Privacy policy and legal information - secrypt GmbH

Thank you for visiting our website or using our software and/or our services and thank you for your interest in our company. The protection of your personal rights is important to us. You can rest assured that we will handle your data responsibly and in a trustworthy manner.

1. Introduction
2. Data Processing When Visiting Our Website
3. Use of Cookies
4. Collection of General Data and Information
5. Use of Google Services
6. Static Linking of Linkedin, Facebook, Google+, XING
7. Processing of Data When Using Our Online Forms or Other Means of Contact
8. Processing of Data When Subscribing to Our Newsletters
9. Processing of Data When Using Our Software and Services
10. Data Protection for Job Applications and the Job Application Process
11. Deletion of Personal Data
12. Rights of the Data Subject

The use of our website is generally possible without providing any personal data. However, if special services of our company are to be used via our website, the processing of personal data may be required. If the processing of personal data is necessary and there is no lawful basis for such processing, we generally obtain the consent of the data subject.

Personal data affected includes, for example, customer data, business partner data, supplier data, employee data, data of former employees, prospect data, and applicant data. Recipients or categories of recipients of the data include public authorities that receive data based on statutory regulations (e.g., social insurance agencies, tax authorities, supervisory authorities) as well as internal departments involved in executing the respective business processes (primarily: human resources management, accounting, finance, purchasing, marketing, general administration, sales, telecommunications, and IT).

Data transfers to third countries occur only within the scope of contract fulfillment, necessary communication, or other legally expressly provided exceptions. Otherwise, no transfer to third countries takes place, nor is it planned.

Our website also includes content, services, and offerings from other providers. These include, among others, Google Analytics, Google AdWords, Google Maps, and Google reCAPTCHA. To display these data in the user’s browser, the transmission of the IP address is essential. The providers therefore become aware of the IP address of the respective user.

The processing of personal data, such as the gender, name, address, email address, or telephone number of a data subject, takes place in accordance with the requirements of the EU General Data Protection Regulation (GDPR). With this privacy policy, secrypt GmbH aims to inform the public about the type, scope, and purpose of the personal data collected, used, and processed. Moreover, data subjects are informed of their rights under this privacy policy.

secrypt GmbH has implemented measures to ensure the most comprehensive protection of personal data processed via this website. However, we note that internet-based data transmission (e.g., communication by email) may have security gaps. Complete protection of data from third-party access is not possible. Therefore, each data subject is free to transmit personal data to us by alternative means, such as by telephone.

The website of secrypt GmbH collects a series of general data and information each time the website is accessed by a data subject or an automated system. This general data and information are stored in the server’s log files. Data that can be collected includes the browser types and versions used, the operating system used by the accessing system, the website from which an accessing system reaches our website, the sub-websites that are accessed via an accessing system on our website, the date and time of an access to the website, an internet protocol address (IP address), the internet service provider of the accessing system, and other similar data and information that serve the purpose of averting danger in the event of attacks on our IT systems.

When using these general data and information, secrypt GmbH does not draw any conclusions about the data subject. Rather, this information is needed to deliver the content of our website correctly, optimize the content of our website and the advertising for it, ensure the continued functionality of our IT systems and the technology of our website, and provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack. Therefore, secrypt GmbH analyzes anonymously collected data and information statistically, with the aim of increasing the data protection and data security of our company and ultimately ensuring an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.

Our website links to the websites set up by secrypt GmbH on Facebook, Google+, XING, and LinkedIn using static links (not “social plugins”). The terms of use and privacy policies can be viewed on the respective websites.

If you sign up for our newsletter, we use the data you provide solely for that purpose or to inform you of circumstances relevant to the service or registration. We do not pass this data on to third parties.

To receive the newsletter, a valid email address is required. Additionally, the IP address used to register for the newsletter and the date on which the newsletter was ordered are stored. These data serve as evidence in case of misuse, should a third-party email address be registered for the newsletter.

You can revoke your consent to the storage of data, the email address, and its use for sending the newsletter at any time. A contact possibility for this purpose is provided in every newsletter and on the website. You also have the option to inform us of your revocation request via the contact methods mentioned on this website.

secrypt GmbH collects and processes the personal data of job applicants for the purpose of handling the application process. Processing can also occur electronically, particularly if an applicant submits the relevant application documents electronically, such as by email. If secrypt GmbH enters into an employment contract with an applicant, the submitted data will be stored for the purpose of handling the employment relationship in compliance with legal requirements. If secrypt GmbH does not conclude an employment contract with the applicant, the application documents will be automatically deleted six months after the rejection decision is announced, provided that no other legitimate interests of the controller preclude deletion. A legitimate interest in this sense, for example, is an obligation to provide evidence in a procedure under the German General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz, AGG).

Right to Obtain Confirmation

Every data subject has the right, granted by the legislator, to request confirmation from secrypt GmbH as to whether personal data concerning them are being processed. If a data subject wishes to exercise this right, they may contact our responsible office at any time.

