Privacy policy

III. general information on data processing

1. Legal basis for the processing of personal data.
Insofar as we obtain the consent of the data subject for processing operations involving personal data, Article 6 (1) (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) lit. b DSGVO serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.
Insofar as processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 (1) lit. c DSGVO serves as the legal basis.
In the event that vital interests of the data subject or another natural person make processing of personal data necessary, Art. 6 (1) lit. d DSGVO serves as the legal basis.
If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6 (1) lit. f DSGVO serves as the legal basis for the processing.

2. Data deletion and storage period
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may take place beyond this if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.

3. Passing on of personal data
Unless expressly stated in this paragraph or below in the description of the individual processing operations, your personal data will not be disclosed to third parties or other recipients.

For the provision (hosting) and for the content as well as technical operation of our website, we use the services of external service providers. The personal data collected on this website is stored on the hoster's servers and can be viewed by our technical service provider. This may include IP addresses, contact requests, meta and communication data, contract data, contact data, names, website accesses and other data generated via a website. The external service providers are used in the interest of a secure, fast and efficient provision of our website by a professional provider. The external service providers will only process your data to the extent necessary to fulfill their service obligations and will follow our instructions regarding the data processed for these purposes. We have concluded a contract on commissioned processing in accordance with Art. 28 DSGVO with each of the service providers used.

We reserve the right, in the event of a legal obligation, to disclose information about you if the disclosure is required of us by lawfully acting authorities or law enforcement bodies. The legal basis is Art. 6 para. 1 lit. c DSGVO (legal obligation).

IV. Provision of the website and creation of log files

1. Description and scope of data processing
Each time our website is called up, our system automatically collects data and information from the computer system of the calling computer.
The following data is collected in this process:

• The IP address of the user
• Date and time of access
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each case
• Information about the browser type and version used as well as language
• The user's operating system
• The user's Internet service provider
• Websites from which the user's system accesses our website
• Websites that are accessed by the user's system via our website

This data is also stored in the log files of our system. This data is not stored together with other personal data of the user.

2. Legal basis for data processing
The legal basis for the temporary storage of the data and the log files is Art. 6 para. 1 lit. f DSGVO.

3. Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.
The storage in log files is done to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.
These purposes are also our legitimate interest in data processing according to Art. 6 para. 1 lit. f DSGVO.

4. Duration of storage
The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.
In the case of storage of data in log files, this is the case after one month at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible.

b. Third-party cookies
We include content from third-party providers on our website to make our website more appealing. Some of these third-party providers set cookies through our website and can thereby analyze your user behavior on our website, but also across other websites.

2. legal basis for data processing
The legal basis for the processing of personal data using necessary cookies is Art. 6 (1) lit. f DSGVO.
The legal basis for the processing of personal data by third-party providers is your consent pursuant to Art. 6 (1) lit. a DSGVO. You can revoke your consent at any time with effect for the future by making a new selection in the Cookie setting in the info banner.

3. purpose of data processing
The purpose of using required cookies is to provide a secure, functional and user-friendly website.
We require cookies for the following applications:

• Cookie settings
• Technical protocols for the secure transmission of information.

The user data collected through required cookies is not used to create user profiles.

The use of third-party content, serves the purpose of presenting you with an appealing website.

4. Duration of storage, possibility of objection and removal.
Cookies are stored on the user's computer and transmitted from it to our site. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website in full.
VI. contact form and e-mail contact
1 Description and scope of data processing
A contact form is available on our website, which can be used for electronic contact. If a user takes advantage of this option, the data entered in the input mask is transmitted to us and stored. These data are:

• Name
• e-mail address
• Content of the request

At the time the message is sent, the following data is also stored:

• The IP address of the user
• Date and time of sending the request

Alternatively, it is possible to contact us via the e-mail address provided. In this case, the personal data of the user transmitted with the e-mail will be stored.
In this context, the data will not be passed on to third parties. The data is used exclusively for processing the conversation.

2. Legal basis for data processing

The legal basis for the processing of the data is Art. 6 para. 1 lit. f DSGVO. If the contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b DSGVO.

3. Purpose of the data processing
The processing of personal data serves to respond to your request. This is also the necessary legitimate interest in processing the data.
The other personal data processed during the submission process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

4. Duration of storage
The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. If no contract is concluded, this is the case when the respective conversation with the user has ended. The conversation is terminated when it can be inferred from the circumstances that the matter in question has been conclusively clarified.
If you request the generation of a portfolio via the contact form, the data contained therein will be deleted immediately after the generation of the portfolio.
Any additional personal data collected during the submission process will be deleted after a period of seven days at the latest.

VII. applications

1. Description and scope of data processing
You have the opportunity to apply for a job with us. If you send us your application, we will process your associated personal data to the extent necessary to decide on the establishment of a business relationship.
2. Legal basis for data processing
The legal basis for the processing of personal data in the context of your application is the initiation of an employment relationship in accordance with Section 26 of the German Federal Data Protection Act (BDSG) and Article 6 (1) lit. f DSGVO. If we obtain consent from you, your consent is the legal basis for the processing pursuant to Art. 6 (1) a DSGVO.
3. Purpose of the data processing
The purpose of the processing is the decision on the establishment of an employment relationship.
4. Duration of storage
If the application is successful, the application data will be stored for the purpose of the employment relationship.

