DATA PROTECTION POLICY
Valid from: January 2019
As a data controller, we are hereby fulfilling our duty to provide information and our duty of disclosure. We also provide information about the nature, scope and purpose of personal data processing carried out by our company as part of our online presence and operations.
Firstly, we will provide general information on this subject, to the extent that this relates to any processing or constitutes an overriding regulation in this regard. This is followed by information regarding individual instances of processing and the use of services offered by other providers.
The terms used, including “personal data”, “processing”, “data controller”, “data subject”, “third party” and others are defined in accordance with the provisions of Regulation (EU) 2016/679 (GDPR), and, in particular, Art. 4 GDPR.
Please note that this data protection notice may be amended to reflect specific developments or as the result of a regular review. We, therefore, recommend that you stay informed of amendments to our data protection notices made available on our online content.
1 General information
1.1 Scope of application
This data protection notice applies in particular to this website as well as to the following additional online content:
In addition, this data protection statement also applies to other types of processing set out here, which are carried out as part of our business activities. We refer to this data protection notice in order to simplify access and comply with the requirements of clarification and transparency.
In the case of services offered by other service providers, such as those referred to via links, the data protection notice of the relevant service provider shall apply.
1.2 The data controller is
NoKantDo eG
Adolf-Kolping-Str. 20
83607 Holzkirchen
Germany
Tel.: +49 151 42234344
Email: connect@nokantdo.de
1.3 Data distribution and disclosure
1.3.1 General information
As a data controller, we process personal data on a regular basis. The communication or disclosure of personal data shall only take place where there is a legal basis for doing so, in particular, where one of the following reasons applies:
- It is necessary for the performance of a contract or to take steps at the person’s request prior to entering into the contract (point (b) of Art. 6 (1)(1) GDPR).
- The communication of data is necessary for the establishment, exercise or defence of legal claims, and there is no reason to believe that the data subject has compelling, legitimate grounds for their data not being communicated (point (f) of Art. 6(1)(1) GDPR).
- There is a legal obligation to communicate the data (point c of Art. 6(1)(1) GDPR).
- There has been valid consent (point a of Art. 6(1)(1) GDPR).
1.3.2 Processing carried out by contractors
Data belonging to data subjects may also be communicated for the purpose of processing or disclosed by a service provider contracted to carry out the processing. Whenever we contract a processor, this is always done as part of a processing agreement ensuring that the processing is performed in accordance with our policies, there are sufficient guarantees that appropriate technical and organisational measures will be taken and the rights of the data subject will be guaranteed.
If any individual piece of processing is to be carried out by a processor we have contracted, we will inform you of this.
1.3.3 Transmission to third countries
Data will only be transmitted to third countries (outside the EU and EEC) if the specific requirements necessary for this have been met (Art. 44 et seq. GDPR).
1.4 Criteria for determining storage period (periods for the erasure of data)
As a general rule, we shall save personal data if this is necessary for the purpose of the relevant processing, if legal or regulatory retention periods are applicable, if you have a legitimate interest in such storage or if you have granted us the required consent.
We shall save specific types of data, in accordance with the following rules, for the period of time specified in each case. We shall delete them after the specified time period has elapsed:
- Three years: Data and content regarding legal transactions (including their preparation), to the extent that these are necessary to be able to disclose information and prepare a defence, as well as for establishing and mounting a defence against claims.
- Six years: Commercial letters (Section 257(1) No. 2 and 3 and Section 257(4) of the German Commercial Code (HGB))
- 10 years: The documents, accounting records and trading books (Section 147 (1) of the German Fiscal Code (AO)) relevant for taxation under points 1 and 4 of Section 257(1) and Section 257 (4) HGB)
- 30 years: Data which are saved in specific circumstances to serve our interests or those of third parties, due to the fact that there are relevant applicable limitation or retention periods (e.g. enforcement orders or special limitation periods).
In such cases, as a general rule, the storage period will begin at the end of the calendar year in which the last event relating to the relevant processing has taken place (e.g. the order, delivery, end of a contract or issuing of an invoice).
After the storage period has elapsed, checks will be carried out at the end of the relevant calendar year to determine whether further storage is required. If circumstances arise during the storage period (such as the conclusion of a contract, negotiations regarding claims, legal disputes, etc.) which make it necessary to store the data for a longer period, these time periods will be extended accordingly.
