Your Cookie preferences

Change your cookie and data privacy settings!

Privacy policy

This Privacy Policy clarifies the nature, scope and purpose of the processing of personal data (hereinafter referred to as “data”) within our online service and the associated websites, functions and content as well as external online presences, such as our Social Media Profile (hereinafter jointly referred to as “online offer”). With regard to the terms used, such as “processing” or “person responsible”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

Controller

SRC
Security Research & Consulting GmbH
Conformity Assessment Body
Emil-Nolde-Str.7
DE-53113 Bonn
Telephone: +49 (228) 2806 – 0
Telefax: +49 (228) 2806 – 199
Internet: www.src-zert.de/en
eMail: info@src-zert.de
CEO: Gerd Cimiotti
Commercial register: Bonn HRB 9414
VAT registration number: DE 212254844
https://src-zert.de/en/imprint/

You can contact our data protection officer as follows:

Florian Reichert
Adenauerallee 136
DE-53113 Bonn

Telephone: +49 (0) 228-227 226-0
Telefax: +49 (0) 228-227 226-26
Contact: https://www.scheja-partner.de/en/contact/contact.html

Types of data processed:

  • Inventory data (for example, names, addresses).
  • Contact details (e.g., e‑mail, telephone numbers).
  • Content data (e.g., text input, photographs, videos).
  • Usage data (e.g., visited websites, interest in content, access times).
  • Meta/communication data (e.g., device information, IP addresses).

Purpose of the data processing

  • Provision of the online offer, its functions and contents.
  • Response to contact requests and communication with users.
  • Security measures.
  • Range measurement / marketing

Terms used

“Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by assignment to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more special features that express the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. The term covers practically every handling of data.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Decisive legal bases

In accordance with Art. 13 GDPR, we inform you about the legal basis of our data processing. If the legal basis is not mentioned in the data protection declaration, the following applies: The legal basis for obtaining consents is Art. 6 para. 1 lit. a and Art. 7 GDPR, the legal basis for processing for the performance of our services and performance of contractual measures as well as for answering inquiries is Art. 6 para. 1 lit. b GDPR, the legal basis for processing to fulfil our legal obligations is Art. 6 para. 1 lit. c GDPR, and the legal basis for processing to protect our legitimate interests is Art. 6 para. 1 lit. f GDPR. In the event that the vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(d) GDPR serves as the legal basis.

Security measures

We ask you to inform yourself regularly about the contents of our privacy policy. We adapt the privacy policy as soon as changes in the data processing carried out by us require this. We will inform you as soon as the changes require your cooperation (e.g. consent) or if any other individual notification is required.

Cooperation with processors and third parties

If, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transfer them or grant them access to the data in any other way, this shall take place as follows

  • on the basis of a legal permission (e.g. if a transmission of the data to third parties, such as to payment service providers, is necessary in accordance with Art. 6 para. 1 lit. b GDPR for contract fulfilment),
  • if you have consented,
  • if a legal obligation requires it, or
  • on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

If we commission third parties with the processing of data on the basis of a so-called “processing contract”, this is done in accordance with the relevant requirements of Art. 28 GDPR.

Transfers to third countries

If we process data

  • in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or
  • the processing takes place in the context of the use of services of third parties, or
  • data will be disclosed or transmitted to third parties,

this only happens if it is

  • to fulfil our (pre)contractual obligations or on the basis of
  • your consent,
  • a legal obligation or
  • on the basis of our legitimate interests.

Subject to legal or contractual permissions, we process or have the data processed in a third country only if the special requirements of Art. 44 ff. GDPR are fulfilled. This means that the processing is carried out, for example, on the basis of special guarantees, such as the officially recognised determination of a data protection level corresponding to the EU or compliance with officially recognised special contractual obligations (so-called “standard contractual clauses”).

Rights of the data subject

Information rights

You have the right to receive information about your personal data stored by us.

Right of recttification and deletion

You can request us to rectify incorrect data and — insofar as the legal requirements are fulfilled — to delete your data.

Restriction of processing

As far as the legal requirements are fulfilled, you can demand that we restrict the processing of your data.

Data portability

If you have provided us with data on the basis of a contract or consent, you may, if the legal requirements are met, request that you receive the data provided by you in a structured, current and machine-readable format or that we transmit it to another person responsible.

