propose to the relevant customer as suitable. For the applicants selected by us as suitable, we send the application documents to the relevant customer, if applicable supplemented by a statement. We inform you in advance to which company your application is to be sent so that you can object, if applicable. The company uses the data for further conducting the application procedure. The legal basis of the processing is Section 26 BDSG respectively the Austrian Labour Constition Law (ö ArbVG) in conjunction with § 11 Ö SDG and on a secondary level Article 6 (1) (f) GDPR. Our legitimate interest in the corresponding processing of your data on the basis of Article 6 (1) (f) GDPR is that you wish a corresponding processing of your data with your application. You are authorised to withdraw a submitted application at any time. In this event, your personal data is deleted within 5 working days in Hamburg.

If it is unfortunately not possible to consider your application, we will delete your application along with the submitted documents two months after our rejection if a further storage is not in our legitimate interest or that of our customer in order to prove the observance of legally imposed obligations within the framework of filling the vacancy, e.g. in accordance with the General Equal Treatment Act (AGG / ö GlBG). In this case, the deletion takes place when the reason no longer applies. The legal basis of the processing is Section 26 BDSG respectively the Austrian Labour Constition Law (ö ArbVG) in conjunction with § 11 Ö SDG and on a secondary level Article  6 (1) (f) GDPR.

Inclusion of your job seeking in our pool of applicants
With your application, we include your job seeking in our database and inform you about vacancies that may be of interest in accordance with your information. The legal basis for the processing is Article 6 (1) (a) GDPR. You may object to the corresponding use of your data at any time by requesting the deletion of your profile. In this event, we will delete your data within 5 working days in Hamburg, unless we are authorised to store the data for longer due to your participation in a specific job advert in accordance with the above explanations. If this is the case, the deletion of the data is guided by the above details.

With applications for highest level positions ( General Manager, CEO, CFO, CSO, board member or similar), HAPEKO reserves its rights to conduct a check of the applicant’s background by gaining information from Creditreform Hamburg von der Decken & Wall KG.

Contact queries
If you send us a message via the contact options provided, we will use your data provided to us for processing your query. The legal basis for this is our legitimate interest in replying to your request under Article 6(1)(f) GDPR. If your query serves to conclude an agreement with us, the further legal basis for the processing is Article 6(1) (b) GDPR. The data is deleted after completion of your query. If we are legally required to store your data for a longer period, the deletion will take place on expiry of the corresponding deadline.

Creation of a profile for candidates
If you create a profile, we will process the data provided by you to create and manage it and to enable your use of the service, which requires the creation of a profile. The legal basis for the processing is Article 6(1)(a) GDPR. If the creation of the candidate profile serves to conclude an agreement with us, the further legal basis for the processing is Article 6(1) (b) GDPR.

This data is stored until deletion of the profile. If we are legally obligated or authorised to store your data for longer, the deletion will take place after expiry of the storage obligation or the legal authorisation.

Newsletter
If you register for one of our email newsletters, until your revocation the data provided by you for creating and mailing the newsletter and for proof of the subscription to the newsletter is processed. The legal basis for the processing is Article 6(1)(a) GDPR. For our newsletter, we use the platform of an external service provider, to whom we, as a contract processor, pass on your personal data to the necessary degree.

For the mailing of the newsletter, you must click on the confirmation link in the verification email which is sent to you after your registration to prove your consent. By clicking on the corresponding link, we process the public IP address of the computer from which the link is called up together with the date and time of the click. We process this data to provide evidence that you have confirmed receipt of our email newsletter.

The legal basis for the processing is Article 6(1)(f) GDPR. Our legitimate interest in this is the fulfilment of the obligations of evidence imposed on us in relation to the subscription made by you.

You can withdraw your consent at any time by unsubscribing from the newsletter. You can find the corresponding link at the end of each newsletter.

Your data will be deleted when you unsubscribe from the newsletter. We delete the data that we require as proof that you have agreed to receive the newsletter on expiry of the statute of limitations for corresponding evidence obligations.