We shall provide specific information regarding storage periods for specific types of processing in the relevant place.
1.5 Use of automated decision-making or profiling
As a general rule, we do not use automated decision-making or profiling of any person, as defined in Art. 22 GDPR, even where we use software-supported processes to process data.
To the extent that such technology is used in specific instances of processing, we shall give express notification of this, as well as meaningful information regarding the rationale and scope of such use and its intended outcomes.
1.6 Rights of data subjects and the right to lodge a complaint
Persons affected by our processing of personal data (i.e. data subjects), e.g. as users of our services, are entitled to exercise various rights:
- Under Art. 15 GDPR, they are entitled to obtain information, in particular regarding whether we are processing their personal data. Under certain circumstances, this right to information may be subject to limitations (e.g. in cases where Section 34 of the German Federal Data Protection Act (BDSG) is applicable).
- Under Art. 16 GDPR, data subjects are entitled to obtain the rectification of any inaccurate personal data and the completion of any personal data belonging to them that is stored by us.
- Under Art. 17 GDPR, they are entitled to demand the erasure of personal data belonging to them that is stored by us.
- Under Art. 18 GDPR, they are entitled to demand the restriction of processing.
- Under Art. 20 GDPR, they are entitled to demand the personal data that they have provided us with in a structured, commonly used and machine readable format or to have these data transmitted to another controller.
- They are entitled to exercise their right to object under Art. 21 GDPR, especially if their personal data are being used for the purpose of direct marketing or if grounds for such arise due to their specific circumstances, if the processing is based either point (e) or (f) of Art. 6(1)(1) GDPR.
If data subjects consent to the processing of their personal data, this can be withdrawn at any time with effect for the future. This shall not affect any processing that has taken place prior to the withdrawal of consent.
Under Art. 77 GDPR, the data subject shall have the right to lodge a complaint with a data protection supervisory authority.
2 Online content and other media services
In the following sections we will set out the processing performed as part of our online content and media services.
2.1 Online content provided
Our online content serves the purpose of general communication, the provision and presentation of information on us as well as allowing us to provide our services.
The legal basis for this type of data processing is our legitimate interest, which, as a general rule, arises from the specified purpose (point (f) of Art. 6(1)(1) GDPR). To the extent that the online content is necessary for the performance of a contract or for preparing the grounds for the conclusion of a contract with the data subject, at their request, the legal basis is point (b) of Art. 6(1)(1) GDPR.
The data subjects are typically the respective users of this online content.
We set out any additional or differing information regarding individual instances of processing, as well as additional purposes and legal bases, in the relevant parts of this data protection notice.
2.1.1 Company website
Our company website shall serve the purpose of general communication, providing and presenting information on us and our services.
2.1.2 Corporate wiki
This online content shall serve the purpose of collecting and making experiences and knowledge available in a centralised location, as well as documenting projects and decisions relating to them. In addition, internal company information and decisions will be set out and documented.
Authorised users (data subjects) will be able to read, process and amend this content.
The following types of data are processed for this purpose: Name, email address, content data, comments, metadata.
2.1.3 Project management software
We provide authorised project participants (data subjects) with online project management services for coordinating the planning, direction, monitoring and completion of projects to allow flexible cooperation between the various teams involved in projects across various sites.
The following types of data are processed for this purpose: Name, email address, tasks, project task logs, comments, time tracking, metadata.
2.1.4 Code hosting website
For the central management, provision and versioning of programming code, we use a code hosting website that allows authorised persons (data subjects) to manage and access code.
The following types of data are processed for this purpose: Name, email address, content data, comments, metadata.
2.2 General information regarding online content
2.2.1 Hosting the online content:
Our online content is hosted by a provider within the EU with which we have concluded a processing contract. Unless stated otherwise, the data are processed on the systems of the provider on our behalf and in accordance with our instructions, during which time the employees of the service provider will have no direct access to the data.
2.2.2 Processing the calls and server log files
When online content is used, we collect personal data which are transmitted from the user’s browser to the server at the point at which the call is made. This will involve the processing of the following data in order to provide the corresponding online content and any related services:
- The IP address of the request, and where applicable, the proxy server used
- The time and date of the request.
- The hostname/device name of your terminal device.
- The URL (address) of the request as well as the URL which made the request (the referrer).
- The browser used, the operating system and its interface, the language settings and version of the browser software.
