Note: The data protection information on the use of »Microsoft Teams« can be found separately on this page.
We appreciate your interest in our company and your visit to our website.
With this privacy notice we would like to inform you in a clear, transparent and concise manner about the nature, scope and purposes of the personal data we collect, use and process, and to explain your rights as a data subject.
We process your personal data exclusively within the framework of the statutory data protection provisions. Your privacy is important to us. We treat the data protection and data security of our clients and partners with confidence in accordance with our motto “Trusted Advice”.
If you have further questions about data protection at DextraData, you are welcome to contact our data protection officer at datenschutz@dextradata.com or via the contact details given at the end of this privacy notice.
Controller
DextraData GmbH
Girardetstraße 4
45131 Essen
Germany
Tel.: +49 201 95 975 0
E-Mail: info@dextradata.com
Website: https://www.dextradata.com
Represented by the management: Shayan Faghfouri
Defined terms
The terms used in this privacy notice have the following meanings in accordance with the EU General Data Protection Regulation (EU GDPR or GDPR).
“personal data”: All information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more special characteristics which express the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
“processing”: Any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
“restriction of processing”: The marking of stored personal data with the aim of limiting their future processing;
“pseudonymisation”: The processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
“controller”: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
“processor”: A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
“recipient”: A natural or legal person, public authority, agency or other body to which personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry under Union or Member State law shall not be regarded as recipients; the processing of those data by such authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
“third party”: A natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process the personal data;
“consent” of the data subject: Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
Your rights as a data subject
You may exercise the following rights at any time via the contact details of our data protection officer given above:
- Access to the personal data we hold about you and information about their processing (Art. 15 GDPR),
- Rectification of inaccurate personal data (Art. 16 GDPR),
- Erasure of your personal data held by us (Art. 17 GDPR),
- Restriction of processing where we are not yet able to erase your data due to legal obligations (Art. 18 GDPR),
- Objection to the processing of your personal data by us (Art. 21 GDPR), and
- Data portability, where you have consented to the processing or have entered into a contract with us (Art. 20 GDPR).
When asserting the right to access as well as erasure, the restrictions of §§ 33, 34 BDSG-neu must be taken into account. If you have given us consent, you may withdraw it at any time with effect for the future. To make contact in this regard, please use the contact details provided at the end of this privacy notice. You may at any time lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR in conjunction with § 19 BDSG-neu, e.g. the supervisory authority of the federal state of your residence or the supervisory authority responsible for us as the controller:
North Rhine-Westphalia
P.O. Box 20 04 44
40102 Düsseldorf
Kavalleriestraße 2-4
40213 Düsseldorf
Phone: +49 211 384240
E-Mail: poststelle[at]ldi.nrw[dot]de
Homepage: https://www.ldi.nrw.de
A list of all supervisory authorities (for the non-public sector) with addresses can be found at: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
Data categories
We have designed the development of the website to collect as little data from you as possible. However, certain processing purposes require the provision of specific personal data, e.g. in the context of newsletter or event registration, contacting us via the contact form or by e‑mail for the initiation of a contract up to contract conclusion. We take care to process your data only in accordance with a legal basis or your consent. We comply with the provisions of the General Data Protection Regulation (GDPR) in force since 25 May 2018 and the respective national data protection provisions or other more specific laws. We process the following categories of personal data:
| Data categories | Purpose of processing | Legal basis | Storage period |
| Server log data: IP address, website usage data (log data on website access and file retrievals, e.g. name of the retrieved file, date and time of retrieval, volume of data transferred) and device information (e.g. operating system, browser type and version) | Network communication, functionality and security of the website, detection and resolution of malfunctions and errors | Art. 6(1)(1)(f) GDPR – legitimate interest in providing our website efficiently and securely | 7 days. If further retention is required for evidentiary purposes, deletion takes place once the incident has been finally clarified |
