We are very pleased about your interest in our company. Data protection has a particularly high priority for the management of HCD Consulting GmbH. As a rule, the websites of HCD Consulting GmbH can be used without providing any personal data. However, if a data subject wishes to use special services of our company via our website, the processing of personal data may become necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the consent of the data subject.

The processing of personal data, such as the name, address, email address or telephone number of a data subject, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection provisions applicable to HCD Consulting GmbH. By means of this privacy policy, our company wishes to inform the public about the type, scope and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed of their rights by means of this privacy policy.

As the controller, HCD Consulting GmbH has implemented numerous technical and organizational measures to ensure the most complete protection possible of personal data processed via this website. Nevertheless, internet-based data transmissions can generally have security gaps, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us by alternative means, for example by telephone.

A. BASIC INFORMATION PURSUANT TO ARTICLES 13/14 GDPR

1. Responsible entity

Responsible for the collection and processing of your personal data as well as for compliance with data protection regulations is:

HCD Consulting GmbH
Billerberg 5
82266 Inning am Ammersee
Germany
Tel.: +49 89 215 37 01-0
Email: info@hcd-consulting.de

2. Contact for data protection

Our officially appointed Data Protection Officer can be reached at the following contact details:
HCD Consulting GmbH – Data Protection
Billerberg 5
82266 Inning am Ammersee
Email: datenschutz@hcd-consulting.de

3. Supervisory authority

If you believe that the processing of your personal data by HCD Consulting GmbH is not lawful, you can lodge a complaint with the data protection supervisory authority. The supervisory authority responsible pursuant to Article 55 GDPR is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Phone: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800
Email: poststelle@lda.bayern.de

B. DEFINITIONS

The privacy policy of HCD Consulting GmbH is based on the terms used by the European legislator when issuing the General Data Protection Regulation (GDPR). Our privacy policy is intended to be easy to read and understand for the public as well as for our customers and business partners. To ensure this, we would like to explain the terms used in advance.

In this privacy policy, we use, among others, the following terms:

a) Personal data
Personal data means any information relating to an identified or identifiable natural person (hereinafter “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Data subject
Data subject is any identified or identifiable natural person whose personal data is processed by the controller responsible for the processing.

c) Processing
Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of processing
Restriction of processing means the marking of stored personal data with the aim of limiting their processing in the future.

e) Profiling
Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

f) Pseudonymization
Pseudonymization means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

g) Controller or controller responsible for the processing
Controller or controller responsible for the processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

h) Processor
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

i) Recipient
Recipient means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

j) Third party
Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

k) Consent
Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

C. PURPOSES AND SCOPE OF DATA PROCESSING

1. Processing of communications data

Each time a user accesses a page of HCD Consulting GmbH, access data about this process is stored in a log file on our server.

Each record consists of:

• IP address
• Date and time
• Page accessed/name of the file retrieved
• Amount of data transferred
• Message indicating whether access/retrieval was successful
• Browser including version and operating system
• In the event of an error, the error message is stored

We store IP addresses for a period of 12 weeks in server log files. Storage is carried out for reasons of data security in order to ensure the stability and operational security of our web presence. The legal basis for this is Article 6(1)(c) GDPR.

2. Recipients of the data

We generally do not disclose your data to third parties unless you have given your consent. However, for hosting and maintaining our website, we rely on service providers whom we obligate, via a data processing agreement pursuant to Article 28 GDPR, to comply with the legal requirements.

3. Cookies & tracking

The websites of HCD Consulting GmbH use cookies. Cookies are text files that are placed and stored on a computer system via an internet browser.
Many websites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a string of characters through which websites and servers can be assigned to the specific internet browser in which the cookie was stored. This enables visited websites and servers to distinguish the individual browser of the data subject from other internet browsers that contain other cookies. A specific internet browser can be recognized and identified via the unique cookie ID.
By using cookies, HCD Consulting GmbH can provide users of this website with more user-friendly services that would not be possible without the cookie setting.

The information and offers on our website can be optimized with the user in mind by means of a cookie. As already mentioned, cookies enable us to recognize the users of our website. The purpose of this recognition is to make the use of our website easier for users. For example, the user of a website that uses cookies does not have to re-enter his or her access data each time he or she visits the website, because this is taken over by the website and the cookie stored on the user’s computer system. Another example is the cookie of a shopping cart in an online shop. The online shop remembers the items that a customer has placed in the virtual shopping cart via a cookie.

The data subject can prevent the setting of cookies by our website at any time by means of an appropriate setting of the internet browser used and can thus permanently object to the setting of cookies. Furthermore, already set cookies can be deleted at any time via an internet browser or other software programs. This is possible in all common internet browsers. If the data subject deactivates the setting of cookies in the internet browser used, not all functions of our website may be fully usable.

4. Collection of general data and information

With each call-up of the website of HCD Consulting GmbH by a data subject or an automated system, a series of general data and information is collected and stored in the server log files. The following may be collected: (1) browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrer), (4) the subpages which are accessed via an accessing system on our website, (5) the date and time of access to the website, (6) an internet protocol address (IP address), (7) the internet service provider of the accessing system and (8) any other similar data and information that serve the purpose of averting danger in the event of attacks on our information technology systems.
When using these general data and information, HCD Consulting GmbH does not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the contents of our website correctly, (2) optimize the content of our website as well as its advertising, (3) ensure the long-term functionality of our information technology systems and website technology, and (4) provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack. These anonymously collected data and information are therefore evaluated by HCD Consulting GmbH on the one hand statistically and also with the aim of increasing data protection and data security in our company, in order ultimately to ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.

5. Who receives your data?

Within HCD Consulting GmbH, only those persons who need your personal data to make decisions regarding your employment and to fulfill our legal and contractual obligations will have access to it.

Disclosure within the corporate group:
HCD Consulting GmbH belongs to a corporate group (PromoData GmbH, Green IT Solution GmbH, Green IT Services GmbH and HCD Consulting GmbH).
Within the framework of jointly used management systems (certified according to ISO 9001, 27001, 45001 and EMAS) as well as joint internal policies, personal data may be transferred to other companies in the group if this is necessary to carry out or support the respective processing activity.
Such a transfer shall take place exclusively if the processing or task in question is actually carried out by another group company (e.g., IT, HR or accounting services).
All affiliated companies are contractually and organizationally obliged to comply with data protection requirements.

Where applicable, we also transmit personal data to HCD Consulting AG (a 100% subsidiary of HCD Consulting GmbH) in Switzerland, insofar as this is necessary for internal administrative purposes, for the provision of services or for the performance of a contract (Article 6(1)(b) or (f) GDPR). An adequacy decision of the European Commission exists for Switzerland. This means that the level of data protection there corresponds to that in the EU; additional safeguards (e.g., standard contractual clauses) are not required.
Apart from this, we only transmit your personal data if we are legally obliged to do so (e.g., to law enforcement authorities).