If we are unable to make you a job offer or if you withdraw your application, we will store your application data for up to six months after the end of the application process in accordance with Art. 6 (1) lit. f DSGVO. Our legitimate interest in this case is the defense of legal claims.

VII. Content from third-party providers

On our website, we integrate content from the following third-party providers.

1. YouTube
For the provision of videos on our website, we use the video platform "YouTube" of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "Google").
By visiting the website, YouTube receives the information that you have accessed the corresponding sub-page of our website. In addition, the data mentioned in section IV.1 of this declaration is transmitted to Google. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be directly assigned to your account. If you do not want the assignment with your profile at YouTube, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right.

For more information on the purpose and scope of data collection and processing by YouTube, please see the privacy policy. There you will also find further information on your rights and setting options to protect your privacy: https://www.google.de/intl/de/policies/privacy.
Please note that Google also processes your data in the USA.
The legal basis for the processing of your data by YouTube is your consent pursuant to Art. 6 (1) lit. a DSGVO. To the extent necessary, your consent also includes the transfer of personal data to the USA pursuant to Art. 49 (1) lit. a DSGVO. You can revoke your consent at any time with effect for the future by making a new selection in the Cookie setting in the info banner.

When calling up our website, users are informed by an info banner (so-called cookie bar) about content requiring consent and are referred to this data protection declaration.

2. Vimeo
For the provision of videos on our website, we use the video platform "vimeo" of Vimeo.com, Inc, 555 West 18th Street, New York, New York 10011, USA (hereinafter "Vimeo").
In doing so, Vimeo generally transmits your IP address, as well as technical information about the device you are using (e.g. browser type, operating system and basic device information) to Vimeo, and Vimeo may also use cookies and other tracking technologies.

For details on the processing of personal data by Vimeo, please refer to the Vimeo privacy policy linked below at https://vimeo.com/privacy and cookie policy at https://vimeo.com/cookie_policy.
The videos embedded by the video platform in our app are embedded via the "do not track" setting in order to minimize data collection by Vimeo as much as possible.
Please note that Vimeo processes your data in the USA.
The legal basis for the processing of your data by Vimeo is your consent pursuant to Art. 6 para. 1 lit. a DSGVO. To the extent necessary, your consent also includes the transfer of personal data to the USA pursuant to Art. 49 (1) lit. a DSGVO. You can revoke your consent at any time with effect for the future by making a new selection in the Cookie settings in the info banner.

3. Yumpu
To provide an appealing user experience for viewing online catalogs on our website, we use the service Yumpu. The provider of Yumpu is i-magazine AG, Board of Directors Kuster Martin, Gewerbestrasse 3, 9444 Diepoldsau, Switzerland.
The integration of Yumpu takes place via so-called iFrames. Thereby the content of a Yumpu page is displayed as sub-content of this page. In addition, the data mentioned in section IV 1. of this declaration is transmitted to Yumpu. For more information, please refer to Yumpu's privacy policy at https://www.yumpu.com/de/info/privacy_policy. There you will also find further information about your rights and setting options for the protection of your privacy. i-magazine AG also processes your personal data in Switzerland (adequacy decision of the Commission (Art. 45 DS-GVO) is available, http://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:32016D2295&from=DE).
The legal basis for the processing of your data by Yumpu is your consent according to Art. 6 para. 1 lit. a DSGVO. You can revoke your consent at any time with future effect by making a new selection in the Cookie settings in the info banner.
When calling up our website, users are informed by an info banner (so-called cookie bar) about content requiring consent and referred to this privacy policy.

4. Podigee
For the provision of podcast on our website, we use the podcast hosting service Podigee of the provider Podigee GmbH, Schlesische Straße 20, 10997 Berlin, Germany. The podcasts are thereby loaded by Podigee or transmitted via Podigee.
Podigee processes IP addresses and device information to enable podcast downloads/playbacks and to determine statistical data, such as retrieval figures. This data is anonymized or pseudonymized before being stored in Podigee's database, unless it is necessary for the provision of the podcasts.
The legal basis for the processing of your data by Podigee is your consent pursuant to Art. 6 para. 1 lit. a DSGVO. You can revoke your consent at any time with effect for the future by making a new selection in the Cookie settings in the info banner.
When calling up our website, users are informed by an info banner (so-called cookie bar) about content requiring consent and referred to this data protection declaration.
Further information and objection options can be found in Podigee's privacy policy: https://www.podigee.com/de/about/privacy/.

VIII. Social media presences

1. Instagram
We operate a publicly accessible profile (so-called "fan page" in the social network Instagram at https://www.instagram.com/storyboard.gmbh/. The provider of Instagram is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (hereinafter: Meta).
When you visit our fan pages, Meta generally analyzes your user behavior. Meta also collects your device information. This occurs regardless of whether you are logged in to Instagram. Meta provides us with so-called "page insights" through which we receive the evaluation of the analysis of interactions with our fan page. For more information, please see Meta's privacy policy: https://www.facebook.com/about/privacy/.

