Data Protection & Compliance

Data Protection at a Glance

General information

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

Responsible Entity

The responsible body for data processing on this website is:

Curato Holding AG
Schiessstraße 47-49
40549 Düsseldorf
Telephone: +49 (0) 2 11 – 97 26 56 50
Email: info@curato.de

We have appointed a data protection officer for our company, who can be contacted at:

Lawyer
Dr. Nils Helmke
Waldring 43-47
44789 Bochum
Telephone: +49 234 282 533-20
Email: helmke@agad.de

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content — such as orders or enquiries that you send to us as the website operator — this website uses SSL or TLS encryption. You can recognise an encrypted connection by the change in the browser’s address line from “http://” to “https://” and by the padlock symbol displayed in your browser bar.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

We would like to point out that data transmission over the Internet (e.g. when communicating by e-mail) may be subject to security vulnerabilities. It is not possible to completely protect data from access by third parties.

Consent and Withdrawal of Consent to Data Processing

Where we require your consent for data processing, we will request it in advance. This is usually done via a pop-up when you first visit the website (also known as a cookie banner or consent banner) or via a dialogue box embedded in our website.

You may withdraw your consent given in this way at any time by reopening the cookie banner. You can access the banner by clicking the button located at the bottom left of our website.

Where we do not obtain your consent using the methods described above and/or withdrawal is not possible via the banner, the process for granting and withdrawing consent is described within the respective data processing activity.

The lawfulness of data processing carried out prior to the withdrawal remains unaffected by the withdrawal.

Cookies

To make your visit to our website more attractive and to enable the use of certain functions, we use so-called cookies. Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted after the end of the browser session, i.e. when you close your browser (so-called session cookies). Other cookies remain on your device and enable us to recognise your browser on your next visit (persistent cookies). The duration of storage can be found in the overview within your web browser’s cookie settings.

We also distinguish between technically necessary cookies, which are essential for the operation of our website, and optional cookies, which provide additional features or services on our website.

Where personal data is processed through cookies that are technically necessary for the operation of our website, such processing is carried out in accordance with Section 25 (2) No. 2 TDDDG and Article 6 (1) (f) GDPR in order to safeguard our legitimate interests in ensuring the best possible functionality of the website as well as a user-friendly and effective website experience.

Where we use optional cookies, we will obtain your consent prior to their use.

What rights do you have with regard to your data?

Where your personal data is processed, you are considered a data subject within the meaning of the GDPR and you are entitled to the following rights in relation to us as the controller:

1) Right of Access

You have the right to request confirmation from us as to whether your personal data is being processed. Where such processing takes place, you may request information from us in accordance with Article 15 GDPR regarding the following:

1. the purposes for which your personal data is processed,
2. the categories of personal data being processed,
3. the recipients or categories of recipients to whom your personal data has been or will be disclosed,
4. the envisaged period for which your personal data will be stored or, if specific details are not possible, the criteria used to determine that period,
5. the existence of the right to rectification or erasure of your personal data, the right to restriction of processing by us, or the right to object to such processing,
6. the existence of the right to lodge a complaint with a supervisory authority,
7. all available information about the source of the data where the personal data is not collected from the data subject,
8. the existence of automated decision-making, including profiling, in accordance with Article 22 (1) and (4) GDPR and – at least in those cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

Furthermore, you have the right to request information as to whether your personal data is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 GDPR in connection with the transfer.

2) Right to Rectification

In accordance with Article 16 GDPR, you have the right to obtain from us the rectification and/or completion of your personal data if the data processed concerning you is inaccurate or incomplete. We shall carry out the rectification without undue delay.

3) Right to Restriction of Processing

Under the following conditions, you may request the restriction of processing of your personal data in accordance with Article 18 GDPR:

1. where you contest the accuracy of your personal data for a period enabling us to verify the accuracy of the personal data,
2. where the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead,
3. where the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead,
4. where you have objected to processing pursuant to Article 21 (1) GDPR and it has not yet been determined whether our legitimate grounds override your grounds.

Where the processing of your personal data has been restricted, such data – apart from storage – may only be processed with your consent or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State. You will be informed by us before the restriction is lifted.