6. Rights of the data subject

a) Right to confirmation
Every data subject has the right granted by the European legislator to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. If a data subject wishes to exercise this right to confirmation, he or she may contact an employee of the controller at any time.

b) Right of access
Every data subject has the right granted by the European legislator to obtain from the controller, at any time and free of charge, information about the personal data stored about him or her and a copy of this information. Furthermore, the European legislator has granted the data subject access to the following information:

• the purposes of the processing
• the categories of personal data that are processed
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
• the existence of the right to request rectification or erasure of personal data concerning him or her, or restriction of processing by the controller, or to object to such processing
• the existence of the right to lodge a complaint with a supervisory authority
• where the personal data are not collected from the data subject, any available information as to their source
• the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.

Furthermore, the data subject shall have a right to obtain information as to whether personal data are transferred to a third country or to an international organization. Where this is the case, the data subject also has the right to be informed of the appropriate safeguards relating to the transfer.

If a data subject wishes to exercise this right of access, he or she may contact an employee of the controller at any time.

c) Right to rectification
Every data subject has the right granted by the European legislator to obtain without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of a supplementary statement.

If a data subject wishes to exercise this right to rectification, he or she may contact an employee of the controller at any time.

d) Right to erasure (right to be forgotten)
Every data subject has the right granted by the European legislator to obtain from the controller the erasure of personal data concerning him or her without undue delay where one of the following grounds applies and insofar as the processing is not necessary:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• The data subject withdraws consent on which the processing is based according to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, and where there is no other legal ground for the processing.
• The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
• The personal data have been unlawfully processed.
• The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
• The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

If one of the above reasons applies and a data subject wishes to request the erasure of personal data stored by HCD Consulting GmbH, he or she may contact an employee of the controller at any time. The employee of HCD Consulting GmbH shall ensure that the request for erasure is complied with immediately.

Where HCD Consulting GmbH has made the personal data public and is obliged as a controller pursuant to Article 17(1) GDPR to erase the personal data, HCD Consulting GmbH, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the published personal data that the data subject has requested the erasure by such controllers of any links to, or copies or replications of, those personal data, insofar as processing is not required. The employee of HCD Consulting GmbH will arrange what is necessary in the individual case.

e) Right to restriction of processing
Every data subject has the right granted by the European legislator to obtain from the controller restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
• The controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise or defense of legal claims.
• The data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

If one of the above conditions is met and a data subject wishes to request the restriction of personal data stored by HCD Consulting GmbH, he or she may contact an employee of the controller at any time. The employee of HCD Consulting GmbH will initiate the restriction of processing.

f) Right to data portability
Every data subject has the right granted by the European legislator to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format. He or she also has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR, and the processing is carried out by automated means, provided that processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

In exercising his or her right to data portability pursuant to Article 20(1) GDPR, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

To assert the right to data portability, the data subject may contact an employee of HCD Consulting GmbH at any time.

g) Right to object
Every data subject has the right granted by the European legislator to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.

HCD Consulting GmbH shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defense of legal claims.

Where HCD Consulting GmbH processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to HCD Consulting GmbH to the processing for direct marketing purposes, HCD Consulting GmbH will no longer process the personal data for these purposes.
In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her by HCD Consulting GmbH for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

To exercise the right to object, the data subject may contact any employee of HCD Consulting GmbH directly or another employee. The data subject is also free, in the context of the use of information society services, notwithstanding Directive 2002/58/EC, to exercise his or her right to object by automated means using technical specifications.

h) Automated individual decision-making, including profiling
Every data subject has the right granted by the European legislator not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning him or her or similarly significantly affects him or her, unless the decision (1) is necessary for entering into, or performance of, a contract between the data subject and a controller, or (2) is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or (3) is based on the data subject’s explicit consent.

If the decision (1) is necessary for entering into, or performance of, a contract between the data subject and the controller, or (2) it is based on the data subject’s explicit consent, HCD Consulting GmbH shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

If the data subject wishes to assert rights concerning automated decisions, he or she may contact an employee of the controller at any time.

i) Right to withdraw consent
Every data subject has the right granted by the European legislator to withdraw consent to the processing of personal data at any time.

If the data subject wishes to exercise the right to withdraw consent, he or she may contact an employee of the controller at any time.

7. Provisions on data protection regarding the use of Google Analytics (with anonymization function)

The controller has integrated the component Google Analytics (with anonymization function) on this website. Google Analytics is a web analysis service. Web analysis is the collection, compilation and evaluation of data on the behavior of visitors to websites. A web analysis service collects, among other things, data about the website from which a data subject came to a website (so-called referrer), which subpages of the website were accessed or how often and for what duration a subpage was viewed. Web analysis is mainly used to optimize a website and to carry out a cost-benefit analysis of internet advertising.

The operator of the Google Analytics component is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.
For web analysis via Google Analytics, the controller uses the add-on “_gat._anonymizeIp”. By means of this add-on, the IP address of the internet connection of the data subject is shortened and anonymized by Google if access to our website is from a member state of the European Union or from another contracting state of the Agreement on the European Economic Area.

The purpose of the Google Analytics component is the analysis of visitor flows on our website. Google uses the data and information obtained, among other things, to evaluate the use of our website, to compile online reports for us that show the activities on our websites, and to provide other services related to the use of our website.

Google Analytics sets a cookie on the information technology system of the data subject. What cookies are has already been explained above. By setting the cookie, Google is enabled to analyze the use of our website. Each time one of the individual pages of this website, which is operated by the controller and on which a Google Analytics component has been integrated, is called up, the internet browser on the information technology system of the data subject is automatically prompted by the respective Google Analytics component to transmit data to Google for online analysis purposes. As part of this technical process, Google gains knowledge of personal data, such as the IP address of the data subject, which serves Google, among other things, to trace the origin of visitors and clicks and subsequently to enable commission settlements.

By means of the cookie, personal information, such as the time of access, the location from which access originated and the frequency of visits to our website by the data subject, is stored. With each visit to our website, these personal data, including the IP address of the internet connection used by the data subject, are transmitted to Google in the United States of America. These personal data are stored by Google in the United States of America. Google may pass these personal data collected via the technical process on to third parties.

The data subject can prevent the setting of cookies by our website, as already shown above, at any time by means of a corresponding setting of the internet browser used and thus permanently object to the setting of cookies. Such a setting of the internet browser used would also prevent Google from setting a cookie on the information technology system of the data subject. In addition, a cookie already set by Google Analytics can be deleted at any time via the internet browser or other software programs.