| Consent data: your selection in the cookie banner as well as the time and version of your consent (stored in your browser's local storage, key “dd-cookie-consent”) | Consent management: documenting and honouring your cookie decision, hiding the banner on repeat visits | Art. 6(1)(1)(c) GDPR (accountability) in conjunction with Section 25(2)(2) TDDDG (technically necessary storage) | Until deleted by you or until the consent version changes |
| Contact form (HubSpot): name, e-mail address, company and phone number where provided, information on your request as well as technical form submission data | Processing and answering your enquiry, sending information or quotations on request, initiation and, where applicable, conclusion of a contract | Art. 6(1)(1)(b) and (f) GDPR; the embedded form is only loaded after your consent (Art. 6(1)(1)(a) GDPR, Section 25(1) TDDDG) | Max. 1 year. If a contract is concluded: storage until the end of the contractual relationship and expiry of statutory retention periods |
| Analytics data (Google Analytics 4): IP address (truncated), cookie/usage data such as pages viewed, time on page, referrer, device and browser information | Reach measurement, website analysis and optimisation | Art. 6(1)(1)(a) GDPR, Section 25(1) TDDDG – loading and processing exclusively after your consent in the cookie banner | 14 months from the last event; cookies can be deleted at any time via the cookie banner or your browser settings |
| Contact by e-mail or telephone: name, contact details, content of your message | Handling your request, initiation and, where applicable, conclusion of a contract | Art. 6(1)(1)(b) and (f) GDPR | Until your request has been dealt with, thereafter within the scope of statutory retention periods |
| Application data: name, contact details, qualification documents and further information provided by you (submitted via our external applicant portal Personio) | Handling the application procedure; if a contract is concluded: administration of the employment relationship | Art. 6(1)(1)(b) GDPR, Section 26 BDSG | 6 months after completion of the procedure (e.g. to meet evidentiary obligations under the AGG); if a contract is concluded, until the end of the employment relationship and expiry of statutory retention periods |
Recipients of data
Personal data are disclosed for the purpose of providing our website and delivering our services in particular to the following recipients: hosting providers, data centre operators, e‑mail marketing and tracking service providers, partners and manufacturers. Necessary data protection contracts have been concluded with all service providers. Other recipients are authorities such as tax offices and social security agencies within the scope of our legal reporting obligations (e.g. for the execution of employment relationships). In addition, credit reference agencies in the context of ordering our products.
Within our company we ensure that only those persons receive your data who need it to fulfil contractual and legal obligations. All employees are obliged to comply with data protection regulations. Further information can be found below.
Further information on data processing
| Is there a legal obligation to provide the personal data? | No |
| Is there a contractual necessity to provide the personal data? | No |
| What are the possible consequences of not providing the data? | Applies to contact and form fields: If you do not provide your data, the desired contact, the sending of information material, event registration and/or newsletter registration cannot take place. |
| Is automated decision‑making carried out? | No |
| From which source do the personal data originate (if not collected from the data subject)? | No data about you are obtained from third parties in the course of using our website. |
Outside the website
| Is there a legal obligation to provide the personal data? | No |
| Is there a contractual necessity to provide the personal data? | Yes – in the case of contract initiation (customer, partner, employee) and/or contract conclusion. |
| What are the possible consequences of not providing the data? | If you do not provide your data, the desired contract initiation (e.g. sending an offer, arranging a job interview) and a contract conclusion cannot take place. |
| Is automated decision‑making carried out? | No |
| From which source do the personal data originate (if not collected from the data subject)? | In the course of contract initiation or during an ongoing contractual relationship we generally receive personal data from you. Exceptionally, in certain constellations your personal data are also collected from other sources. In certain cases we receive your personal data from our partners in order to be able to make you an offer on the basis of Art. 6(1)(1)(b) GDPR. For ad‑hoc enquiries of relevant information, we obtain data from credit reference agencies (Crefo, Schufa), in particular regarding creditworthiness and credit behaviour. |
Collection of general information when visiting our website
When you access our website, i.e. if you do not register or otherwise transmit information, information of a general nature is automatically collected. This information (server log files) includes, for example, the type of web browser, the operating system used, the domain name of your internet service provider, your IP address and similar.