4) Right to Erasure

a. Obligation to Erase

In accordance with Article 17 GDPR, you may request that we erase your personal data without undue delay. We are obliged to erase such data without undue delay where one of the following grounds applies:

1. the personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed,
2. you withdraw your consent on which the processing is based pursuant to Article 6 (1) (a) GDPR or Article 9 (2) (a) GDPR, and there is no other legal basis for the processing,
3. you object to the processing pursuant to Article 21 (1) GDPR and there are no overriding legitimate grounds for the processing,
4. you object to the processing pursuant to Article 21 (2) GDPR,
5. the personal data concerning you have been processed unlawfully,
6. the erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which we are subject,
7. the personal data concerning you have been collected in relation to the offer of information society services in accordance with Article 8 (1) GDPR.

b. Information to Third Parties

Where we have made your personal data public and are obliged pursuant to Article 17 (1) GDPR to erase it, we shall, taking into account available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of any links to, or copies or replications of, those personal data.

c. Exceptions to the Right to Erasure

The right to erasure does not apply where processing is necessary:

1. for exercising the right to freedom of expression and information,
2. for compliance with a legal obligation which requires processing under Union or Member State law to which we are subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us,
3. for reasons of public interest in the area of public health in accordance with Article 9 (2) (h) and (i) and Article 9 (3) GDPR,
4. for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89 (1) GDPR, insofar as the right referred to in Section 1 is likely to render the achievement of the objectives of that processing impossible or seriously impair it,
5. for the establishment, exercise, or defence of legal claims.

d. Right to Be Informed

If you have exercised your right to rectification, erasure, or restriction of processing against us, we are obliged pursuant to Article 19 GDPR to communicate such rectification or erasure of the data, or restriction of processing, to all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about those recipients.

5) Right to Data Portability

In accordance with Article 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from us, provided that

1. the processing is based on consent pursuant to Article 6 (1) (a) GDPR or Article 9 (2) (a) GDPR, or on a contract pursuant to Article 6 (1) (b) GDPR, and
2. the processing is carried out by automated means.

In exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.

The right to data portability does not apply to processing of personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

6) Right to Object

In accordance with Article 21 GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Article 6 (1) (e) or (f) GDPR; this also applies to profiling based on those provisions. The objection must be justified.

Upon receipt of an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims.

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling insofar as it is related to such direct marketing.

If you object to the processing for direct marketing purposes, your personal data will no longer be processed for such purposes.

You have the option, in connection with the use of information society services – irrespective of Directive 2002/58/EC – to exercise your right to object by automated means using technical specifications.

7) Automated Decision-Making in Individual Cases, Including Profiling

In accordance with Article 22 GDPR, you have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

1. is necessary for entering into, or the performance of, a contract between you and us, or
2. is authorised by Union or Member State law to which we are subject, and such law provides for appropriate measures to safeguard your rights and freedoms and legitimate interests, or
3. is based on your explicit consent.

However, such decisions must not be based on special categories of personal data pursuant to Article 9 (1) GDPR, unless Article 9 (2) (a) or (g) GDPR applies and appropriate measures have been taken to safeguard your rights and freedoms and legitimate interests.

With regard to the cases referred to in sections 1 and 3, we shall implement appropriate measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention on our part, to express your point of view, and to contest the decision.

8) Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR.

9) Right to Withdraw Consent under Data Protection Law

In accordance with Article 7 (3) GDPR, you have the right to withdraw your consent to data processing at any time, including consent given prior to the entry into force of the GDPR (25 May 2018). The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. The withdrawal of consent may be declared by email, letter, or telephone using the contact details provided above.

Data collection on our website

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources.

This data is collected on the basis of Art. 6 (1) lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website—for this purpose, the server log files must be collected.

The data will be erased as soon as they are no longer necessary for achieving the purpose for which they were collected. In the case of data collection for the provision of the website, this is the case when the respective session has ended. In the case of data storage in log files, this is the case after no later than seven days. Storage beyond this period is possible. In such cases, your IP address will be deleted or anonymised so that it can no longer be assigned to the accessing client.