YouTube

We have embedded YouTube videos in our website. YouTube is an offering of YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

The embedding of the YouTube videos in our portal is carried out solely on the basis of the “expanded data protection mode” of YouTube. According to YouTube, the company only stores information about visitors to the website if they click and play back the video. Additional information can be found at https://support.google.com/youtube/answer/171780?hl=de in the section Activate expanded data protection mode.

Playing back videos is associated with considerable data volumes, in particular if various visitors to the website view videos in parallel. Furthermore, the playing back of the videos is accelerated and thereby their playback quality improved if the playing back takes place from a server that is as close as possible to the visitor of the website. We cannot guarantee this ourselves due to the associated considerable technical work involved. We have embedded the videos using YouTube. The legal basis for the processing is Article 6(1) (f) GDPR.

GoogleMaps
For the visual illustration of where our company is located, we use a map of GoogleMaps, a service of Google LLC (“Google”), Amphitheatre Parkway, Mountain View, CA 94043, USA. The general data protection statement of Google applies here, which can be accessed at https://www.google.com/policies/privacy/. Our legitimate interest in the use of GoogleMaps is an aid for visitors to our website where they can find our company so that we are reached more easily. The legal basis for the processing is Article 6(1)(f) GDPR.

Google Webfonts

For the illustration of our website we use Google Webfonts. It is a collection of fonts provided by Google LLC („Google“), Amphitheatre Parkway, Mountain View, CA 94043, USA that is particularly used for websites. When the font used by our website is retrieved through your browser, the public IP address of the computer used by you is transferred to Google LLC („Google“), Amphitheatre Parkway, Mountain View, CA 94043, USA. The IP address is a unique numeric address that is used by this computer to send and receive data to and from the internet.

When visiting our website, your browser loads the fonts required to display the website as we intended. If your browser does not support Webfonts, the website is displayed in a standard font of your computer. Further information can be fount at https://developers.google.com/fonts/faq. The general data protection statement of Google applies here, which can be accessed at https://www.google.com/policies/privacy/. Our legitimate interest in the use of Google Webfonts is to ensure a consistent look of our website and therefore, ensure its functionality on all end devices. The legal basis for the processing is Article 6(1)(f) GDPR.

Use of cookies

For the operation of our website we use cookies to guarantee the technical function of our website and to understand how visitors use our website.

A cookie is a small text file that is stored on your end device when you access our website via your browser. If you access our website at a later time, we can export these cookies again. Cookies are stored for different periods of time. You can set your browser at any time regarding what cookies it should accept; however, this may result in our website no longer working properly. Furthermore, you can delete cookies yourself at any time. If you do not do this, during storage, we can state for how long a cookie is to be stored on your computer. So-called session and permanent cookies must be distinguished here. Session cookies are deleted from your browser when you leave our website or close your browser. Permanent cookies are stored for the duration we state during storage.

We use cookies for the following purposes:

  • Technically required cookies, which are mandatory for using the functions of our website (e.g. identification whether you have logged in). Without these cookies, certain functions cannot be provided.
  • Functional cookies, which are used to technically carry out certain functions that you want to use.
  • Analysis cookies, which are used to analyse your user behaviour. For the details, please read the information on Google Analytics and SalesViewer.

Most browsers that our users use allow setting what cookies are to be stored and allow deleting (certain) cookies again. If you limit the storing of cookies on certain websites or do not permit cookies from third-party websites, this may result in our website no longer being fully useable. Here you can find information on how to adjust the cookie settings for the most common browsers:

Google Analytics

Within the framework of contract processing, we use GGF via Google Tag Manager Google Analytics, a service of Google LLC (“Google”), Amphitheatre Parkway, Mountain View, CA 94043, USA. Google uses a so-called cookie for this as the order processor. This is a small text file that is stored on your computer by your browser. With this cookie, Google receives information on what website was accessed by you and additionally, in particular the following information browser type / version, operating system used technical information about the operating system and the browser as well as the public IP address of the computer used by you. We use Google Analytics in such a way that your IP address is only used in an anonymised form. This anonymisation is carried out after information of Google in the European Union or a member state of the EEA. Only in exceptional cases should the full IP address be transferred to a server of Google in the US and only shortened there. According to Google, the anonymisation is carried out for the first time before the IP address is stored on a permanent data carrier. For the details, we refer to the data protection statement of Google, which can be accessed at https://support.google.com/analytics/answer/6004245?hl=de.