Furthermore, the data subject has the possibility of objecting to the collection of data generated by Google Analytics relating to the use of this website as well as to the processing of these data by Google and to prevent such collection. To do this, the data subject must download and install a browser add-on under the link https://tools.google.com/dlpage/gaoptout. This browser add-on tells Google Analytics via JavaScript that no data and information about visits to websites may be transmitted to Google Analytics. The installation of the browser add-on is considered an objection by Google. If the information technology system of the data subject is deleted, formatted or reinstalled at a later date, the data subject must perform a new installation of the browser add-on in order to deactivate Google Analytics. If the browser add-on is uninstalled or deactivated by the data subject or another person attributable to their sphere of control, there is the option of reinstalling or reactivating the browser add-on.

Further information and the applicable data protection provisions of Google can be retrieved at https://www.google.de/intl/de/policies/privacy/ and at http://www.google.com/analytics/terms/de.html. Google Analytics is explained in more detail at this link https://www.google.com/intl/de_de/analytics/.

8. Provisions on data protection regarding the use of Google Tag Manager

The controller has integrated Google Tag Manager on this website. Google Tag Manager is a free service that enables us to manage tags and configure mobile applications ourselves via a user-friendly web interface. Further information on Google Tag Manager can be found here: https://www.google.com/intl/de/tagmanager/features.html.

Service operator: Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland.

The purpose of processing is to manage tags and configure mobile applications via a user-friendly web interface.

Each time our web pages are visited, personal data, including the IP address of the internet connection used by the data subject, may be transmitted to Google in the United States of America. These personal data are stored by Google in the United States of America. Google may pass these personal data collected via the technical process on to third parties or use them for interest-based advertising.

There is the possibility to object to Google’s interest-based advertising. To do this, the data subject must access the link www.google.de/settings/ads from each internet browser they use and make the desired settings there.

Further information and the applicable data protection provisions of Google can be retrieved at https://policies.google.com/privacy.

9. Legal basis of processing

Article 6(1)(a) GDPR serves our company as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, with processing operations which are necessary for the supply of goods or the provision of any other service or consideration, the processing is based on Article 6(1)(b) GDPR. The same applies to such processing operations that are necessary for carrying out pre-contractual measures, for example in cases of inquiries concerning our products or services. If our company is subject to a legal obligation by which processing of personal data is required, such as for the fulfillment of tax obligations, the processing is based on Article 6(1)(c) GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor were injured on our premises and his name, age, health insurance data or other vital information would have to be passed on to a doctor, hospital or other third parties. Then the processing would be based on Article 6(1)(d) GDPR. Finally, processing operations could be based on Article 6(1)(f) GDPR. This legal basis is used for processing operations which are not covered by any of the aforementioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Such processing operations are particularly permitted because they have been specifically mentioned by the European legislator. He considered that a legitimate interest could be assumed if the data subject is a client of the controller (Recital 47, sentence 2 GDPR).

10. Legitimate interests in processing pursued by the controller or a third party

Where the processing of personal data is based on Article 6(1)(f) GDPR, our legitimate interest is the conduct of our business activities for the benefit of the well-being of all our employees and our shareholders.

11. Routine erasure and blocking of personal data

The controller processes and stores the personal data of the data subject only for the period necessary to achieve the purpose of storage or insofar as this is provided for by the European legislator or another legislator in laws or regulations to which the controller is subject.

If the purpose of storage ceases to apply or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with legal requirements.

12. Statutory or contractual requirements for the provision of personal data; necessity for contract conclusion; obligation of the data subject to provide personal data; possible consequences of non-provision

We inform you that the provision of personal data is partly required by law (e.g., tax regulations) or may also result from contractual provisions (e.g., information about the contractual partner). Sometimes it may be necessary for the conclusion of a contract that a data subject provides us with personal data which must subsequently be processed by us. The data subject is, for example, obliged to provide us with personal data when our company concludes a contract with him or her. Failure to provide the personal data would result in the contract with the data subject not being concluded. Before personal data are provided by the data subject, the data subject must contact one of our employees. Our employee will explain to the data subject on a case-by-case basis whether the provision of personal data is required by law or contract or necessary for the conclusion of the contract, whether there is an obligation to provide the personal data and the consequences of not providing the personal data.

13. Existence of automated decision-making

As a responsible company, we do not use automatic decision-making or profiling.

14. Cookies, including third-party cookies on websites that can be reached via links from our website

1. Cookie name: PHPSESSID
Provider: hcd-consulting.de/en/
Type: HTTP
Expiry: Session
Purpose: Preserves user states across all page requests.

2. Cookie name: __utm.gif
Provider: google-analytics.com
Type: HTTP
Expiry: Session
Purpose: This cookie is used to determine what type of device or browser software the visitor is using — this allows the website to be formatted accordingly.

3. Cookie name: __utma
Provider: hcd-consulting.de/en/
Type: HTTP
Expiry: 2 years
Purpose: Collects data on how often a user has visited a website, as well as data for the first and last visit. Used by Google Analytics.

4. Cookie name: __utmb
Provider: hcd-consulting.de/en/
Type: HTTP
Expiry: 1 day
Purpose: Registers a timestamp with the exact time the user accesses the website. Used by Google Analytics to calculate the duration of a website visit.

5. Cookie name: __utmc
Provider: hcd-consulting.de/en/
Type: HTTP
Expiry: Session
Purpose: Registers a timestamp with the exact time the user accesses the website. Used by Google Analytics to calculate the duration of a website visit.

6. Cookie name: __utmt
Provider: hcd-consulting.de/en/
Type: HTTP
Expiry: 1 day
Purpose: Used to throttle the speed of requests to the server.

7. Cookie name: __utmz
Provider: hcd-consulting.de/en/
Type: HTTP
Expiry: 6 months
Purpose: Collects data on where the user came from, which search engine was used, which link was clicked and which search terms were used. Used by Google Analytics.

Status of this privacy policy: 28 October 2025

This privacy policy is intended to inform about the nature, scope, and purpose of the collection and use of personal data by HCD Consulting GmbH in relation to electronic visitor registration through the SaaS service “Einfach Gast.”
HCD Consulting GmbH takes the protection of personal data very seriously and handles such data confidentially and in compliance with legal regulations.
Definitions of terms used (e.g., “personal data” or “processing”) can be found in Article 4 of the GDPR.