Objection to data processing in the case of a “legitimate interest” legal basis

You have the right to object to our processing of your data at any time for reasons arising from your particular situation, insofar as this is based on the legal basis of “legitimate interest”. If you use your right of objection, we will stop processing your data unless we can — in accordance with the statutory provisions — prove compelling reasons worthy of protection for further processing, which exceed your rights.

Controlling the use of cookies

You can control the use of cookies at any time. Please refer to the Cookies section for details. We offer you an appropriate tool for this purpose.

Revocation of consent

If you have given us your consent to the processing of your data, you can revoke this at any time with effect for the future. The legality of the processing of your data until revocation remains unaffected by this.

Right of appeal at the supervisory authority

You may also lodge a complaint with the competent supervisory authority if you believe that the processing of your data is contrary to applicable law. You can contact the data protection authority responsible for your place of residence or country or the data protection authority responsible for us.

Your contact to us:

Furthermore, you can contact us free of charge with questions regarding the processing of your personal data, your data subject rights and any consent given. To make use of all your aforementioned rights, please contact datenschutz@src-gmbh.de or via post to the address indicated under point 1 above. Please ensure that we can uniquely identify you.

Right of objection in the case of a “legitimate interest” legal basis

Objection to data processing on the legal basis of “legitimate interest”: You have the right, for reasons arising from your particular situation, to object at any time to the future processing of the data concerning you by us, insofar as this is based on the legal basis of “legitimate interest”. If you exercise your right of objection, we will stop the processing of your data unless we can — in accordance with the statutory provisions — prove compelling reasons worthy of protection for further processing, which outweigh your rights.

To exercise your right of objection, please contact us at datenschutz@src-gmbh.de or by post at the address given above under “Controller”.

Cookies

“Cookies” are small files that are stored on the user’s computer. Different data can be stored within the cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after his or her visit to an online offer. Temporary cookies, or “session cookies” or “transient cookies”, are cookies that are deleted after a user leaves an online offer and closes the browser. In such a cookie, for example, the content of a shopping basket can be stored in an online shop or a login jam. Cookies are referred to as “permanent” or “persistent” if they remain stored even after the browser is closed. For example, the login status can be saved when users visit it after several days. Likewise, the interests of users used for range measurement or marketing purposes may be stored in such a cookie. “Third-party cookies” are cookies that are offered by providers other than the person responsible for operating the online offer (otherwise, if they are only operator cookies, they are referred to as “first-party cookies”).

We may use temporary and permanent cookies and explain this when using our website. When you visit our website for the first time, you will receive a pop-up message at the bottom of the screen with information on the use of cookies. If you click on the accept button, we save a cookie so that we know that you have taken note of our message and that it will not be displayed again on your next visit.

If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of this online offer.

The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 lit. f GDPR. Our legitimate interests are the simplification of the use of our website and the recognition of the user’s browser even after a switch of the website.

Deletion of data

The data processed by us will be deleted or their processing restricted in accordance with Articles 17 and 18 GDPR. Unless expressly stated in this data protection declaration, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and the deletion does not conflict with any statutory storage obligations. If the data is not deleted because it is necessary for other and legally permissible purposes, its processing is restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.
In accordance with statutory requirements in Germany, the records are kept in particular for 6 years in accordance with § 257 (1) HGB (trading books, inventories, opening balance sheets, annual financial statements, commercial letters, accounting documents, etc.) and for 10 years in accordance with § 147 (1) AO (books, records, management reports, accounting documents, commercial and business letters, documents relevant for taxation, etc.).

Order processing for services

We process our customers’ data as part of the ordering process in our online ticket management system to enable them to select and order the selected products and services, as well as their payment and delivery or execution.

The processed data includes inventory data, communication data, contract data, payment data. The persons affected by the processing include our customers, interested parties and other business partners. The processing takes place for the purpose of providing contractual services in the context of operating an online shop, billing, delivery and customer services. We use session cookies for storing the contents of the shopping cart and permanent cookies for storing the login status.

Processing is carried out on the basis of Art. 6 Para. 1 lit. b (execution of order processes) and c (legally required archiving) GDPR. The information marked as necessary is required to establish and fulfil the contract. We disclose the data to third parties only within the framework of delivery, payment or within the framework of legal permits and obligations to legal advisors and authorities. The data will only be processed in third countries if this is necessary for the fulfilment of the contract (e.g. at the customer’s request upon delivery or payment).