Google Analytics permits us in non-personal form to create usage statistics for our website as well as demographic data on the visitors and their user behaviour. Furthermore, statistics are created that help us better understand how our website is found in order to improve our search engine optimisation and our advertising measures. With this processing, we pursue the legitimate interest of being able to improve our website and our advertising means. The legal basis for the processing is Article 6(1)(f) GDPR.

At https://tools.google.com/dlpage/gaoptout?hl=de, you can find information on how you can object to the use of Google Analytics.

Google is a member of the PrivacyShield convention and has concluded an order processing agreement for Google Analytics with us.

The pseudonym data is deleted after 14 months.

SalesViewer

Within the framework of order processing, we use the SalesViewer technology of SalesViewer® GmbH, Nikolai Street. 2, 44866 Bochum, Germany. To this end, a javascript-based code is used that serves to collect company-related data and the corresponding use. With the use of the IP address of the end device with which you call up our website, it is determined whether the IP address is allocated to a company and if applicable, it is then stored. If this is not the case, no further processing of the IP address takes place, but the collected data is encrypted via a non-traceable single-route function (so-called hashing). The data is directly pseudonymised and not used to personally identify the visitor to the website.

SalesViewer does not allow us to understand in a personal form for what companies our website was visited. The legal basis for the processing is Article 6(1) (f) GDPR. We thereby pursue the legitimate interest to align with our marketing here and to thereby increase sales opportunities.

The data collection and storage can be objected to at any time with effect for the future at https://www.salesviewer.com/opt-out. In this process, an opt-out cookie is placed on your device for this website. If you delete the cookies in your browser, you must click on this link again.

Right to information
Under Article 15 GDPR, you have the right to demand confirmation from us whether data relating to you is processed by us. If this is the case, you have the right to be informed about this personal data and to further information specified under Article 15 GDPR.

Right to correction
Under Article 16 GDPR, you have the right to immediately request the correction of incorrect personal data relating to you. Taking into account the purposes of processing, you also have the right to request the completion of incomplete personal data, also by supplemental declaration.

Right to deletion
You have the right to request from us that personal data relating to you is deleted without delay. We are obligated to immediately delete personal data if the corresponding requirements of Article 17 GDPR are given. Due to the details, we refer to Article 17 GDPR.

Right to restriction to processing
According to Article 18 GDPR, under certain circumstances you have the right to request the restriction of the processing of your personal data from us.

Right to data portability
Under Art 20 GDPR, you have the right to obtain the personal data you provided us with in a structured, common and machine-readable form and you have the right to send this data to another person in charge without obstruction if the processing is based on approval under Article 6(1)(a) GDPR or Article 9(2)(a) GDPR that is based on an agreement in accordance with Article 6(1)(b) GDPR and the processing takes place with the use of automatic procedures.

Right of objection
Under Article 21 GDPR, you have the right to file an objection to the processing of personal data relating to you which is carried out on the basis of Article 6(1)(e or f) GDPR. This also applies for any profiling based on these provisions.

If we process your personal data to conduct direct advertising, you have the right, at any time, to file an objection against the processing of personal data relating to you for the purposes of such advertising- This also applies for the profiling insofar as it is linked to such direct advertising.

If you wish to use a right to which you are entitled, please contact us as the unit in charge at the above contact details or use one of the other types offered by us and send us such notification. If you have any questions, please contact us.

Existence of a right of complaint with the supervisory authority
Under Article 77 GDPR, you have the right to complain with the supervisory authority, notwithstanding another administrative law or court remedy. This right exists, in particular, in the member state of your location, your place of work or the place of the alleged violation if you are of the opinion that the processing of the personal data relating to you violates the GDPR.

Datenschutz