They are processed in particular for the following purposes:
- Ensuring a problem‑free connection to the website,
- Ensuring smooth use of our website,
- Evaluation of system security and stability, and
- for further administrative purposes.
We do not use your data to draw conclusions about you as an individual. Information of this kind is possibly evaluated by us on a statistical basis in order to optimise our internet presence and the technology behind it.
Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.
The provision of the aforementioned personal data via our website is neither legally nor contractually required. Without the IP address, however, the service and the functionality of our website cannot be guaranteed. In addition, individual services and features may not be available or may be limited. For this reason, objection is not possible.
Form fields/TLS encryption
Unfortunately, the transmission of information via the Internet is never completely secure; therefore we cannot guarantee the security of data transmitted to our website over the Internet.
However, we protect our website by technical and organisational measures against loss, destruction, access, alteration or dissemination of your data by unauthorised persons.
In particular, your personal data are transmitted to us in encrypted form. We use the encoding systems SSL/TLS (Secure Sockets Layer/Transport Layer Security). You can recognise an encrypted connection by the "https://" address line of your browser and by the padlock symbol in the browser bar. This means that data you transmit via this website cannot be read by third parties. Our security measures are continuously improved in line with technological developments.
Data collection when providing content via our website
When registering to use our personalised services (e.g. downloads), certain personal data are collected, such as name, address, contact and communication details (e.g. telephone number and email address). After registration you can access the specific content for which you registered.
The provision of your personal data is voluntary and is based solely on your consent. Without providing your personal data we cannot grant you access to the content and services we offer.
The processing of the data entered during registration is based on your consent (Art. 6(1)(a) GDPR).
Data will only be processed in this context for as long as the relevant consent exists. Afterwards they will be deleted, provided that no statutory retention obligations prevent this. For contact in this regard, please use the contact details given at the end of this privacy policy.
Contact
You can contact us via the contact form on our website. The personal data you submit will be stored in order to process your request and to contact you for the purpose of handling it.
Providing your personal data is voluntary. However, we can only process your request if you provide us with your name, your email address and the reason for your enquiry.
The processing of the data entered into the contact form is based on a legitimate interest (Art. 6(1)(f) GDPR).
If you contact us to request a quote, the processing of the data takes place for the performance of pre-contractual measures (Art. 6(1)(b) GDPR).
The data entered via the contact form will be deleted no later than 6 months after the request has been processed. If a contractual relationship is concluded, we are subject to the statutory retention periods under the HGB and will delete your data after these periods have expired.
You can also contact us by email. In this case too, we store the personal data you send to us in order to process your request and to contact you for the purpose of handling it. These data are likewise provided to us by you on a purely voluntary basis. The details for contacting us by email can be found in this privacy policy and in our imprint.
Cookies
Like many other websites, we also use so-called "cookies". Cookies are small text files that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our website.
This gives us certain data such as IP address, browser used and operating system.
Of course, you can generally view our website without cookies. Internet browsers are regularly set to accept cookies. In general, you can disable the use of cookies at any time via the settings of your browser. Please use the help functions of your Internet browser to find out how to change these settings. Please note that certain functions of our website may not work if you have disabled the use of cookies. On this website we use exclusively the cookies and cookie-like storage technologies listed below. Cookies in the "Marketing" category are only set after you have given your consent in the cookie banner.