We are jointly responsible for data processing with Meta. For this purpose, we have concluded a joint data processing agreement with Meta. This specifies who is responsible for which data processing operations when you visit our fanpages. You can view this agreement between us and Facebook here: https://www.facebook.com/legal/terms/page_controller_addendum.
We process your data for the purpose of effectively informing and supporting our customers and interested parties. This is our legitimate interest according to Art. 6 para. 1 lit. f DSGVO.
Please note that Meta may base its data processing operations on a different legal basis. For further information, please refer to the Privacy Policy as well as the Joint Processing Agreement.
We delete the data accruing in this context again after the storage is no longer necessary, unless there are legal retention obligations or statutes of limitations must be observed.
Since we are jointly responsible for data processing with Facebook, you can assert your rights both against us and against Facebook. Please note, however, that depending on the processing operation, we do not have full influence on the data processing, as this is predominantly carried out by Facebook.

More information about data processing at Instagram:
Data scope: https://privacycenter.instagram.com/policy/?section_id=1-WhatInformationDoWe
Data protection: https://privacycenter.instagram.com/policy/  

2. LinkedIn
We operate a publicly accessible profile (so-called "fan page" in the social network "LinkedIn". The provider of Linkedin is LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland.
When you visit, follow or engage with our LinkedIn company page, LinkedIn processes personal data to provide us with anonymized statistics and insights. This provides us with insights into the types of actions that people take on our page (so-called page insights). For this purpose, LinkedIn processes in particular such data that you have already provided to LinkedIn via the information in your profile, such as data on function, country, industry, seniority, company size and employment status. In addition, LinkedIn will process information about how you interact with our LinkedIn company page, such as whether you are a follower of our LinkedIn company page. With the page insights, LinkedIn does not provide us with any personal data about you. We only have access to the aggregated Page Insights. It is also not possible for us to draw conclusions about individual members via the information in the Page Insights. For further information about the processing of personal data by LinkedIn, please visit unter https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy.

The processing of personal data in the context of Page Insights is carried out by LinkedIn and us as joint controllers. The processing serves our legitimate interest to evaluate the types of actions taken on our LinkedIn company page and to improve our company page based on these insights. The legal basis for this processing is Art. 6 (1) lit. f DSGVO. We have entered into a joint controller agreement with LinkedIn, which sets out the distribution of data protection obligations between us and LinkedIn. The agreement is available at: https://legal.linkedin.com/pages-joint-controller-addendum. Thereafter, the following applies:

• LinkedIn and we have agreed that LinkedIn is responsible for enabling you to exercise your rights under the GDPR. You can contact LinkedIn to do so online via the following link (https://www.linkedin.com/help/linkedin/ask/PPQ?lang=de) or reach LinkedIn via the contact details in the Privacy Policy. You can contact the Data Protection Officer at LinkedIn Ireland via the following link: https://www.linkedin.com/help/linkedin/ask/TSO-DPO. You may also contact us at our provided contact details about exercising your rights in connection with the processing of personal data in the context of Page Insights. In such a case, we will forward your request to LinkedIn.
• LinkedIn and we have agreed that the Irish Data Protection Commission is the lead supervisory authority overseeing processing for Page Insights. You always have the right to lodge a complaint with the Irish Data Protection Commission (see at www.dataprotection.ie) or any other supervisory authority.

Please note that according to the LinkedIn Privacy Policy, personal data is also processed by LinkedIn in the USA or other third countries. LinkedIn states that it only transfers personal data to countries for which an adequacy decision has been issued by the European Commission in accordance with Article 45 of the GDPR or on the basis of suitable guarantees in accordance with Article 46 of the GDPR.

XIII. Rights of the data subject

You are entitled to the following data subject rights:

1. Right to information
You have the right to request information from us as to whether personal data relating to you is being processed and about this personal data.

2. Correction/deletion/restriction of processing
Furthermore, you have the right to demand from us that

• Inaccurate personal data concerning you be corrected without delay (right to rectification);
• personal data relating to you be erased without delay (right to erasure)processing be restricted (right to restriction of processing), provided that the relevant conditions are met in each case.

3. Right to data portability
You have the right to receive personal data concerning you that you have provided to us in a structured, common and machine-readable format and to transfer this data to another controller.

4. Right of revocation
You have the right to revoke your consent at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

5. Right of complaint
If you believe that the processing of personal data concerning you violates the GDPR, you have the right to lodge a complaint with a supervisory authority, without prejudice to other legal remedies.
XIII Automated decision-making and profiling.
In the context of processing your data, we do not use any fully automated decision-making or corresponding profiling within the meaning of Art. 22 DSGVO

XIV. Right of objection
If the processing of personal data relating to you is necessary to protect our legitimate interests (Art. 6 (1) (f) DSGVO), you have the right to object.
Our legitimate interests are presented by us in each case in the description of data processing When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as carried out by us. In the event of your justified objection, we will review the situation and either discontinue or adjust the data processing or show you our compelling legitimate grounds on the basis of which we will continue the processing.