1. Responsible entity

Responsible for the collection and processing of your personal data and for compliance with data protection regulations is:
HCD Consulting GmbH
Billerberg 5
82266 Inning am Ammersee
Germany
Tel.: +49 89 215 37 01-0
Email: info@hcd-consulting.de

2. Data protection contact

Our officially appointed Data Protection Officer can be reached at the following contact details:
HCD Consulting GmbH – Datenschutz
Billerberg 5
82266 Inning am Ammersee
Email: datenschutz@hcd-consulting.de

3. Purpose of data collection

The personal data collected from you during the visit are electronically recorded via the service “Einfach Gast” to document who was present and when at our premises or operational site (especially at the Ellwangen location).
This serves:
• Ensuring the protection of people and property,
• Tracing visitors in the event of security-related or organizational incidents,
• Compliance with legal and internal safety requirements.
Furthermore, the electronic recording acts as proof that you have acknowledged the displayed safety and behavior notices.

4. Legal basis

The legitimacy of collecting your personal data is based on Article 6(1)(f) of the GDPR:
“Legitimate interest of the controller in ensuring the safety of the company and its employees.”

5. Further details on data usage

Our legitimate interest lies in ensuring the safety of our employees, visitors, facilities, and data.
The digital visitor registration replaces the previous paper-based visitor logbook and enables a data protection-compliant, traceable, and up-to-date documentation of visits.

6. Recipients and disclosure of your personal data

The collection and management of your visitor data are conducted via the SaaS service “Einfach Gast,” operated by:
Einfach Gast GmbH
Landsberger Straße 155
80687 Munich
Germany
Email: info@einfachgast.de
Web: www.einfachgast.de

The data processing takes place on behalf of HCD Consulting GmbH under a data processing agreement in accordance with Article 28 of the GDPR.
(https://einfachgast.de/datensicherheit/)

Disclosure within the corporate group:
HCD Consulting GmbH is part of a corporate group (PromoData GmbH, Green IT Solution GmbH, Green IT Services GmbH, and HCD Consulting GmbH).
Within the jointly used management systems (certified according to ISO 9001, 27001, 45001, and EMAS) and shared internal policies, personal data may be shared with other companies within the group where necessary to carry out or support the respective processing activity.
Such sharing occurs exclusively when the respective processing or task is actually conducted by another group company (e.g., IT, HR, or accounting services).
All affiliated companies are contractually and organizationally obligated to comply with data protection regulations.
Where applicable, personal data may also be transferred to HCD Consulting AG (a wholly-owned subsidiary of HCD Consulting GmbH) in Switzerland if necessary for internal administrative purposes, service provision, or contract execution (Article 6(1)(b) or (f) GDPR).
Switzerland has an adequacy decision made by the European Commission. As a result, it has a data protection level equivalent to that of the EU, and no additional guarantees (such as standard contractual clauses) are required.
A general disclosure of your personal data to other third parties does not occur.
However, in the case of security-related incidents, data may be reviewed by management or – where legally required – by authorities.

7. Transfer of your personal data to third countries or international organisations (outside the GDPR’s scope)

Your personal data are not transferred to a third country or international organization outside the EU/EEA.

8. Storage duration and erasure

Your personal visitor data are automatically erased by “Einfach Gast” according to the agreed storage periods, no later than three months.
A longer storage period occurs only if necessary to resolve a security-related incident. In this case, the data are promptly erased after the conclusion of the process.

9. Rights regarding access, erasure, correction, objection, and restriction of your personal data

You have the right to request confirmation from us as to whether personal data concerning you are being processed. If this is the case, you are entitled to access this personal data and obtain the following information:

• The processing purposes
• The categories of personal data processed
• The recipients or categories of recipients to whom your personal data have been or will be disclosed, particularly recipients in third countries or international organizations
• If possible, the planned duration for which your personal data will be stored, or if not possible, the criteria for determining this duration
• The existence of a right to rectification or deletion of the personal data concerning you, or restriction of processing by us, or objection to the processing
• The existence of a right to lodge a complaint with a supervisory authority
• If the personal data was not obtained from the data subject, all available information about the source of the data
• The existence of automated decision-making, including profiling, along with meaningful information regarding the logic involved and the significance and consequences for the data subject.

If your personal data are transferred to a third country or international organization, you are entitled to be informed about the safeguards applied to ensure adequate data protection levels during the transfer.
We provide a free copy of the personal data being processed. For additional copies requested, we may charge a reasonable fee based on administrative costs. If you make your request electronically, unless otherwise specified, the information will be provided in a commonly used electronic format.
The right to receive a copy may be restricted if doing so affects the rights and freedoms of others.
You also have the right to request us to:

• Correct inaccurate personal data concerning you without delay.
• Complete incomplete personal data, including by providing a supplementary statement.

To exercise these rights, kindly contact our Data Protection Officer.

10. Right to data portability

You have the right to receive the personal data concerning you, which is stored by us and processed in an automated manner, in a structured, commonly used, and machine-readable format. You also have the right to transmit these data to another controller without hindrance from us.
Moreover, you can request that we directly transfer your personal data to another controller, where technically feasible, as part of this right.
This right to data portability may be restricted if the exercise adversely impacts the rights or freedoms of others.

11. Right to Withdraw Consent

If we process your personal data based on your explicit consent, you have the right to withdraw this consent at any time.
The legality of processing carried out prior to withdrawal remains unaffected.
Please also refer to point 8 regarding retention periods.

12. Right to Lodge Complaints with a Supervisory Authority

If you find the need to lodge a complaint with the relevant supervisory authority, you are free to do so at any time.
The supervisory authority in Bavaria is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
Tel.: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800
Email: poststelle@lda.bayern.de

13. Mandatory Provision of Your Personal Data and Possible Consequences of Non-Provision

The provision of your personal data is necessary to achieve the purposes mentioned above.
Without this information, access to our premises or electronic registration cannot be carried out.

14. Automated Decision-Making and Profiling

No automated decision-making or profiling is performed regarding your personal data.

15. Change of Purpose

If we intend to change the purpose for which your personal data were originally collected, you will be informed in advance in a detailed and transparent manner.
Where applicable, consent will be requested formally for such changes.

16. Open Questions, Complaints, or Suggestions

If you have questions, complaints, or suggestions regarding data protection, feel free to contact us. You can also reach out to our Data Protection Officer (see point 2 for contact information).

Effective Date of Privacy Policy: October 28, 2025

Dear applicants, dear employees,
with this privacy policy, we fulfill our legal information obligations under the General Data Protection Regulation (GDPR) and inform you transparently about the handling of your personal data.

