Data protection at a glance
General information
The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data means any data that can be used to identify you personally. Detailed information on the topic of data protection can be found in our following data protection declaration.
1. Data collection on this website
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. The contact details can be found in the section “Information about the controller” in this data protection declaration.
How do we collect your data?
On the one hand, your data is collected when you provide it to us. This can be e.g. data that you enter into a contact form.
On the other hand, data is collected automatically or with your consent captured by our IT systems when you visit the website. This refers primarily to technical data (e.g. internet browser, operating system or time of page access). This data is collected automatically once you enter this website.
What do we use your data for?
Some of the data is collected to ensure that the website is provided error-free. Other data may be used to analyze your user behavior.
What rights do you have regarding your data?
At any time you have the right to receive information free of charge concerning the origin, recipient and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given your consent to data processing, you can revoke this consent at any time with future effect. You also have the right to request the restriction of processing your personal data in certain circumstances. Furthermore, you have the right to lodge a complaint with the responsible supervisory authority.
If you have any further questions hereto or about data protection, you can contact us at any time.
Analysis tools and third-party tools
When you visit this website, your browsing behavior can be statistically evaluated. This takes place primarily with so-called analysis programs.
Detailed information about these analysis programs can be found in the following data protection declaration.
2. Hosting and Content Delivery Networks (CDN)
External hosting
This website is hosted by an external service provider (host). The personal data collected on this website will be stored on the host’s servers. This data may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access and other data generated via a website.
The host is used for the purpose of fulfilling the contract for our potential and existing customers (Art. 6 Para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online platform by a professional provider (Art. 6 Para. 1 lit. f GDPR).
Our host will only process your data to the extent necessary to fulfil its service obligations and is obliged to follow our instructions regarding this data.
We use the following host:
Ideenmühle GmbH
Schlehenstrasse 14
90542 Eckental
Germany
3. General and mandatory information
Data protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations as well as this data protection declaration.
When you use this website, various personal data are collected. Personal data means all data that can be used to identify you personally. This data protection declaration explains which data we collect and what we use it for. It also explains how and for what purpose this occurs.
We would like to point out that data transmission on the Internet (e.g. when communicating via email) may have security gaps. Complete protection of data from access by third parties is not possible.
Information about the controller
The controller for data processing on this website is:
onysID GmbH
Theodor-Schmidt-Strasse 19
95448 Bayreuth
Germany
Telephone: +49 921 959 21 800
Email: info@onysID.com
The controller is the natural or legal person which, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, email addresses, etc.).
Storage period
Unless a more specific storage period is specified within this data protection declaration, your personal data will remain with us until the purpose for data processing no longer applies. If you make a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. tax or commercial law retention periods); In the latter case, the deletion will take place after these reasons no longer apply.
Note on data transfer to the USA
Our website includes, among others, tools from companies based in the USA. When these tools are active, your personal information may be shared with the respective companies’ US servers. We would like to point out that the USA is not a safe third country within the meaning of EU data protection law. US companies are obliged to hand over personal data to security authorities without you as the person concerned being able to take legal action against this. Therefore, it cannot be ruled out that US authorities (e.g. secret services) process, evaluate and permanently store your data on US servers for surveillance purposes. We have no influence on these processing activities.
Revocation of your consent to data processing
Many data processing operations are only possible with your explicit consent. You can revoke your consent you have already given at any time. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.
Right to object to data collection in particular cases and to direct marketing (Art. 21 GDPR)
IF THE DATA PROCESSING IS BASED ON ART. 6 (1), POINT (E) OR (F) OF THE GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, INCLUDING PROFILING BASED ON THOSE PROVISIONS. THE APPLICABLE LEGAL BASIS USED FOR PROCESSING CAN BE FOUND IN THIS DATA PROTECTION DECLARATION. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE LEGITIMATE REASONS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS OR THE PROCESSING IS FOR THE ASSERTION, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ARTICLE 21 (1) GDPR).
IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF PERSONAL DATA FOR THE PURPOSE OF SUCH ADVERTISING AT ANY TIME; THIS ALSO APPLIES TO PROFILING TO THE EXTENT IT IS CONNECTED WITH SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR THE PURPOSE OF DIRECT ADVERTISING (OBJECTION PURSUANT TO ARTICLE 21 (2) GDPR).
Right to lodge a complaint with the supervisory authority
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work or the place of the alleged infringement. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedies.
Right to data portability
You have the right to have your personal data that we process automatically based on your consent or in fulfillment of a contract handed over to you or to a third party in a structured, commonly used and machine-readable format. If you request the data to be transferred directly to another controller, this will only be done if it is technically feasible.
SSL or TLS encryption
This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the website operator. You can recognize an encrypted connection by the browser address line changing from “http://” to “https://” as well as by the lock symbol in your browser line.
If SSL or TLS encryption is active, the data you transmit to us cannot be read by third parties.
Access, erasure and rectification
Within the framework of the applicable legal provisions, you have the right to receive information free of charge at any time about your stored personal data, its origin and recipient and the purpose of the data processing as well as, if necessary, a right to rectification or erasure of this data. If you have any further questions hereto and about personal data, you can contact us at any time.
Right to restriction of processing
You have the right to request restriction of processing your personal data. For this purpose you can contact us at any time. The right to restriction of processing exists in the following cases:
- If you contest the accuracy of your personal data we have stored, we generally need time to verify this. For the duration of the review, you have the right to request the restriction of processing your personal data.
- If the processing of your personal data was/is occurring unlawfully, you can request the restriction of processing instead of erasure.
- If we no longer require your personal data, but you need it to exercise, defend against or assert legal claims, you have the right to request the restriction of processing your personal data instead of erasure.
- If you have lodged an objection in accordance with Article 21 (1) GDPR, we must weigh your interests and ours. As long as it is not yet clear whose interests override, you have the right to request the restriction of processing your personal data.
If you have restricted the processing of your personal data, this data – apart from its storage – may only be processed with your consent or for the assertion, to exercise or defend legal claims or to protect the rights of another natural or legal person or for reasons of substantial public interest of the European Union or a member state.
Objection to advertising emails
The use of contact data published in the imprint to send unsolicited advertising and information materials is hereby not permitted. The operators of the website expressly reserve the right to take legal action against unrequested sending of advertising information, such as spam emails.
4. Data collection on this website
4.1. Cookies
Our website uses so-called “cookies”. Cookies are small text files and do not cause any damage to your end device. They are saved on your end device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your end device until you delete them yourself or your web browser deletes them automatically.
In some cases, cookies from third-party companies may also be saved on your end device when you visit our website (third-party cookies). These enable us or you to use specific third-party services (e.g. cookies to process payment services).
Cookies have various functions. Numerous cookies are technically necessary because certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies are used to evaluate user behavior or display advertising.
Cookies that are required to perform the electronic communication process (necessary cookies) or to provide specific functions required by you (functional cookies, e.g. for the shopping cart function) or to optimize the website (e.g. cookies to measure the web audience) are saved on the basis of Art. 6 (1) (f) GDPR, unless another legal basis is stated. The website operator has a legitimate interest in storing cookies in order to provide its services in a technically error-free and optimized manner. If consent to the storage of cookies has been requested, the relevant cookies will be stored exclusively on the basis of this consent (Art. 6 (1) (a) GDPR); this consent can be revoked at any time.
You can change your browser settings so that you are informed when cookies are set and can only allow cookies in individual cases, exclude the acceptance of cookies for specific cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are disabled, the functionality of this website may be restricted.
If cookies are used by third-party companies or for analysis purposes, we will inform you separately in this data protection declaration and, if necessary, request your consent.
4.2. Contact form
If you send us inquiries using the contact form, your details from the inquiry form, including the contact details you provided there, will be saved by us in order to process the inquiry and in case of subsequent questions. We will not forward this data without your consent.
This data is processed on the basis of Article 6 (1) (b) GDPR, provided your inquiry is related to the performance of a contract or is required to carry out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in effective processing of the inquiries sent to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR) if this was requested.