When registering, re-registering and using our online services, we store the IP address and the time of the respective user action. This data is stored on the basis of our legitimate interests as well as the users’ interest in protection against misuse and other unauthorized use. A passing on of this data to third parties does not take place in general, unless it is necessary to pursue our claims or there is a legal obligation according to Art. 6 para. 1 lit. c GDPR.

The deletion takes place after the expiry of statutory warranty and comparable obligations, the necessity of data storage is reviewed every three years; in the case of statutory archiving obligations, the deletion takes place after their expiry (end of commercial law (6 years) and tax law (10 years) storage obligation).

Agency services

We process our customers’ data as part of our contractual services, which include conceptual and strategic consulting, campaign planning, software and design development / consulting or maintenance, implementation of campaigns and processes / handling, server administration, data analysis / consulting services and training services.

We process inventory data (e.g., customer master data, such as names or addresses), contact data (e.g., e‑mail, telephone numbers), content data (e.g., text entries, photographs, videos), contract data (e.g., subject matter of the contract, term), payment data (e.g., bank details, payment history), usage and metadata (e.g. as part of the evaluation and performance measurement of marketing measures). We do not process special categories of personal data unless these are part of commissioned processing. This includes our customers, prospects, their customers, users, website visitors or employees, as well as third parties. The purpose of the processing is to provide contractual services, billing and our customer service. The legal basis for processing results from Art. 6 para. 1 lit. b GDPR (contractual services), Art. 6 para. 1 lit. f GDPR (analysis, statistics, optimisation, safety measures). We process data which are necessary to justify and fulfil the contractual services and point out the necessity of their disclosure. Disclosure to external parties only takes place if it is necessary within the framework of an order. When processing the data provided to us within the scope of an order, we act in accordance with the instructions of the client and the legal requirements for order processing pursuant to Art. 28 GDPR and process the data for no other purposes than those stipulated in the order.

We delete the data after the expiry of statutory warranty and comparable obligations. The necessity of storing the data is checked every three years; in the case of statutory archiving obligations, the data is deleted after their expiry (6 years, in accordance with § 257 Paragraph 1 HGB, 10 years, in accordance with § 147 Paragraph 1 AO). In the case of data disclosed to us within the scope of an order by the customer, we delete the data in accordance with the specifications of the order, generally after the end of the order.

Fulfilment of contractual services

We process inventory data (e.g., names and addresses as well as contact data of users), contract data (e.g., services used, names of contact persons, payment information) for the purpose of fulfilling our contractual obligations and services pursuant to Art. 6 para. 1 lit b. GDPR. The entries marked as obligatory in online forms are required for the conclusion of the contract.

When using our online services, we store the IP address and the time of the respective user action. The data is stored on the basis of our legitimate interests as well as the user’s protection against misuse and other unauthorized use. A passing on of this data to third parties does not take place in principle, unless it is necessary for the pursuit of our claims or there is a legal obligation according to Art. 6 Abs. 1 lit. c GDPR.
The data will be deleted after the expiry of statutory warranty and comparable obligations; the necessity of storing the data will be reviewed every three years; in the case of statutory archiving obligations, the data will be deleted after their expiry. Information in the possible customer account remain up to its deletion.

Administration, financial accounting, office organisation, contact management

We process data within the framework of administrative tasks as well as the organisation of our company, financial accounting and compliance with legal obligations, e.g. archiving. We process the same data that we process as part of the performance of our contractual services. The processing bases are Art. 6 para. 1 lit. c. GDPR, Art. 6 para. 1 lit. f. GDPR. Customers, prospects, business partners and website visitors are affected by the processing. The purpose and our interest in the processing lies in the administration, financial accounting, office organization, archiving of data, thus tasks which serve the maintenance of our business activities, and the provision of our services. The deletion of the data with regard to contractual services and contractual communication corresponds to the information provided in these processing activities.

We disclose or transmit data to the tax authorities, consultants, such as tax consultants or auditors, as well as other fee offices and payment service providers.