1. Responsible entity

Responsible for the collection and processing of your personal data and for compliance with data protection regulations is:
HCD Consulting GmbH
Billerberg 5
82266 Inning am Ammersee
Germany
Tel.: +49 89 215 36 92-0
Email: info@hcd-consulting.de

2. Data protection contact

Our officially appointed Data Protection Officer can be reached at the following contact details:

HCD Consulting GmbH – Datenschutz
Billerberg 5
82266 Inning am Ammersee
Email: datenschutz@hcd-consulting.de

3. Purpose of data collection

Your personal data are processed for the following purposes:

• Evaluation and processing of incoming applications
• Conducting interviews and applicant selection
• Conclusion of an employment contract (establishment of an employment relationship)
• Performance of the employment relationship
• Termination of the employment relationship

4. Legal basis

The processing of your personal data is based on Section 26(1) of the German Federal Data Protection Act (BDSG).

5. Further details on data use

To recruit and hire suitable new personnel or to establish, conduct, and terminate an employment relationship, we require a minimum amount of personal data. We always observe the principle of data minimization and do not collect personal data that we do not strictly need as per point 3 of this privacy policy. Should we wish to collect additional personal data not covered by point 3, we will ask you for a voluntary declaration of consent.

6. Disclosure of your personal data

Internal disclosure of your personal data takes place exclusively within the scope of the purposes defined under point 3 of this privacy policy in accordance with the principle of data minimization and other data protection principles.

Disclosure within the corporate group:
HCD Consulting GmbH is part of a corporate group (Promodata GmbH, Green IT Solution GmbH, Green IT Services GmbH, and HCD Consulting GmbH).
Within the jointly used management systems (certified according to ISO 9001, 27001, 45001, and EMAS) and shared internal policies, personal data may be disclosed to other companies in the group, provided this is necessary to carry out or support the respective processing activity.
Such disclosure only occurs when the respective processing or task is actually performed by another group company (e.g., IT, HR, or accounting services).
All affiliated companies are contractually and organizationally obligated to comply with data protection requirements.
Where applicable, personal data may also be transferred to HCD Consulting AG (a wholly owned subsidiary of HCD Consulting GmbH) in Switzerland, insofar as this is necessary for internal administrative purposes, service provision, or contract performance (Article 6(1)(b) or (f) GDPR).

There is an adequacy decision by the European Commission for Switzerland.
This ensures a level of data protection equivalent to that in the EU; additional safeguards (e.g., standard contractual clauses) are not required.
External disclosure of your personal data may occur under the following circumstances:

• Disclosure of your personal data (contact details) to contractors, subcontractors, or cooperation partners in the course of performing the employment relationship, insofar as this is necessary for fulfilling assignments. Any such disclosure is always limited to what is necessary. Where possible, disclosure of your personal data is avoided.
• Engagement of support services where access to your personal data is necessary or cannot be completely ruled out. This includes, for example, IT support services, payroll services, or the use of tax advisory services.
• Disclosure of your personal data (contact details) as part of supplier management, insofar as this is necessary for fulfilling assignments. Any such disclosure is always limited to what is necessary. Where possible, disclosure of your personal data is avoided.
• Disclosure of your personal data due to legal obligations to authorities and health insurance funds.

7. Transfer of your personal data to third countries or international organizations (outside the scope of the GDPR)

Your personal data are not transferred to countries outside the EU or to international organizations. Should this become necessary in the future, you will be informed in advance and all necessary measures to protect your data will be taken.

8. Storage period and deletion

Your personal data are stored only as long as necessary to fulfill the stated purposes or as long as statutory retention obligations exist.
After these periods expire, your data will be deleted unless you have consented to longer storage.

9. Right to access, deletion, correction, objection, and restriction of processing of your personal data

You have the right to request confirmation from us as to whether personal data concerning you are being processed. If this is the case, you have the right to access this personal data and to the following information:

• the purposes of processing
• the categories of personal data being processed
• the recipients or categories of recipients to whom your personal data have been or will be disclosed, in particular recipients in third countries or international organizations
• where possible, the planned duration for which your personal data will be stored, or, if not possible, the criteria used to determine that duration
• the existence of a right to rectification or deletion of personal data concerning you or to restriction of processing by us, or a right to object to such processing
• the existence of a right to lodge a complaint with a supervisory authority
• where the personal data are not collected from the data subject, any available information as to their source
• where automated decision-making, including profiling, takes place: meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

If your personal data are transferred to a third country or an international organization, you have the right to be informed of the appropriate “safeguards” relating to ensuring an adequate level of data protection in connection with the transfer. We will provide you with a free copy of the personal data undergoing processing. For any further copies you request, we may charge a reasonable fee based on administrative costs. If you submit the request electronically, the information will be provided in a commonly used electronic format, unless you specify otherwise. The right to receive a copy may be restricted if this would adversely affect the rights and freedoms of others. You have the right to request without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of processing, you have the right to have incomplete personal data completed, including by means of a supplementary statement. To exercise this right, feel free to contact our Data Protection Officer. You have the right to request the deletion of your personal data stored by us if one of the following criteria applies:

• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
• You withdraw a voluntary declaration of consent (the lawfulness of processing based on consent before its withdrawal remains unaffected).
• Your personal data have been unlawfully processed.
• There is a legal obligation to delete the data.
• The personal data were collected in relation to the offer of information society services (persons under 16 years of age).

Furthermore, you have the right to request restriction of processing if one of the following conditions applies:

• You contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data.
• The processing is unlawful and you oppose the deletion of your personal data and instead request the restriction of their use.
• We no longer need your personal data for the purposes of processing, but you require them for the establishment, exercise, or defense of legal claims.
• You have objected to processing pending the verification of whether our legitimate grounds override yours.

10. Right to data portability

You have the right to receive the personal data concerning you, which are stored by us and processed by automated means, in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from us, to whom the personal data have been provided. When exercising your right to data portability, you have the right to have your personal data transmitted directly by us to another controller where technically feasible. The right to data portability may be restricted if the exercise of this right adversely affects the rights or freedoms of others.

11. Right to withdraw consent and effect of consents already granted

Where we process personal data concerning you on the basis of a declaration of consent, you have the right to withdraw that consent. The lawfulness of processing carried out on the basis of consent until its withdrawal remains unaffected. With regard to compliance with retention periods, please also refer to point 8 of this privacy policy.

12. Right to lodge a complaint with the supervisory authority

If you see the need to lodge a complaint with the competent supervisory authority, you are free to do so at any time. The address of the competent supervisory authority in Bavaria is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Phone: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800
Email: poststelle@lda.bayern.de

13. Mandatory provision of your personal data and possible consequences of refusal

On the one hand, we are legally obliged to process personal data concerning you (this also includes disclosure to, for example, authorities or health insurance funds); on the other hand, we need the data collected from you for decisions regarding the establishment, performance, and termination of the employment relationship. Without the collected data, it would not be possible to decide on, establish, conduct, or terminate an employment relationship.