The data you enter in the contact form will remain with us until you request its erasure, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been fully processed). Mandatory legal provisions, in particular retention periods, remain unaffected.
4.3. Inquiries by email, telephone or fax
If you contact us by email, telephone or fax, your inquiry, including all resulting personal data (name, inquiry), will be saved and processed by us for the purpose of answering your request. We will not forward this data without your consent.
This data is processed on the basis of Article 6 (1) (b) GDPR, provided your request is related to the performance of a contract or is required to carry out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 Para. 1 lit. f GDPR) or on your consent (Art. 6 Para. 1 lit. a GDPR) if this was requested.
The data you provided to us via contact requests will remain with us until you request its erasure, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been fully processed). Mandatory legal provisions, in particular statutory retention periods, remain unaffected.
5. Analytics tools and advertising
Google Tag Manager
We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Tag Manager is a tool that helps us to integrate tracking or statistical tools and other technologies on our website. The Google Tag Manager itself does not create any user profiles, does not save any cookies and does not perform any independent analyses. It is only used to manage and display the tools integrated through it. However, Google Tag Manager collects your IP address, which may also be transferred to Google’s parent company in the United States.
The use of the Google Tag Manager is based on Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in integrating and managing various tools on his website quickly and easily. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR; this consent can be revoked at any time.
Google Analytics
This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics enables the website operator to analyze the behavior of website visitors. The website operator receives various usage data, such as page views, retention period, operating systems used and the user’s origin. Google may summarize this data in a profile that is assigned to the respective user or their device.
Google Analytics uses technologies that enable user recognition for the purpose of analyzing user behavior (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is usually transmitted to a Google server in the USA and saved there.
The use of this analysis tool is based on Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in analyzing user behavior in order to optimize both its website and its advertising. If appropriate consent has been requested (e.g. consent to the storage of cookies), processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR; this consent can be revoked at any time.
Data transfer to the USA is based on the EU Commission’s standard contractual clauses. Details can be found here:
https://privacy.google.com/businesses/controllerterms/mccs/.
IP anonymization
We have activated the IP anonymization function on this website. This means that your IP address will be shortened by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area before it is transmitted to the USA. The full IP address will only be transmitted to a Google server in the USA and shortened there in exceptional cases. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics is not combined with other Google data.
Browser plugin
You can prevent Google from collecting and processing your data by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
You can find more information about the handling of user data by Google Analytics in Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.
Order processing
We have an order processing contract with Google and fully comply with the strict requirements of the German data protection authorities when using Google Analytics.
Demographic characteristics in Google Analytics
This website uses the “demographic characteristics” function of Google Analytics to show website visitors appropriate advertisements within the Google advertising network. This allows reports to be created that contain information about the age, gender and interests of site visitors. This data comes from interest-based advertising from Google and third-party visitor data. This data cannot be assigned to a specific person. You can deactivate this function at any time via the ad settings in your Google account or generally prohibit the collection of your data by Google Analytics as described in the section “Objection to data collection”.
Storage period
User and event-level data stored by Google which is linked to cookies, user identifiers (e.g. User ID) or advertising IDs (e.g. DoubleClick cookies, Android advertising ID) is anonymized after 26 months or deleted. Details can be found at the following link: https://support.google.com/analytics/answer/7667196?hl=de
Google conversion tracking
This website uses Google Conversion Tracking. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
With the help of Google conversion tracking, Google and we can recognize whether the user performed specific actions. For example, we can analyze which buttons on our website were clicked how often and which products were viewed or purchased particularly frequently. This information is used to generate conversion statistics. We learn the total number of users who clicked on our ads and which actions they performed. We do not receive any information with which we can personally identify the user. Google itself uses cookies or comparable recognition technologies for identification.
The use of Google Conversion Tracking is based on Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in analyzing user behavior in order to optimize both its website and its marketing. If appropriate consent was requested (e.g. consent to the storage of cookies), processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR; this consent can be revoked at any time.