External hosting

This website is hosted by an external service provider (host). The personal data collected on this website is stored on the host’s servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and other data generated via a website.

The use of the host is for the purpose of fulfilling our contractual obligations towards our potential and existing customers (Art. 6 (1) (b) GDPR) and in the interest of a secure, fast, and efficient provision of our online offering by a professional provider (Art. 6 (1) (f) GDPR).

Our host will only process your data to the extent necessary to fulfill its service obligations and will follow our instructions regarding this data.

We use the following hosting provider:

united-domains AG
Gautinger Straße 10
82319 Starnberg
Germany

Contact form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We will not pass on this data without your consent.

The processing of the data entered into the contact form is therefore carried out exclusively on the basis of your consent (Article 6 (1) (a) GDPR). You may withdraw this consent at any time. For this purpose, an informal notification by email to us is sufficient.

The data you enter in the contact form will remain with us until you request us to delete it, revoke your consent to its storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory legal provisions—in particular retention periods—remain unaffected.

Request by e-mail, telephone or fax

If you contact us by email, telephone, or fax, your inquiry, including all resulting personal data (name, inquiry), will be stored and processed by us for the purpose of processing your request. We will not disclose this data without your consent.

The processing of these data is carried out on the basis of Article 6 (1) (b) GDPR, where your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on your consent (Article 6 (1) (a) GDPR) and/or on our legitimate interest in effectively handling your request (Article 6 (1) (f) GDPR).

The data you send us via contact requests will remain with us until you request us to delete it, revoke your consent to its storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory legal provisions—in particular statutory retention periods—remain unaffected.

If you wish to withdraw your consent, an informal notification by email to us is sufficient.

Google Services

Our website uses services provided by Google. “Google” is a group of companies consisting of Google Ireland Ltd. (service provider), Gordon House, Barrow Street, Dublin 4, Ireland, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, as well as other affiliated companies of Google LLC.

Google Analytics

This website uses Google Analytics.

Google Analytics uses JavaScript and cookies to analyse the use of the website. JavaScript is a programming language that is executed in your browser. Google Analytics collects information about your browser, your system, and your use of the website. The information generated about your use of our website (including your IP address, which is anonymised using the anonymise IP method so that it can no longer be associated with a specific connection) is transmitted to a Google server in the USA and stored there.

Google will use this information to evaluate your use of our website, to compile reports on website activity for the website operators, and to provide other services related to website and internet usage. Google may also transfer this information to third parties where required to do so by law or where such third parties process the data on Google’s behalf. Google may combine your IP address with other data held by Google.

The processing of your personal data is carried out on the basis of your consent.

Further information on data protection in connection with the use of Google Analytics can be found at: https://policies.google.com/privacy

Retention Period
Data stored by Google at user and event level that is linked to cookies, user identifiers (e.g. User ID), or advertising IDs (e.g. DoubleClick cookies, Android advertising ID) is anonymised or deleted after 14 months.

Google Analytics Remarketing

Our websites use the features of Google Analytics Remarketing in conjunction with the cross-device functionalities of Google Ads and Google DoubleClick.

This feature allows you to link advertising audiences created with Google Analytics Remarketing to the cross-device features of Google AdWords and Google DoubleClick. This means that interest-based, personalized advertising messages that have been tailored to you based on your previous usage and browsing behavior on one device (e.g., cell phone) can also be displayed on another of your devices (e.g., tablet or PC).

For this purpose, Google links your web and app browsing history with your Google account. In this way, the same personalised advertising messages can be displayed on any device on which you sign in with your Google account.

To support this feature, Google Analytics collects Google-authenticated user IDs, which are temporarily linked to our Google Analytics data to define and create audiences for cross-device advertising.

You can permanently opt out of cross-device remarketing/targeting by disabling personalized advertising in your Google Account; to do so, follow this link: https://www.google.com/settings/ads/onweb/.

The processing of your personal data is carried out on the basis of your consent.

Further information and the privacy policy can be found in Google’s privacy policy at: https://policies.google.com/technologies/ads?hl=de.