| Provider | Name | Category | Function | Storage duration |
| DextraData (diese Website) | dd-cookie-consent | Necessary (Local Storage) | Stores your cookie consent or its rejection so that the banner does not appear again | Until deletion by you or until a change of the consent version |
| DextraData (diese Website) | dd-locale | Necessary (Session Storage) | Stores the language version you have selected (DE/EN) | End of the browser session |
| HubSpot (Kontaktformular) | __cf_bm | Marketing (third party, hsforms.com / hsforms.net) | Cloudflare bot management: distinguishing between human visitors and bots when loading the embedded HubSpot form | 30 minutes |
| HubSpot (Kontaktformular) | hubspotutk, __hstc, __hssrc, __hssc | Marketing (third party) | May be set when using or submitting the HubSpot form in order to associate your form request with a browser and detect multiple submissions | Session to 6 months |
| Google Analytics 4 | _ga, _ga_<ID> | Statistics/Marketing (third party) | Reach measurement and analysis of website use; only loaded and set after your consent | Up to 24 months (data deletion at Google after 14 months) |
Without your consent to the "Marketing" category the HubSpot form will not be loaded; in this case no third-party cookies will be set and no data will be transmitted to HubSpot. If you revoke your consent, the form will no longer be loaded; cookies already set by hsforms.com/hsforms.net will expire automatically and can be deleted at any time via your browser settings.
You can delete individual cookies or the entire cookie store via your browser settings. In addition, you can find information and instructions on how these cookies can be deleted or blocked in advance. Depending on your browser provider, the necessary information can be found at the links below:
- Mozilla Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox
- Microsoft Edge / Internet Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies
- Google Chrome: https://support.google.com/accounts/answer/61416?hl=en
- Opera: https://www.opera.com/help
- Safari: https://support.apple.com/en-us/guide/safari/sfri11471/mac
Website analysis
Google Analytics 4
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (https://marketingplatform.google.com/about/analytics/)
This website uses Google Analytics 4, a web analytics service provided by Google. Google Analytics uses cookies and similar technologies that allow an analysis of the use of this website (e.g. pages viewed, time on page, referrer, device and browser information).
The analytics script is only loaded after you have consented to the "Marketing/Statistics" category in the cookie banner. As long as no consent has been given, no Google scripts are loaded, no data is transmitted to Google and no analytics cookies are set. In addition, Google Consent Mode V2 is active with denied defaults.
IP anonymisation is enabled: your IP address is truncated by Google within the EU or the EEA. The legal basis is your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You may withdraw your consent at any time with effect for the future via the cookie banner or the cookie settings. A transfer of data to the USA cannot be excluded. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. By giving your consent you also consent, in awareness of the possible risks, to the processing of your data in the USA pursuant to Art. 49(1)(1)(a) GDPR. Data linked to cookies and user identifiers is deleted automatically after 14 months. Further information can be found in Google's privacy policy.
HubSpot forms (contact form)
HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland; parent company: HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA (https://www.hubspot.com/)
Our contact form is technically provided via HubSpot (hosted in the EU region eu1). When the form is loaded, a connection to HubSpot servers is established; your IP address, browser and device information as well as the form data you enter are processed.
The form is only loaded after your consent in the cookie banner. Without consent, no HubSpot scripts are loaded, no cookies are set and no data is transmitted. The legal basis for loading the form is Art. 6(1)(1)(a) GDPR in conjunction with Section 25(1) TDDDG; the subsequent handling of your enquiry is based on Art. 6(1)(1)(b) and (f) GDPR.
A data processing agreement including standard contractual clauses for any transfers to the USA is in place with HubSpot. Further information: https://legal.hubspot.com/privacy-policy
Hosting and server log data
Our website is hosted by a service provider with server locations in the EU. When the website is accessed, technically necessary access data (server log data) is processed; details can be found in the "Data categories" section and under "Collection of general information when visiting our website".
Services we do not use
We do not use any other analytics, advertising or tracking services on this website. In particular, we do not use Google Ads, Google Tag Manager, the LinkedIn Insight Tag, the XING pixel, Seismic, Google Maps, embedded YouTube videos or social media plug-ins. The fonts used are delivered locally from our own server; no connection is made to external font providers (e.g. Google Fonts, Adobe Fonts).
Links to our social media profiles are plain HTML links. Data is only transmitted to the respective network once you actively click the link.
Cookie settings and withdrawal
Social Media
We maintain so-called fan pages or accounts or channels on the networks listed below in order to provide you with information and offers within social networks and to offer you additional ways to contact us and to learn about our offers. Below we inform you about which data we or the respective social network process about you in connection with the access to and use of our fan pages/accounts.