- Technical information relating to access: Access status/HTTP status code and the volume of data transmitted in each case.
- Accessed and linked content data (text, photos, videos, graphics, other types of data etc.).
These data are stored in a log file. In the log file, the IP address is replaced by an invariable, private IP address, meaning that, as a general rule, it is no longer possible to make any conclusions regarding the original request.
The log data are erased after 14 days. These data will only be retained for longer periods under exceptional circumstances for evidence or analysis purposes. Such data will be erased as soon as grounds for retention cease to apply.
The legal basis for data processing is our legitimate interest in providing our online content (point (f) of Art. 6(1)(1) GDPR).
2.2.3 Use of cookies
Our online content uses cookies. Cookies are small files in which data can be stored and are saved on the terminal device by a browser. This information is transmitted to the web server when it is re-accessed. This means that it is possible for the user session to be recognised, e.g. to attribute login data or user settings such as language settings or font size, or to clearly attribute a basket in a web shop to a user. However, cookies also make it possible to observe user behaviour, especially when so-called “third-party cookies” are used.
We use the cookies required to allow us to provide the main functions of the website and allow us to manage our online content and, in particular, to respond to user queries. This shall include, in particular, the management of the settings you have chosen, filling out and processing forms, potential basket functions as well as the recognition of user sessions with log-in functions.
The legal basis for the use of cookies is point (f) of Art. 6(1)(1) GDPR. Our legitimate interest is based on the respective use of cookies.
Users will be able to configure their browser settings in accordance with their wishes and, for instance, to reject cookies or delete them on a regular basis. However, this may mean that it is not possible to use all the functions.
2.2.4 User accounts and authentication
We shall provide clients, customers, services, freelances, contractual partners, interested parties, employees and associates (data subjects) with user accounts for authentication on our various services and online content. The users can gain information relevant to the use of the services and their user accounts via email.
The data processed includes, in particular, names, user names, passwords, email addresses and log data in relation to each log in (time and IP address of the terminal device).
The storage period for the data shall conform to the criteria used to determine this time-frame.
The legal basis for processing is point (f) of Art.6(1)(1) GDPR. Our legitimate interest lies in ensuring that data subjects can gain secure and authenticated access to the services and online content.
2.2.5 External links
We also use links to the services of other providers on our websites. The relevant provider or operator is responsible for such services and we do not have any influence over the processing they carry out. We, therefore, draw your attention to the data protection notices of such providers to the extent that it allows you to gain an understanding of the processing and to exercise your rights.
It is possible that these service providers will collect data concerning you, use cookies, as well as embedding the tracking services of other providers. In addition, it is possible that data will be linked to the user accounts that you have with the provider while you are logged into their service. If you think this may be the case, you should not make use of the links.
The legal basis is point (f) of Art.6(1)(1) GDPR. Our legitimate interest lies in the optimisation of the functionality and user-friendliness of our web presence.
2.2.6 General data security
To protect the processing of data and prevent misuse, unauthorised access, unauthorised changes, unauthorised communication and destruction, we shall implement the following measures:
- It will be possible to access the online content via HTTPS. Here, the content data are encrypted during the transmission between your browser and the server using a state-of-the-art encryption algorithm. However, this does not apply to addresses accessed (links/URLs). These tend to be unencrypted for technical reasons.
The limitation of access to personal detail by our employees and clients to persons who are responsible for processing data.
2.3 Chat services
2.3.1 Description and purpose of processing
We use chat services for the communication and discussion between clients, customers, service providers, freelancers, contractual partners, interested parties, employees and associates (data subjects) for the purpose of implementing contracts, exchanging experiences and planning projects.
This involves the processing of the following categories of data:
- Personal master data (first name(s), surname, suffixes to names).
- Contact data (country of residence, telephone number(s), email address).
- Content data and metadata relating to the relevant communication.
2.3.2 The recipient and transmission of the data
In addition to the services we provide ourselves, we also use the service “Slack”, provided by Slack Technologies Inc., 500 Howard Street, San Francisco, California. Slack is certified under the Privacy Shield, thereby ensuring the necessary appropriate and level of data protection for the processing of data by providers in third countries. We have concluded a processing contract with the provider. Slack has comprehensive information regarding data security and compliance with data protection regulation on its website.
2.3.3 Data storage period
The storage period for the data shall conform to the criteria used to determine this time-frame.