14. Automated decision-making and profiling

No automated decision-making relating to you takes place. No “profiling” (meaningful information about the logic involved as well as the scope and the intended effects of such processing for you) is carried out using the personal data collected from you.

15. Change of purpose

If we intend to change the purpose for which your personal data were originally collected, we will inform you of this in advance in a detailed and transparent manner. In such a case, we will of course provide you with all information required by law. If the change of purpose involves processing personal data based on a voluntary declaration of consent, we will inform you accordingly and request your formal consent.

16. Open questions, complaints, or suggestions

You are welcome to contact us with any questions, complaints, or suggestions regarding data protection. If necessary, you may also contact our Data Protection Officer (see point 2 of this privacy policy).

Status of the privacy policy: October 28, 2025

Dear Customers and Prospective Customers,
with this privacy policy, we fulfill our legal obligation to provide information according to the General Data Protection Regulation (GDPR) and inform you transparently about the handling of your personal data.

1. Responsible entity

Responsible for the collection and processing of your personal data and for compliance with data protection laws is:

HCD Consulting GmbH
Billerberg 5
82266 Inning am Ammersee
Germany
Tel: +49 89 215 36 92-0
Email: info@hcd-consulting.de

2. Data protection contact

Our officially appointed Data Protection Officer can be reached at the following contact details:

HCD Consulting GmbH – Data Protection
Billerberg 5
82266 Inning am Ammersee
Email: datenschutz@hcd-consulting.de

3. Purpose of data collection

Your personal data are processed for the following purposes:

• Creation of personalized offers following your requests for work or services
• Formation of service or work contracts
• Provision of contractually agreed services
• Billing for the contractually agreed services

4. Legal basis

The processing of your personal data is based on Article 6(1)(b) of the GDPR.

5. Further details on data usage

To provide our contractual service or to create a personalized offer in response to your request, we need a minimum amount of personal data. We always observe the principle of data minimization and do not collect personal data which we do not need for fulfilling our tasks.

6. Disclosure of your personal data

Internal disclosure of your personal data occurs exclusively for fulfilling contractual duties or further activities related to the purposes mentioned in point 3.

Disclosure within the corporate group:
HCD Consulting GmbH is part of a corporate group (including PromoData GmbH, Green IT Solution GmbH, Green IT Services GmbH, and HCD Consulting GmbH). Within the shared management systems (certified according to ISO 9001, 27001, 45001, and EMAS) and joint internal guidelines, personal data may be transferred to other companies in the group if necessary for carrying out or supporting the respective processing activity.

Such a transfer takes place exclusively when the particular processing or task is actually conducted by another company within the group (e.g., IT, HR, or accounting services).

All associated companies are contractually and organizationally obliged to comply with data protection regulations.
Additionally, personal data may also be transferred to HCD Consulting AG (a wholly-owned subsidiary of HCD Consulting GmbH) in Switzerland if necessary for internal administrative purposes, service provision, or contract fulfillment (Article 6(1)(b) or (f) GDPR).

Switzerland has an adequacy decision from the European Commission, ensuring a level of data protection equivalent to that within the EU; additional guarantees (e.g., standard contractual clauses) are not required.

External disclosure of your personal data may occur under the following circumstances:

• Engagement of subcontractors to fulfill contractual obligations that have been agreed upon in our cooperation with you.
• Provision of support services where access to your personal data may be necessary or cannot be entirely excluded. This includes, for example, IT support services, services related to invoice preparation, or the use of tax advisory services.
• Disclosure of your personal data due to legal obligations.
• Obtaining information from credit reporting agencies.
• Sharing of personal data through automated matching with databases as part of export control.
• Payment processing (only for online/shop orders)

If you order goods or services through one of our online shops and choose an electronic payment method, we transmit the necessary data for payment processing (e.g., invoice amount, order, payment method, possibly name and email address) to the payment service provider you have selected (e.g., PayPal, Stripe) to carry out the payment (Article 6(1)(b) GDPR).
Further processing by the payment service provider is under their own data protection responsibility; more information can be found in the privacy notices of the respective payment service provider.

7. Transfer of your personal data to third countries or international organisations (outside the scope of the GDPR)

Your personal data are not transferred to states outside the EU or to international organizations. Should this become necessary in the future, you will be informed in advance, and all necessary measures to protect your data will be taken.

8. Storage duration and erasure

Your personal data are stored only as long as necessary for the fulfillment of the stated purposes or as long as legal retention obligations exist.
After these periods expire, your data will be erased unless there is consent for longer storage.

9. Right to access, deletion, correction, objection, and restriction of use of your personal data

You have the right to request confirmation from us whether personal data concerning you are being processed. If this is the case, you have the right to access these personal data and the following information:

• The purposes of the processing
• The categories of personal data processed
• The recipients or categories of recipients to whom your personal data have been or will be disclosed, particularly recipients in third countries or international organizations
• If possible, the planned duration for which your personal data will be stored, or, if this is not possible, the criteria used to determine this duration
• The existence of a right to correction or deletion of the personal data concerning you, or to restriction of processing by us, or a right to object to this processing
• The existence of a right to lodge a complaint with a supervisory authority
• If the personal data were not collected from the data subject, all available information about the source of the data
• The existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

If your personal data are transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards relating to the transfer. We will provide you with a free copy of the personal data undergoing processing. For any further copies you request, we may charge a reasonable fee based on administrative costs. If you make the request electronically, and unless otherwise requested by you, the information shall be provided in a commonly used electronic format. The right to receive a copy may be limited if it adversely affects the rights and freedoms of others.

You have the right to request from us without undue delay the correction of incorrect personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

To exercise this right, you may contact our Data Protection Officer. You have the right to request the deletion of your personal data stored by us if one of the following criteria is met:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• You withdraw consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing.
• The personal data have been unlawfully processed.
• There is a legal obligation to delete the data.
• The personal data were collected in relation to the offer of information society services referred to in Article 8(1).

Furthermore, you have the right to request from us the restriction of processing if one of the following applies:

• The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data.
• The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead.
• We no longer need the personal data for the purposes of processing, but they are required by you for the establishment, exercise, or defense of legal claims.
• You have objected to the processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

10. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from us, to whom the personal data have been provided, where:

• The processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2), or on a contract pursuant to point (b) of Article 6(1), and;
• The processing is carried out by automated means.

In exercising your right to data portability pursuant to paragraph 1, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The right to data portability may be limited if it adversely affects the rights and freedoms of others.