Data we process about you
If you wish to contact us by messenger or via direct message through the respective social network, we will generally process your username through which you contact us and may store further data you provide to the extent necessary to handle/answer your request.
The legal basis is Art. 6(1)(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the controller).
(Static) usage data we receive from the social networks
We obtain statistics automatically provided via insights functionalities concerning our accounts. The statistics include, among other things, the total number of page views, likes, information on page activity and post interactions, reach, video views/plays and information on the proportion of men/women among our fans/followers.
The statistics contain only aggregated data that cannot be related to individual persons. They do not enable us to identify users.
Which data the social networks process about you
To view the contents of our fan pages or accounts you do not have to be a member of the respective social network and a user account for the respective social network is not required for this purpose.
Please note, however, that the social networks do collect and store data from website visitors without a user account when the respective social network is accessed (e.g. technical data to display the website to you) and use cookies and similar technologies, over which we have no influence. Details can be found in the privacy policies of the respective social network (see the corresponding links above).
If you wish to interact with the content on our fan pages/accounts, e.g. comment on, share or like our posts/contributions and/or contact us via messenger functions, prior registration with the respective social network and the provision of personal data is required.
We have no influence on the data processing carried out by the social networks in the context of your use. To our knowledge, your data are stored and processed by the social networks in particular in connection with the provision of the services of the respective social network, and also for the analysis of usage behaviour (using cookies, pixels/web beacons and similar technologies) based on which interest-based advertising is displayed both inside and outside the respective social network. It cannot be ruled out that your data may be stored by the social networks outside the EU/EEA and disclosed to third parties.
Information, among other things, on the exact scope and the purposes of the processing of your personal data, the retention/deletion period and policies on the use of cookies and similar technologies in the context of registration and use of the social networks can be found in the privacy policies/cookie policies of the social networks. There you will also find information on your rights and objection options.
Facebook Page
When visiting our Facebook page, Facebook, among other things, records your IP address as well as further information that is present in the form of cookies on your PC. This information is used to provide us, as operators of the Facebook pages, with statistical information about the use of the Facebook page. Further information on this is provided by Meta Platforms Ireland Limited at the following link:
https://facebook.com/help/pages/insights.
By means of the transmitted statistical information it is not possible for us to draw conclusions about individual users. We use these data only to address the interests of our users and to continually improve our online presence and ensure its quality. We collect your data via our fan page only in order to enable possible provision for communication and interaction with us. This collection usually includes your name, message contents, comment contents as well as profile information you have made “public”.
The processing of your personal data for the purposes set out above is based on our legitimate commercial and communicative interest in providing an information and communication channel pursuant to Art. 6(1)(1)(f) GDPR. If you as a user have given consent to the data processing to the respective provider of the social network, the legal basis for the processing extends to Art. 6(1)(a), Art. 7 GDPR.
Due to the fact that the actual data processing is carried out by the provider of the social network, our access to your data is limited. Only the provider of the social network is authorised to have full access to your data. For this reason only the provider can directly take corresponding measures to fulfil your user rights (request for information, deletion request, objection, etc.) and implement them. Asserting the corresponding rights is therefore most effective directly against the respective provider. We are jointly responsible with Meta Platforms Ireland Limited for the personal data content of the Facebook fan page. Data subject rights may be asserted against Meta Platforms Ireland Limited as well as against us.
Primary responsibility for the processing of insights data lies, in accordance with the GDPR, with Meta Platforms Ireland Limited. It is also responsible for fulfilling all obligations under the GDPR with regard to the processing of insights data. Meta Platforms Ireland Limited provides the essentials of the Pages Insights addendum to the data subjects. We do not make decisions regarding the processing of insights data and all further information required by Art. 13 GDPR, including the legal basis, the identity of the controller and the storage duration of cookies on user devices, is provided by the provider.