2.3.4 Legal basis
The legal basis for processing is point (f) of Art.6(1)(1) GDPR. Our legitimate interest lies in ensuring efficient, structured and documented communication with data subjects.
3 Online presence on social media
We maintain an online presence on the platforms of social media providers for the purpose of communication with customers, suppliers, interested parties, as well as presenting and informing others about our company and services. Our presence on and use of social media for these purposes lies in our legitimate interests arising from this (legal basis is point (f) of Art. 6(1)(1) GDPR).
We would like to point out that this involves user data being processed outside the European Union, which may present risks to these data, as it may be more difficult for users to exercise their rights. To the extent that the providers in the USA are certified under the Privacy Shield, they thereby undertake to comply with data protection standards of the European Union.
As a general rule, user data from social media are used to create user profiles and analyse user behaviour. These are then, in turn, used for the purpose of market research and advertising. Cookies are regularly saved on the user’s terminal device for this purpose. In addition, data from users who have social media accounts can be assigned to their profiles.
The platform providers are typically responsible for the processing of data on the respective social media platforms. We, therefore, draw your attention to the terms of use and data protection notices of the relevant providers. In addition, we also advise you to make use of impartial news media and up-to-date reports to gain an understanding of the current situation and possible risks of using specific social media platforms.
- LinkedIn:
Provider/representative: LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland
Data protection notice
Opt-out
Privacy shield
4 Processing as part of our business activities
4.1 Cooperation network and contact form:
4.1.1 Description and purpose of processing
We maintain a database together with customers and interested parties (data subjects) who cooperate with us or intend to do so in the future (cooperation network database). For this purpose, we also provide a special contact form.
This involves the processing of the following categories of data:
- Personal master data (first name(s), surname, suffixes to names).
- Contact data (country of residence, telephone number(s), email address).
- Current job or educational status.
- Information on knowledge, experience and skills.
- Information given voluntarily by the data subject.
The data are, as a general rule, collected from the data subject directly, via the contact form or a discussion.
In addition, we use data collected in a permissible way and which have been made accessible on publicly available sources by data subjects for the purpose of presenting a professional image and professional communication, especially on platforms such as XING or LinkedIn.
4.1.2 The recipient and transmission of the data
The data are used internally, within the company and in accordance with the purpose of the processing. The data will not be communicated without receiving appropriate consent from the data subject.
4.1.3 Storage period
As a general rule, data belonging to data subjects will be erased if there has been no further contact with the data subject for two years.
4.1.4 Legal basis
We have a legitimate interest in maintaining a database of potential cooperation partners who can be contacted during projects and jobs for cooperation purposes (the legal basis is point (f) of Art. 6(1)(1) GDPR).
4.2 Time-recording system
4.2.1 Description and purpose of processing
To invoice our clients for services and to establish a system for invoicing in relation to our service providers and employees, we use a time-recording system. The data subjects are the relevant service providers and employees.
The categories of data processed are as follows:
- Personal master data (first name(s), surname, suffixes to names).
- Contact data (email address).
- Dates, project information and descriptions of the activities.
4.2.2 The recipient and transmission of the data
We use service providers to carry out time-recording, which can provide us with an appropriate system.
Data are also exchanged with our project management software.
The data are also transmitted to our clients and customers for the purpose of invoicing if this has been agreed upon under the relevant contract.
4.2.3 Data storage period
The storage period for the data shall conform to the criteria used to determine this time-frame.
4.2.4 Legal basis
The legal basis for processing is point (f) of Art. 6(1)(1) GDPR. Our legitimate interest stems from the purpose of processing proper and verifiable invoicing practices with our contractual partners.
4.3 Processing for the purpose of providing services and implementing contacts
4.3.1 Description and purpose of processing
We process personal data belonging to you or the relevant contact person (the data subject) to provide our services to clients and customers and take steps at the request of interested parties prior to entering into the contract.
The categories of data processed are as follows:
- Personal master data (first name(s), surname, suffixes to names).
- Contact data (address, telephone numbers, email address).
- Payment data (bank details, information on payment processors).
- Data regarding contractual content and the processing of contracts (provision of services and the processing of payments.).
4.3.2 The recipient and transmission of the data
As part of the processing, we contract a range of service providers to process data on our behalf (see above), especially for the purpose of development in providing and maintaining the information systems we use for such processing, as well as invoicing and accounting. In addition, data may be transmitted or disclosed to another third party if this is necessary to carry out a service (e.g. delivery services).