11. Right to withdraw consent and maintenance of granted consents

To the extent that we process personal data about you based on a declaration of consent, you have the right to withdraw your consent at any time. However, the legality of the processing carried out on the basis of the consent until revocation is not affected by this. Regarding the observance of retention periods, point 8 of this privacy policy must also be observed.

12. Right to complain to a supervisory authority

Should you see the necessity to lodge a complaint with the competent supervisory authority, you are free to do so at any time. The address of the competent supervisory authority in Bavaria is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
Telephone: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800
Email: poststelle@lda.bayern.de

13. Obligation to provide your personal data and possible consequences of refusal

For the fulfillment of our contractual performance or to create a personalized offer, we need the personal data collected from you. Without this personal data, it is not possible to create offers or provide the desired services and work.

14. Automated decision making and profiling

There is no automated decision-making in relation to your person. No “profiling” with the personal data collected from you is carried out.

15. Change of purpose

In case we intend to change the purpose for which your personal data were originally collected, we will inform you in advance in detail and transparently. In such a case, we will of course provide you with all legally required information. If the change of purpose involves processing personal data based on a declaration of consent, we will inform you accordingly and ask for your formal consent.

16. Unresolved questions, complaints, or suggestions

You are welcome to contact us with any questions, complaints or suggestions regarding data protection. If necessary, you can contact our Data Protection Officer (see point No. 2 of this privacy policy).

Status of the privacy policy: October 28, 2025

Dear Suppliers and Service Providers,

with this privacy policy, we fulfill our legal obligation to provide information according to the General Data Protection Regulation (GDPR) and inform you transparently about the handling of your personal data.

1. Responsible entity

Responsible for the collection and processing of your personal data and for compliance with data protection laws is:

HCD Consulting GmbH
Billerberg 5
82266 Inning am Ammersee
Germany
Tel.: +49 89 215 36 92-0
Email: info@hcd-consulting.de

2. Data protection contact

Our officially appointed Data Protection Officer can be reached at the following contact details:

HCD Consulting GmbH – Data Protection
Billerberg 5
82266 Inning am Ammersee
Email: datenschutz@hcd-consulting.de

3. Purpose of data collection

Your personal data are processed for the following purposes:

• Requesting individual offers for work or services
• Concluding a service or work contract or executing an order
• Inquiries about completed work, services, or products including complaint management
• Settling invoices

4. Legal basis

The processing of your personal data is based on:

• Article 6(1)(b) of the GDPR (in case of a contract conclusion, e.g., service contract or sales contract) and / or
• Article 6(1)(f) of the GDPR (in the case of pre-contractual measures upon request of the responsible entity)

5. Further details on data usage

To receive contracted services or to request an individual offer, we naturally require a minimum amount of personal data. We always abide by the principle of data minimization and do not collect personal data which we do not need according to point no. 3 of this privacy policy.

6. Disclosure of your personal data

Internal disclosure of your personal data occurs exclusively for fulfilling contractual obligations or further activities related to the purposes mentioned in point no. 3.

Disclosure within the corporate group:
HCD Consulting GmbH is part of a corporate group (including PromoData GmbH, Green IT Solution GmbH, Green IT Services GmbH, and HCD Consulting GmbH).

As part of the shared management systems (certified according to ISO 9001, 27001, 45001, and EMAS) and joint internal guidelines, personal data may be transferred to other companies of the group if necessary for carrying out or supporting the respective processing activity.
Such a transfer occurs exclusively when the particular processing or task is actually conducted by another company within the group (e.g., IT, HR, or accounting services).

All affiliated companies are contractually and organizationally obligated to comply with data protection regulations.
Additionally, personal data may be transferred to HCD Consulting AG (a wholly-owned subsidiary of HCD Consulting GmbH) in Switzerland if necessary for internal administrative purposes, service provision, or contract execution (Article 6(1)(b) or (f) GDPR).
Switzerland enjoys an adequacy decision from the European Commission, ensuring a level of data protection equivalent to that within the EU; additional guarantees (e.g., standard contractual clauses) are not required.

External disclosure of your personal data may occur under the following circumstances:

• Forwarding your contact information for coordination among multiple contractors if engaging another service provider/supplier is necessary to fulfill contractual obligations agreed upon in our cooperation with you
• Engaging support services where access to your personal data may be necessary or cannot be entirely excluded, including IT support services, services related to invoice creation, or use of tax advisory services
• Disclosure of your personal data due to legal obligations

7. Transfer of your personal data to third countries or international organisations (outside the scope of the GDPR)

Your personal data will not be transferred to states outside the EU or to international organizations. Should this become necessary in the future, you will be informed in advance, and all necessary measures to protect your data will be taken.

8. Storage duration and erasure

Your personal data are stored only as long as necessary for the fulfillment of the stated purposes or as long as legal retention obligations exist. After these periods, your data will be erased unless there is consent for longer storage.

9. Right to access, erasure, correction, objection, and restriction of use of your personal data

You have the right to request confirmation from us whether personal data concerning you are being processed. If this is the case, you have the right to access these personal data and the following information:

• The purposes of processing
  • The categories of personal data processed
  • The recipients or categories of recipients to whom your personal data have been or will be disclosed, particularly recipients in third countries or international organizations
  • If possible, the planned duration for which your personal data will be stored, or if not, the criteria used to determine this duration
  • The existence of a right to correction or deletion of the personal data concerning you or to restriction of processing by us or a right to object to this processing
  • The existence of a right to lodge a complaint with a supervisory authority
  • If the personal data were not collected from the data subject, all available information about the source of the data
  • The existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

If your personal data are transferred to a third country or to an international organization, you have the right to be informed about the appropriate safeguards relating to the transfer. We will provide you with a free copy of the personal data undergoing processing. For any further copies you request, we may charge a reasonable fee based on administrative costs. If you make the request electronically, and unless otherwise requested by you, the information shall be provided in a commonly used electronic format. The right to receive a copy may be limited if it adversely affects the rights and freedoms of others.

You have the right to request from us without undue delay the correction of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of a supplementary statement.

To exercise this right, you may contact our Data Protection Officer. You have the right to request the deletion of your personal data stored by us if one of the following criteria is met:

• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
• You withdraw consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and there is no other legal ground for the processing.
• The personal data have been unlawfully processed.
• There is a legal obligation to delete the data.
• The personal data were collected in relation to the offer of information society services referred to in Article 8(1).

Furthermore, you have the right to request from us the restriction of processing if one of the following conditions is met:

• The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data.
• The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead.
• We no longer need the personal data for the purposes of processing, but they are required by you for the establishment, exercise, or defense of legal claims.
• You have objected to the processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of our controller override yours.

10. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from us, to whom the personal data have been provided, where:

• The processing is based on consent pursuant to point (a) of Article 6(1), or point (a) of Article 9(2), or on a contract pursuant to point (b) of Article 6(1), and
• The processing is carried out by automated means.