Right to be Informed

Each data subject affected by the processing of personal data has the right, granted by the legislator, to receive free information about the personal data stored about them and a copy of this information at any time. Furthermore, the data subject has the right to obtain the following information:

• the processing purposes
• the categories of personal data being processed
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations
• where possible, the planned duration for which the personal data will be stored or, if not possible, the criteria for determining this duration
• the existence of a right to rectify or erase the personal data concerning them, to restrict the processing by the controller, or to object to such processing
• the existence of a right to lodge a complaint with a supervisory authority
• where the personal data are not collected from the data subject: all available information about the source of the data
• the existence of automated decision-making, including profiling, as per Article 22 (1) and (4) of the GDPR and, at least in such cases, meaningful information about the logic involved and the scope and intended impact of such processing on the data subject

Moreover, the data subject has a right to be informed whether personal data have been transferred to a third country or to an international organization.

If this is the case, the data subject has the right to be informed about the appropriate safeguards relating to the transfer. If a data subject wishes to exercise this right, they may contact our responsible office at any time.

Right to Rectification

Every data subject affected by the processing of personal data has the right, granted by the legislator, to request the immediate rectification of inaccurate personal data concerning them. Furthermore, the data subject has the right to request the completion of incomplete personal data, including by means of a supplementary statement, taking into account the purposes of the processing. If a data subject wishes to exercise this right, they may contact our responsible office at any time.

Right to Erasure / Right to Be Forgotten

Every data subject affected by the processing of personal data has the right, granted by the legislator, to demand from the controller the immediate erasure of personal data concerning them, provided that one of the following reasons applies and as long as the processing is not necessary:

• The personal data was collected or otherwise processed for purposes for which it is no longer necessary.
• The data subject withdraws their consent on which the processing is based as per Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, and there is no other lawful basis for the processing.
• The data subject objects to the processing per Article 21(1) of the GDPR, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing per Article 21(2) of the GDPR.
• The personal data has been unlawfully processed.
• The erasure of personal data is necessary to fulfill a legal obligation under EU or Member State law to which the controller is subject.
• The personal data was collected in relation to the offer of information society services as per Article 8(1) of the GDPR.

If one of the aforementioned reasons applies and a data subject wishes to request the deletion of personal data stored by secrypt GmbH, they may contact our responsible office at any time, who will ensure that the deletion request is promptly complied with. If the personal data has been made public by secrypt GmbH and our company, as the controller, is obliged to delete the personal data in accordance with Article 17(1) of the GDPR, secrypt GmbH will, taking into account available technology and implementation costs, take reasonable measures, including technical measures, to inform other controllers processing the published personal data that the data subject has requested these controllers delete any links to, or copies or replications of, that personal data, as far as processing is not necessary.

Right to Restriction of Processing

Every data subject affected by the processing of personal data has the right, granted by the legislator, to request the restriction of processing from the controller under one of the following conditions:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of its use instead.
• The controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise, or defense of legal claims.
• The data subject has objected to processing pursuant to Article 21(1) of the GDPR, and it has not yet been determined whether the legitimate grounds of the controller override those of the data subject.

If one of the above conditions applies and a data subject wishes to request the restriction of personal data stored by secrypt GmbH, they may contact our responsible office at any time.

Right to Data Portability

Every data subject affected by the processing of personal data has the right, granted by the legislator, to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format. They also have the right to transmit this data to another controller without hindrande from the controller to whom the personal data was provided, as long as the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, in exercising their right to data portability pursuant to Article 20(1) of the GDPR, the data subject has the right to have personal data transmitted directly from one controller to another, where technically feasible and where this does not adversely affect the rights and freedoms of others. To assert the right to data portability, the data subject may contact our responsible office at any time.

Right to Object

Every data subject affected by the processing of personal data has the right, granted by the legislator, to object, at any time, on grounds relating to their particular situation, to the processing of personal data concerning them, which is based on Article 6(1)(e) or (f) of the GDPR. This also applies to profiling based on these provisions. secrypt GmbH will no longer process the personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing is for the establishment, exercise, or defense of legal claims.

If secrypt GmbH processes personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data for such marketing. This also applies to profiling insofar as it is related to such direct marketing. If the data subject objects to secrypt GmbH processing for direct marketing purposes, secrypt GmbH will no longer process the personal data for these purposes.

Additionally, the data subject has the right, on grounds relating to their particular situation, to object to the processing of personal data concerning them for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest. To exercise the right to object, the data subject may directly contact our responsible office. The data subject is also free to exercise their right to object in the context of the use of information society services, notwithstanding Directive 2002/58/EC, by means of automated procedures using technical specifications.

Automated Individual Decision-Making, Including Profiling

Every data subject affected by the processing of personal data has the right, granted by law, not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for the conclusion or performance of a contract between the data subject and the controller, or is authorized by Union or Member State law to which the controller is subject and which also provides appropriate measures to safeguard the rights, freedoms, and legitimate interests of the data subject, or is based on the explicit consent of the data subject. If the decision is necessary for the conclusion or performance of a contract between the data subject and the controller, or if it is made with the explicit consent of the data subject, secrypt GmbH shall take appropriate measures to safeguard the rights, freedoms, and legitimate interests of the data subject, which include at least the right to obtain human intervention from the controller, to express their point of view, and to contest the decision. If the data subject wishes to assert rights regarding automated decision-making, they may contact our responsible office at any time.

Right to Withdraw Data Protection Consent

Every data subject affected by the processing of personal data has the right, granted by the legislator, to withdraw their consent to the processing of personal data at any time. If the data subject wishes to exercise their right to withdraw consent, they may contact our responsible office at any time.

secrypt GmbH, October 2024