You can find more information about Google conversion tracking in Google’s Privacy Policy: https://policies.google.com/privacy?hl=de.6. Newsletter
6. Newsletter
If you subscribe to our company’s newsletter, the data in the respective form will be transmitted to the person responsible for processing. Registration for our newsletter takes place using a so-called double opt-in procedure. i.e. after registering, you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can log in with someone else’s email address. When registering for the newsletter, the user’s IP address as well as the date and time of registration are saved. This is to prevent misuse of the services or the data subject’s email address. The data will not be forwarded to third parties. An exception exists if there is a legal obligation to pass it on. The data is used exclusively for sending the newsletter. The subscription to the newsletter can be canceled by the data subject at any time. Likewise, consent to the storage of personal data can be revoked at any time. For this purpose, there is a corresponding link in every newsletter. The legal basis for the processing of data after the user has registered for the newsletter, provided the user has given his consent, is Article 6 (1) (a) GDPR. The legal basis for sending the newsletter as a result of the sale of goods or services is Article 7 (3) UWG.
Use of rapidmail
Description and purpose: We use rapidmail to send newsletters. The provider is rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg, Germany. We organize and analyze the sending of newsletters with rapidmail. The data you enter for the purpose of subscribing to the newsletter will be stored on rapidmail’s servers in Germany. If you do not want analysis by rapidmail, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message. For analysis purposes, emails sent with rapidmail contain a so-called tracking pixel, which connects to rapidmail’s servers when the email is opened. In this way it can be determined whether a newsletter message has been opened. We can also use rapidmail to determine whether and which links in the newsletter message are clicked. Optionally, links in the email can be set as tracking links and based on that your clicks can be counted.
Legal basis: The legal basis for data processing is Article 6 (1) (a) GDPR.
Recipient: The recipient of the data is rapidmail GmbH.
Transfer to third countries: Data will not be transferred to third countries.
Duration: Your data saved as part of your consent for the purpose of the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from both our servers and rapidmail’s servers after you unsubscribe from the newsletter. Data saved by us for other purposes (e.g. email addresses for the member area) remains unaffected.
Option to revoke: You have the option to revoke your consent to data processing at any time with future effect. The lawfulness of the data processing operations already carried out remains unaffected by the revocation.
Further data protection information: For more information, please see rapidmail’s data security information at: https://www.rapidmail.de/datensicherheit. For more information about rapidmail’s analysis functions, please see the following link: https://www.rapidmail.de/wissen-und-hilfe
7. Plugins and tools
YouTube with extended data protection
This website includes videos from YouTube. The website is operated by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
We use YouTube in extended data protection mode. According to YouTube, this mode means that YouTube does not save any information about visitors of this website before they watch the video. However, the extended data protection mode does not necessarily exclude that data is forwarded to YouTube partners. This means that YouTube connects to the Google DoubleClick network regardless of whether you are watching a video.
As soon as you start a YouTube video on this website, a connection to YouTube’s servers is established. The YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.
Furthermore, after starting a video, YouTube can save various cookies on your device or use comparable recognition technologies (e.g. device fingerprinting). In this way, YouTube can receive information about visitors to this website. This information is, among other things, used to collect video statistics, improve user experience and prevent fraud attempts.
If necessary, further data processing operations may be triggered after starting a YouTube video, without us having influence on that.
The use of YouTube is in the interest of an attractive presentation of our online offerings. This represents a legitimate interest within the meaning of Article 6 (1) (f) of the GDPR. If appropriate consent has been requested, processing is carried out exclusively on the basis of Article 6 (1) (a) of the GDPR; this consent can be revoked at any time.
Further information about data protection at YouTube can be found in their data protection declaration at: https://policies.google.com/privacy?hl=de.
Google Web Fonts (local hosting)
This site uses so-called web fonts, which are provided by Google, for the uniform presentation of fonts. The Google Fonts are installed locally. There is no connection to Google servers.
Further information about Google Web Fonts can be found at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy?hl=de.