Furthermore, we store information on suppliers, event organisers and other business partners on the basis of our business interests, e.g. for the purpose of making contact at a later date. We store this data, which is mainly company-related, permanently.

Business analyses and market research

In order to operate our business economically and to identify market trends, customer and user requirements, we analyse the data available to us on business transactions, contracts, enquiries, etc., in order to ensure that we are able to offer our customers the best possible service. We process inventory data, communication data, contract data, payment data, usage data, metadata on the basis of Art. 6 para. 1 lit. f. GDPR, whereby the persons concerned include customers, interested parties, business partners, visitors and users of the online offer.

The analyses are carried out for the purpose of economic evaluations, marketing and market research. In doing so, we can consider the profiles of registered users with information e.g. about their purchase processes. The analyses serve us to increase the user-friendliness, the optimization of our offer and the economic efficiency. The analyses serve us alone and are not disclosed externally, unless they are anonymous analyses with aggregated values.

If these analyses or profiles are personal, they will be deleted or made anonymous upon termination of the user, otherwise after two years from the conclusion of the contract. For the rest, macroeconomic analyses and general trend determinations are prepared anonymously wherever possible.

Privacy policy in the application process

We process the applicant data only for the purpose and in the context of the application procedure in accordance with the legal requirements. The processing of the applicant data takes place in order to fulfil our (pre)contractual obligations in the context of the application procedure within the meaning of Art. 6 para. 1 lit. b. GDPR Art. 6 para. 1 lit. f. GDPR if data processing becomes necessary for us, e.g. within the framework of legal procedures (in Germany § 26 BDSG additionally applies).

The application procedure requires that applicants provide us with their data. If we offer an online form, the necessary applicant data are marked otherwise result from the job descriptions and generally include personal data, postal and contact addresses and the documents belonging to the application, such as cover letter, curriculum vitae and certificates. In addition, applicants may voluntarily provide us with additional information.

By submitting the application to us, applicants agree to the processing of their data for the purposes of the application procedure in accordance with the type and scope set out in this data protection declaration.

Insofar as special categories of personal data within the meaning of Art. 9 para. 1 GDPR are voluntarily communicated within the scope of the application procedure, they are additionally processed in accordance with Art. 9 para. 2 letter b GDPR (e.g. health data, e.g. severely disabled status or ethnic origin). If special categories of personal data within the meaning of Art. 9 para. 1 GDPR are requested from applicants during the application procedure, they are additionally processed in accordance with Art. 9 para. 2 lit. a GDPR (e.g. health data, if these are required for the exercise of the profession).

Applicants can send us their applications via an online form on our website. The data is encrypted and transmitted to us according to the state of the art.

Applicants can also send us their applications by e‑mail. Please note, however, that e‑mails are generally not sent in encrypted form and that the applicants themselves must ensure that they are encrypted. We cannot therefore accept any responsibility for the transmission of the application between the sender and receipt on our server and therefore recommend that you use an online form or the postal dispatch. Instead of applying via the online form or by e‑mail, applicants can still send us their application by post.

If the application is successful, the data provided by the applicants can be further processed by us for the purpose of employment. Otherwise, if the application for a job offer is not successful, the applicants’ data will be deleted. Applicants’ data will also be deleted if an application is withdrawn, which the applicants are entitled to do at any time.

The deletion will take place after a period of six months, subject to a justified revocation by the applicant, so that we can answer any follow-up questions to the application and meet our obligations under the Equal Treatment Act. Invoices for any reimbursement of travel expenses are archived in accordance with tax regulations.

Contacting

When contacting us (e.g. via contact form, e‑mail or telephone), the user’s data will be processed in order to process the contact request and to handle it in accordance with Art. 6 Para. 1 lit. b) GDPR. User information can be stored in a customer relationship management system (“CRM system”) or comparable request organization.

We delete the requests if they are no longer necessary. We review the necessity every two years; the statutory archiving obligations also apply.

Newsletter

With the following information we inform you about the contents of our newsletter as well as the registration, mailing and statistical evaluation procedure and your rights of objection. By subscribing to our newsletter you agree to the reception and the described procedures.

Contents of the newsletter

We will only send newsletters, e‑mails and other electronic notifications containing advertising information (hereinafter “newsletters”) with the consent of the recipients or a legal permission. If the contents of a newsletter are specifically described within the scope of a registration, they are decisive for the consent of the users. In addition, our newsletters contain information about our services and us.