Google AdWords and Google Conversion Tracking

This website uses Google Ads. Google Ads is an online advertising programme provided by Google.

As part of Google Ads, we use what is known as conversion tracking. When you click on an advertisement placed by Google, a cookie for conversion tracking is set. These cookies expire after 30 days. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user clicked on the advertisement and was redirected to this page.

Each Google AdWords customer receives an individual cookie. These cookies cannot be tracked across the websites of AdWords customers. The information collected using the conversion cookie is used to generate conversion statistics for AdWords customers who have opted into conversion tracking. Customers receive information about the total number of users who clicked on their ad and were redirected to a page tagged for conversion tracking. However, they do not receive any information that could personally identify users.
The storage of “conversion cookies” and the use of this tracking tool are based on Article 6 (1) (f) GDPR.

The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising.

The processing of your personal data is carried out on the basis of your consent.

For more information about Google AdWords and Google Conversion Tracking, please refer to Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Google Maps

This website uses the Google Maps service via an API.

To use the functions of Google Maps, it is necessary to transmit your IP address to Google. This information is generally transferred to a Google server in the USA. The provider of this website has no influence over this data transfer.

The processing of your personal data is carried out on the basis of your consent.

For more information on how user data is handled, please refer to Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Formcrafts

Our website uses services provided by Formcrafts. Formcrafts, located at 225 Railway St E, T4C 2C3, Cochrane AB, Canada, provides a service for integrating questionnaires and forms into our website.

For this purpose, your responses are processed by Formcrafts and forwarded to us. Formcrafts is based in Canada. The European Commission has determined, by way of an adequacy decision, that Canada ensures a level of data protection equivalent to that of the EU.

The use of Formcrafts is based on our legitimate interest (Article 6 (1) (f) GDPR).

Handling applicant data

We offer you the opportunity to apply for a position with us (e.g., by email, post, or via our online application form). Below, we provide information about the scope, purpose, and use of your personal data collected during the application process. We assure you that the collection, processing, and use of your data will be carried out in accordance with applicable data protection law and all other legal provisions, and that your data will be treated as strictly confidential.

Scope and purpose of data collection

If you submit an application to us, we process the associated personal data (e.g. contact and communication data, application documents, notes taken during interviews, etc.) to the extent necessary for making a decision on the establishment of an employment relationship.

The legal basis for this processing is Section 26 BDSG under German law (initiation of an employment relationship), Article 6 (1) (b) GDPR (general pre-contractual measures) and – where you have given your consent – Article 6 (1) (a) GDPR. Consent may be withdrawn at any time. Your personal data will only be shared within our company with persons involved in processing your application.

If your application is successful, the data you submit will be stored in our data processing systems for the purpose of implementing the employment relationship on the basis of Section 26 of the German Federal Data Protection Act (BDSG) and Article 6(1)(b) of the GDPR.

Data retention period

If we are unable to offer you a position, you decline a job offer, or you withdraw your application, we reserve the right to store the data you have provided on the basis of our legitimate interests (Art. 6 (1) (f) GDPR) for up to 6 months from the end of the application process (rejection or withdrawal of the application). The data will then be deleted and the physical application documents destroyed. The storage serves in particular for evidence purposes in the event of a legal dispute. If it is apparent that the data will be required after the expiry of the 6-month period (e.g. due to an impending or pending legal dispute), deletion will only take place when the purpose for further storage no longer applies.

Data may also be stored for longer if you have given your consent (Art. 6 (1) (a) GDPR) or if statutory retention obligations prevent deletion.

Admission to the applicant pool

If we do not offer you a position, we may add you to our applicant pool. If you are added to the pool, all documents and information from your application will be transferred to the applicant pool so that we can contact you if a suitable vacancy arises.

Inclusion in the applicant pool is based solely on your express consent (Art. 6 (1) (a) GDPR). Consent is voluntary and is not related to the current application process. The data subject may revoke their consent at any time. In this case, the data will be irrevocably deleted from the applicant pool, unless statutory retention obligations apply.

The data from the applicant pool will be irrevocably deleted no later than two years after consent has been given.

To withdraw your consent regarding your application, please send an email to info@curato.de.