The Meta Platforms Ireland Limited Inc. has its headquarters in the USA. The Court of Justice of the European Union (CJEU) has determined that the USA does not provide a level of data protection equivalent to that of European data protection law (CJEU, 16 July 2020 – C-311/18 “Schrems II”, press release). There is in particular a risk that your data may be processed by US authorities for control and surveillance purposes and possibly without effective legal remedies (for example pursuant to Section 702 of the Foreign Intelligence Surveillance Act (FISA 702)). By accepting cookies from Facebook you simultaneously consent, being aware of the possible risks, pursuant to Art. 49(1)(1)(a) GDPR to your data being processed in the USA.
Further information can be found directly on Facebook (Page Controller Addendum with Meta): https://www.facebook.com/legal/terms/page_controller_addendum.
LinkedIn page
LinkedIn is a social network run by LinkedIn Inc., headquartered in Sunnyvale, California, USA, which enables the creation of private and professional profiles. Users can maintain existing contacts and make new ones. Companies can create profiles on which photos and other company information are uploaded. Other LinkedIn users have access to this information and can write their own articles and share that content with others.
The focus is on professional exchange about specialist topics with people who have the same professional interests. In addition, LinkedIn is frequently used by companies and other organisations to recruit staff and to present themselves as attractive employers.
Further information about LinkedIn can be found at: https://about.linkedin.com/
The LinkedIn Corporation is headquartered in the USA. The Court of Justice of the European Union (CJEU) found that the USA does not provide a level of data protection that is equivalent to European data protection law (CJEU, 16.7.2020 – C-311/18 “Schrems II”, press release). There is in particular a risk that your data may be processed by US authorities for control and surveillance purposes and possibly also without effective legal remedies (for example under Section 702 of the Foreign Intelligence Surveillance Act (FISA 702)). By accepting cookies from LinkedIn, you thereby consent, with knowledge of the possible risks in accordance with Art. 49(1)(1)(a) GDPR, to your data being processed in the USA.
Further information on the handling of user data by LinkedIn can be found at: https://www.linkedin.com/legal/privacy-policy
XING page
XING is a social network operated by XING SE, headquartered in Hamburg, Germany, which enables the creation of private and professional profiles. Users can maintain existing contacts and make new ones. Companies can create profiles on which photos and other company information are uploaded. Other XING users have access to this information and can write their own articles and share that content with others.
The focus is on professional exchange about specialist topics with people who have the same professional interests. In addition, XING is frequently used by companies and other organisations to recruit staff and to present themselves as attractive employers.
Further information about XING can be found at: https://corporate.xing.com/de/unternehmen/
Further information on data protection at XING can be found at: https://privacy.xing.com/de/datenschutzerklaerung.
Kununu
When communicating via the employer review platform kununu, DextraData GmbH uses the technical platform and services of kununu GmbH, Neutorgasse 4-8, Top 3.02, 1010 Vienna, Austria. Information about which data kununu processes and for which purposes can be found in kununu’s privacy policy: https://www.kununu.com/de/info/disclaimer.
DextraData GmbH may process data you enter on kununu, such as an employer review, by responding to it. The data you freely publish and distribute on kununu may therefore be included by us in our offering or on our kununu company page and thus made accessible to other visitors to that page.
The processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in communicating with you and other users via kununu and responding to your review. You have the right to information about the stored data, as well as the right to rectification, erasure, restriction of processing and data portability. You also have the right to lodge a complaint with the competent supervisory authority.
References and links
When calling up websites that are referred to on our website, information such as name, address, e-mail address, browser properties etc. may again be requested. This privacy policy does not govern the collection, disclosure or handling of personal data by third parties.
Third-party service providers may have divergent and their own provisions regarding the collection, processing and use of personal data. It is therefore recommended that you inform yourself on the third parties’ websites about their practices for handling personal data before entering personal data.