9. Audio and video conferencing
Data processing
For communication with our customers, we use online conference tools, among other things. The specific tools we use are listed below. If you communicate with us via video or audio conference via the Internet, your personal data will be collected and processed by us and the provider of the respective conference tool.
The conference tools collect all the data that you use and provide to make use of the tools (email address and/or your telephone number). The conference tools also process the duration of the conference, start and end (time) of participation in the conference, number of participants and other “contextual information” related to the communication process (metadata).
Furthermore, the provider of the tool processes all technical data that is necessary to process online communication. This includes in particular IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker as well as the type of connection.
If content is exchanged, uploaded or made available in any other way within the tool, it will also be saved on the tool provider’s servers. Such content includes, but is not limited to, cloud recordings, chat/instant messages, photos and videos uploaded to voicemails, files, whiteboards and other information shared while using the Service.
Please note that we do not have full influence on the data processing operations of the tools used. Our options depend largely on the corporate policy of the respective provider. Further information on data processing by the conference tools can be found in the data protection declarations of the tools used, which we have listed below this text.
Purpose and legal basis
The conference tools are used to communicate with prospective or existing contractual partners or to offer specific services to our customers (Art. 6 (1) Sentence 1 (b) GDPR). Furthermore, the use of the tools serves to generally simplify and accelerate communication with us respectively our company (legitimate interest within the meaning of Art. 6 (1) (f) GDPR). If consent has been requested, the relevant tools will be used on the basis of this consent; this consent can be revoked at any time with future effect.
Storage period
The data we collect directly via the video and conference tools will be deleted from our systems as soon as you request us to delete it, revoke your consent to storage or the purpose for data storage no longer applies. Saved cookies remain on your device until you delete them. Mandatory statutory retention periods remain unaffected.
We have no influence on the storage period of your data, which is stored by the operators of the conference tools for their own purposes. For details, please contact the operators of the conference tools directly.
Conference tools used
We use the following conference tools:
TeamViewer
We use TeamViewer. The provider is TeamViewer Germany GmbH, Jahnstr. 30, 73037 Göppingen. Details on data processing can be found in TeamViewer’s data protection declaration: https://www.teamviewer.com/de/datenschutzerklaerung/.
Microsoft Teams
We use Microsoft Teams. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Details on data processing can be found in the Microsoft Teams data protection declaration: https://privacy.microsoft.com/de-de/privacystatement.
10. Internal services
Handling applicant data
We offer you the opportunityof applying for a job with us (e.g. by email, mail or online application form). Hereinafter we inform you about the scope, purpose and use of your personal data collected during the application process. We assure that the collection, processing and use of your data is carried out in accordance with applicable data protection laws and all other legal provisions and that your data is treated as strictly confidential.
Scope and purpose of data collection
If you send us an application, we process your associated personal data (e.g. contact and communication data, application documents, notes from job interviews, etc.) to the extent that this is necessary in order to decide on the establishment of an employment relationship. The legal basis for this is Section 26 BDSG new pursuant to German law (initiation of an employment relationship), Article 6 (1) (b) GDPR (general contract initiation) and – if you have given your consent – Article 6 (1) (a) GDPR. This consent can be revoked at any time. Your personal data is forwarded internally only to people who are involved in processing your application.
If the application is successful, the data you provided will be saved in our data processing systems for the purpose of implementing the employment relationship on the basis of Section 26 BDSG new and Article 6 (1) (b) GDPR.
Data retention period
If we are unable to offer you a job, you reject a job offer or withdraw your application, we reserve the right to keep the data you have submitted for up to 6 months based on our legitimate interests (Art. 6 (1) (f) GDPR) after the end of the application process (rejection or withdrawal of the application). Afterwards, the data will be erased and the physical application documents destroyed. In particular, retention serves evidentiary purposes in the event of a legal dispute. If it is evident that the data will be required after the end of the 6-month period (e.g. due to an impending or pending legal dispute), erasure will only take place when the purpose for further retention no longer applies.
Retention for longer periods may also take place if you have given the corresponding consent (Art. 6 (1) (a) GDPR) or if statutory retention obligations conflict with erasure.