4.3.3 Data storage period
The storage period for the data shall conform to the criteria used to determine this time-frame.
4.3.4 Legal basis
The legal basis for processing is point (d) of Art. 6(1)(1) GDPR. If it should become necessary to process special categories of personal data, point (f) of Art. 9(2) GDPR shall apply.
4.4 Processing for accounting purposes
4.4.1 Description and purpose of processing
In order to comply with our legal obligations to maintain and provide evidence of our accounting records, we process data from customers, suppliers, service providers, employees, freelancers and others for whom we have to keep records for these purposes.
The categories of data processed are as follows:
- Personal master data (first name(s), surname, suffixes to names).
- Contact data (address, telephone numbers, email address).
- Contractual data underlying the situation.
- Financial messaging data and information (bank details, information on payment processors).
4.4.2 The recipient and transmission of the data
As part of this processing, we use processors to manage the accounting information, especially for the purpose of payroll accounting, as well as using service providers to provide and maintain the information systems we use for this purpose.
In addition, data may be transmitted or disclosed to another third party if this is necessary for carrying out the processing (e.g. the tax office, tax advisers, public authorities, auditors or lawyers).
4.4.3 Data storage period
The storage period for the data shall conform to the criteria used to determine this time-frame.
4.4.4 Legal basis
The legal basis for processing is provided by the statutory regulations (point c of Art. 6(1)(1) GDPR) relating to compliance with accounting duties and the duty to enter into a contract, to ensure the proper course of business and ensuring the company’s existence as a going concern.
4.5 Getting in contact and communication in general
4.5.1 Description and purpose of processing
When persons (data subjects) contact us (e.g. in person, via a contact form, email, by phone or over social media), we store and process the contact details they have submitted (their name, address, e-mail address and telephone number) and the information and content they have transferred when contacting us in order to respond to the request.
The same applies if you provide us with information at events, trade fairs or other occasions (e.g. through business cards or adding your details to the mailing list).
4.5.2 Data storage period
We will erase any data generated in this regard if they become no longer necessary to store it. As a general rule, this will take place after two years if there is no further communication in relation to the request and there is no longer any processing taking place that has arisen from the query (e.g. the following contractual relationship), which stipulates a further storage period.
4.5.3 Legal basis
We perform the processing as part of steps prior to entering the contract, if this is due to a corresponding request you have made (the legal basis is point (b) of Art. 6(1)(1) GDPR). Furthermore, we have a legitimate interest in responding to requests addressed to us and relating to us and our services, as well as making and maintaining business contacts and processing data accordingly (the legal basis is point (f) of Art. 6(1)(1) GPDR).
4.6 The establishment, exercise or defence of legal claims
4.6.1 Description and purpose of processing
We shall process the data of data subjects if it is necessary for the establishment, exercise or defence of legal claims. In this regard, the purpose may also have to be changed in accordance with the personal data.
Data subjects may include, in particular:
- Customers, suppliers, interested parties, employees, service providers and public authorities.
- Other claimants or defendants.
- The contact person, agent or authorised representative of any of the aforementioned persons or bodies.
In this regard, the following categories of data are taken into consideration, if they are necessary in the specific case:
- Personal master data (first name(s), surname, suffixes to names, date of birth).
- Contact data (addresses, telephone numbers, email address).
- Documents, information and data that are necessary for the implementation of the claims.
- Special categories of personal data, if they are necessary for the implementation of the claims.
4.6.2 The recipient and transmission of the data
In relation to the processing, recipients may be a range public authorities, companies or even service providers, depending on the circumstances:
- Service provider tasked with enforcing claims (lawyers, collection agencies etc.)
- Public authorities and the courts
- The defendant
4.6.3 Data storage period
When using data for the purpose of establishing, exercising or defending legal claims, the relevant storage period may be extended until the definitive end of the proceedings, including the corresponding implementation, in order not to jeopardise the achievement of the purpose.
If this results in an enforceable title, the storage period will be 30 years.
4.6.4 Legal basis
The legal basis for processing is point (f) of Art. 6(1)(1) GDPR. Our legitimate interest lies in the establishment, exercise or defence of legal claims. If it becomes necessary to process special categories of personal data, point (f) of Art. 9(2) GDPR shall apply.