Transfer to third countries
| Recipient third country | Measures taken and appropriate safeguards | Purpose |
| Google Inc. / Google LLC 1600 Amphitheatre Parkway Mountain View, California 94043 USA | Data transfer subject to appropriate safeguards (Art. 46 GDPR) Derogations for specific cases (Art. 49 GDPR) | Website analysis and optimisation, marketing |
| Meta Platforms Inc. 1601 Willow Avenue, Menlo Park, California, 94025, USA | Data transfer subject to appropriate safeguards (Art. 46 GDPR) Derogations for specific cases (Art. 49 GDPR) | Website analysis and optimisation, marketing |
| LinkedIn Corporation 2029 Stierlin Court, Mountain View, California 94043, USA | Data transfer subject to appropriate safeguards (Art. 46 GDPR) Derogations for specific cases (Art. 49 GDPR) | Website analysis and optimisation, marketing |
Processing of customer and supplier data outside the website
Within the scope of a contractual relationship outside the website we process the personal data described above. Contracts are generally concluded with companies represented by their respective management, whose employees are our contacts. We generally receive your personal data from you in the context of contract initiation or during the ongoing contractual relationship.
Exceptionally, in certain constellations your personal data may also be obtained from other sources. These include occasion-related enquiries for relevant information from credit agencies (Creditreform, Schufa), in particular about the creditworthiness and payment behaviour of the companies with which we conclude contracts.
Even when processing your personal data outside the website, the provisions of the GDPR and other applicable legal provisions are always complied with.
Your personal data is processed exclusively for the purpose of carrying out pre-contractual measures (e.g. for the preparation of offers for products or services) and for fulfilling contractual obligations (e.g. for the provision of our service or for order/transaction/payment processing) (Art. 6(1)(1)(b) GDPR), or where there is a legal obligation to process (e.g. due to tax law requirements) (Art. 6(1)(1)(c) GDPR). For these purposes the personal data was originally collected.
A data-protection law permission may of course also be your consent to the data processing (Art. 6(1)(1)(a) GDPR). Prior to granting consent we inform you about the purpose of the data processing and about your right to withdraw consent pursuant to Art. 7(3) GDPR.
For the detection of criminal offences, personal data will only be processed under the conditions of Art. 10 GDPR.
As part of the necessary business processes, our specialist departments are partly supported by external service providers in fulfilling their tasks. The necessary data-protection contracts have always been and are concluded with all service providers.
These are in particular service companies such as parcel services and forwarding agents who undertake transport and shipping, as well as financial and consulting firms that assist in checking order-relevant data. In addition, in individual specialist areas we use specialised IT experts from manufacturers and partner companies who have the relevant product know-how. For project processing (registration, project notification, offer preparation, order processing) your data may be forwarded to the manufacturers of the offered or ordered products concerned. These may also be located in a third country outside the EU.
We pass on information about payment processing, to check payment behaviour and creditworthiness to credit, commercial and business credit agencies.
If necessary, processing of your personal data may also take place in the cloud in order to optimise existing processes (for example for more efficient communication and contract processing). For this purpose we have concluded the contracts required from a data protection point of view. If the cloud provider is located in a country outside the EU/EEA (third country), we take the data-protection-law-possible and necessary measures pursuant to Art. 44 ff. GDPR to establish the level of data protection in the respective third country. In doing so, we ensure by technical and organisational measures that only those persons receive your data who need it to fulfil contractual and legal obligations.
Further information on data processing and on your data subject rights can be found at the beginning of this privacy policy.
Marketing Purposes for Existing Customers
We are interested in maintaining our customer relationship with you and providing you with information and offers about our products and/or services. Accordingly, we process your data pursuant to Art. 6(1)(f) GDPR in order to send you corresponding information and offers by e‑mail. In addition, we will occasionally send you an e‑mail containing a link requesting your participation in customer satisfaction surveys of our media partners.
If you do not wish this, you may object at any time to the use of your personal data for the purposes of direct marketing; this also applies to profiling insofar as it is related to direct marketing. If you object, we will no longer process your data for this purpose.
For contact in this context, please use the contact details provided at the end of this privacy notice.
Further information on data processing and your data subject rights can be found at the beginning of this privacy notice.