Double-Opt-In and logging

The registration for our newsletter takes place in a so-called double opt-in procedure. This means that you will receive an e‑mail after your registration in which you will be asked to confirm your registration. This confirmation is necessary so that nobody can register with external e‑mail addresses. The registrations for the newsletter are logged in order to be able to prove the registration process according to the legal requirements. This includes the storage of the registration and confirmation time, as well as the IP address. Likewise the changes of your data stored with the service provider are logged.

Registration details

To subscribe to the newsletter, simply enter your e‑mail address. Optionally we ask you to indicate a name for the purpose of personal address in the newsletter.

The dispatch of the newsletter and the performance measurement associated with it is based on the recipient’s consent pursuant to Art. 6 para. 1 lit. a, Art. 7 GDPR in conjunction with § 7 para. 2 no. 3 UWG or on the basis of the legal permission pursuant to § 7 para. 3 UWG.

The registration procedure is recorded on the basis of our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR. We are interested in the use of a user-friendly and secure newsletter system that serves both our business interests and the expectations of users and also allows us to provide proof of consent.

Cancellation / Revocation

You can cancel the receipt of our newsletter at any time, i.e. revoke your consent. You will find a link to cancel the newsletter at the end of each newsletter. We may store the e‑mail addresses we have unsubscribed for up to three years on the basis of our legitimate interests before we delete them in order to be able to prove a previously given consent. The processing of these data is limited to the purpose of a possible defence against claims. An individual application for cancellation is possible at any time, provided that at the same time the former existence of a consent is confirmed.

Newsletter – Mailing service provider

The newsletter is sent by the mailing service provider MailJet GmbH, Rankestr. 21, 10789 Berlin, Germany. The data protection regulations of the shipping service provider can be viewed here: https://www.mailjet.de/privacy-policy/. The mailing service provider is used on the basis of our legitimate interests according to Art. 6 Para. 1 letter f GDPR and an order processing contract according to Art. 28 Para. 3 S. 1 GDPR.

The mailing service provider can use the recipient’s data in pseudonymous form, i.e. without assignment to a user, to optimise or improve its own services, e.g. for technical optimisation of the dispatch and presentation of the newsletter or for statistical purposes. However, the mailing service provider does not use the data of our newsletter recipients to contact them itself or to pass the data on to third parties.

Range measurement with Matomo

Within the scope of Matomo’s range analysis, based on our legitimate interests (i.e. interest in the analysis, optimization and economic operation of our online offer within the meaning of Art. 6 para. 1 lit. f. GDPR) processes the following data: The browser type and version you use, the operating system you use, your country of origin, date and time of the server request, the number of visits, your time spent on the website and the external links you clicked. The IP address of the users is anonymized before it is stored.

Matomo uses cookies which are stored on the user’s computer and which enable an analysis of the use of our online offer by the user. Pseudonymous user profiles can be created from the processed data. The cookies are stored for one week. The information generated by the cookie about your use of this website is only stored on our server and not passed on to third parties.

Users must consent to the anonymous collection of data by the Matomo program through the tool provided. In this case, a so-called Opt-In-Cookie is stored in their browser, which means that Matomo collects the session data listed above. If users delete their cookies, however, this will result in the Opt-In cookie also being deleted and therefore having to be reactivated by the users.

The logs containing user data will be deleted after 6 months at the latest.

Connection of third-party services and content

Within our online offer, we provide information based on our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offer within the meaning of Art. 6 para. 1 letter f) GDPR) of content or service offerings of third parties in order to embed their content and services, such as videos or fonts (hereinafter uniformly referred to as “content”).

This always requires that the third party providers of this content perceive the IP address of the users, since without the IP address they could not send the content to their browser. The IP address is therefore required for the display of this content. We endeavour to use only those contents whose respective providers use the IP address only for the delivery of the contents. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. “Pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may include technical information about the browser and operating system, referring websites, visiting time and other information about the use of our online offer, as well as be linked to such information from other sources.

Google ReCaptcha

We use the function for the detection of bots, e.g. for entries in online forms (“ReCaptcha”) of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/, Opt-out function indicated by Google: https://adssettings.google.com/authenticated.