Data Processing in the Application Process
If you submit an application to DextraData GmbH electronically, your details will be used exclusively for the purpose of processing your application. Please note that applications you send to DextraData GmbH by e‑mail are transmitted unencrypted. Accordingly, there is a risk that unauthorised persons may intercept and use this data.
We collect and process only the personal data you transmit to us as part of the application process. These are the details listed above under "Data categories".
Processing is carried out with due regard to and in accordance with the applicable General Data Protection Regulation (GDPR) and the BDSG-new, sector‑specific data protection standards in the course of the application process such as the Social Code, the Act to Regulate Data Protection and the Protection of Privacy in Telecommunications and Telemedia (TTDSG) and the Works Constitution Act.
We process your data, where necessary, to safeguard our legitimate interests or the legitimate interests of third parties. Examples include asserting legal claims and defending ourselves in legal disputes, measures for business management and development.
If you give your consent to the processing of personal data, for example to the transfer of such data to other potential companies, the lawfulness of the collection and processing of your personal data is based on the consent you have given us. This consent may be revoked at any time. The revocation takes effect for the future and cannot be made retroactively. If processing of the collected personal data is revoked, the purpose for which they were collected can no longer be fulfilled or implemented.
The data collected will be forwarded within our company to the responsible departments charged with processing the application and who need them to fulfil statutory obligations. Contract processors working with our company may also receive your data for the purposes described. These are typically companies in the area of IT services. At this point it should be noted that even when passing data on to third parties under the circumstances described, we observe and comply with data protection regulations.
Disclosure of your data takes place only on the basis of statutory provisions, the consent you have given us, or if we are authorised to provide such information. Recipients of data may include, for example, affiliated companies (application procedures for other advertised positions) for which you have given us your consent to transfer the data.
Processing and storage of your personal data takes place, as necessary, for the duration of the application process. After the purpose has been fulfilled, but no later than after 6 months, the data will be deleted. If storage of the data is no longer necessary for conducting the application process and there is no statutory retention period, or if we do not have a consent from you that establishes a longer retention period, the data will be deleted without delay.
A transfer of data to a third country, i.e. states outside the European Economic Area (EEA), generally does not take place. However, processing of your personal data may take place in the cloud in order to optimise existing processes (for example, for more efficient communication and handling of the application procedure). For this purpose we have concluded the contracts required from a data protection perspective. If the cloud provider is located in a country outside the EU/the EEA (a third country), we take the data‑protection measures possible and necessary pursuant to Art. 44 et seq. GDPR to establish an adequate level of data protection in the respective third country. In doing so, we ensure by technical and organisational measures that only those persons receive your data who require it to perform contractual and statutory obligations.
Under the statutory provisions of the GDPR and the BDSG-new, every data subject has the right to information about the processing of their personal data, the right to rectification, erasure and restriction of processing, the right to object to processing and the right to data portability. When exercising the right to information and the right to erasure, the limitations in Sections 33 and 34 BDSG-new must be taken into account. Furthermore, there is a right to lodge a complaint with the competent supervisory authority pursuant to Art. 77 GDPR in conjunction with Section 19 BDSG-new.
Further information on data processing and your data subject rights can be found at the beginning of this privacy notice.
Changes to Our Privacy Policy
We reserve the right to amend this privacy notice so that it always complies with current legal requirements or to reflect changes to our services in the privacy notice, for example when new services are introduced. The new privacy notice will apply upon your next visit.
Questions to the Data Protection Officer
If you have questions about data protection, please write to us by e‑mail at datenschutz@dextradata.com or contact the person responsible for data protection in our organisation by post:
Andreas Rübsam
DextraData GmbH
Girardetstr. 4
45131 Essen
Germany
Reporting a Security Incident or Cybersecurity Attack
Have you discovered a security vulnerability or incident? Please report it via our form.
Gender Disclaimer
For reasons of improved readability and easier comprehensibility, we use the masculine form commonly used in the German language in this privacy notice. This is intended to explicitly address all gender identities without evaluative distinction.
As of: 30.05.2022
We reserve the right to update the privacy notice at regular intervals.