In exercising your right to data portability pursuant to paragraph 1, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The right to data portability may be limited if it adversely affects the rights and freedoms of others.

11. Right to withdraw consent and retention of granted consents

To the extent that we process personal data about you based on a declaration of consent, you have the right to withdraw that consent at any time. However, the legality of the processing carried out based on the consent until its withdrawal is not affected by this. Regarding the observance of retention periods, point no. 8 of this privacy policy must also be considered.

12. Right to complain to a supervisory authority

Should you feel the necessity to lodge a complaint with the competent supervisory authority, you are free to do so at any time. The address of the competent supervisory authority in Bavaria is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
Telephone: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800
Email: poststelle@lda.bayern.de

13. Obligation to provide your personal data and possible consequences of refusal

To fulfill our contractual agreements, we require the personal data collected from you. Without these personal data, it may not be possible to fulfill these agreements.

14. Automated decision-making and profiling

No automated decision-making related to your person is performed. No “profiling” with the personal data collected from you is conducted.

15. Change of purpose

In case we intend to change the purpose for which your personal data were originally collected, we will inform you in advance in a detailed and transparent manner. In such an event, we will naturally provide you with all legally required information. If the change of purpose involves processing personal data based on a declaration of consent, we will inform you accordingly and ask for your formal consent.

16. Unresolved questions, complaints, or suggestions

You are welcome to contact us with any questions, complaints, or suggestions regarding data protection. If necessary, you may contact our Data Protection Officer (see point No. 2 of this privacy policy).

Status of the privacy policy: October 28, 2025

This privacy policy is intended to inform about the type, scope, and purpose of the collection and use of personal data by HCD Consulting GmbH in relation to trade shows.

HCD Consulting GmbH takes the protection of personal data very seriously and handles them confidentially and in accordance with legal regulations.
Definitions of the terms used (e.g., “personal data” or “processing”) can be found in Art. 4 GDPR.

1. Responsible entity

The entity responsible for the collection and processing of your personal data as well as compliance with data protection regulations is:

HCD Consulting GmbH
Billerberg 5
82266 Inning am Ammersee
Germany
Tel.: +49 89 215 36 92-0
Email: info@hcd-consulting.de

2. Data protection contact person

Our officially appointed data protection officer can be reached at the following contact details:

HCD Consulting GmbH – Data Protection
Billerberg 5
82266 Inning am Ammersee
Email: datenschutz@hcd-consulting.de

3. Purpose of data collection

Your personal data will be processed for the following purposes:

• Upon request, sending information materials
• Handling inquiries
• Creation of personalized offers
• Formation of a purchase, service, or work contract

4. Legal basis

If you provide us with your contact information to receive updates about products, services, or news, to arrange an advisory appointment, or to answer inquiries, the processing is based on the following legal basis:

• Article 6(1)(a) GDPR:
  “…the data subject has given their consent to the processing of personal data concerning them for one or more specific purposes.”

If the processing involves initiating or executing contracts made with your company, this is based on the legal basis:

• Article 6(1)(f) GDPR:
  “…processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data…”

5. Further details on data usage

Our legitimate interest lies in the fact that the initiation and execution of contracts with your company is only possible if we process a minimum amount of personal data (e.g., contact information of points of contact) to ensure efficient and targeted communication.

For all matters involving contracts with you or their initiation (e.g., creation of offers or conclusion of purchase contracts), we process your personal data based on the following legal basis:

• Article 6(1)(b) GDPR:
  “…processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.”

6. Disclosure of your personal data

Internal disclosure of your personal data occurs strictly within the framework defined under point 3 of this privacy policy, in accordance with the principles of data minimization and other data protection principles.

Disclosure within the corporate group:
HCD Consulting GmbH is part of a corporate group (including PromoData GmbH, Green IT Solution GmbH, Green IT Services GmbH, and HCD Consulting GmbH).

As part of the shared management systems (certified under ISO 9001, 27001, 45001, and EMAS) and joint internal policies, personal data may be shared with other companies within the group if required to carry out or support specific processing activities.
Such sharing only occurs if the respective processing or task is indeed conducted by another group company (e.g., IT, HR, or accounting services).
All affiliated companies are contractually and organizationally obligated to comply with data protection regulations.
Where necessary, personal data may also be transferred to HCD Consulting AG (a wholly-owned subsidiary of HCD Consulting GmbH) in Switzerland if required for administrative purposes, service delivery, or contract execution (based on Art. 6(1)(b) or (f) GDPR).

Switzerland has an adequacy decision by the European Commission, ensuring a level of data protection equivalent to that within the EU; no additional guarantees (e.g., standard contractual clauses) are required.

External disclosure of your personal data may occur under the following circumstances:

• Disclosure to our sales representatives for further handling of your request
• IT service providers working for us have access to your data in the context of administrative activities

7. Transfer of your personal data to third countries or international organizations (outside the scope of the GDPR)

Your personal data will not be transferred to states outside the EU or to international organizations. Should this become necessary in the future, you will be informed in advance, and all necessary measures for protecting your data will be taken.

8. Storage duration and erasure

Your personal data will only be stored as long as necessary for the fulfillment of the mentioned purposes or as long as legal retention periods apply.
After these periods expire, your data will be erased unless consent has been provided for longer storage.

9. Right to access, erasure, correction, objection, and restriction of processing of your personal data

You have the right to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have the right to access this personal data and the following information:

• The purposes of processing
• The categories of personal data processed
• The recipients or categories of recipients to whom your personal data has been or will be disclosed, particularly recipients in third countries or international organizations
• If possible, the planned duration for which your personal data will be stored, or, if this is not possible, the criteria used to determine this duration
• The existence of a right to rectify or delete personal data concerning you, or to restrict processing by us, or to object to such processing
• The existence of a right to lodge a complaint with a supervisory authority
• If the personal data was not collected directly from the data subject, any available information about the data’s origin
• The existence of automated decision-making, including profiling, with meaningful information about the logic involved and the significance and expected consequences of such processing for the data subject

If your personal data is transferred to a third country or international organization, you have the right to be informed of the appropriate safeguards applied to protect your data during the transfer.

You may request a free copy of the personal data undergoing processing. For additional copies, we may charge a reasonable fee based on administrative costs. If you make the request electronically, and unless otherwise specified, the information will be provided in a commonly used electronic format.

10. Right to data portability

You have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format, and to transmit these data to another controller without hindrance from us.

11. Right to withdraw consent

If we process your personal data based on your explicit consent, you have the right to withdraw this consent at any time. The legality of processing carried out prior to withdrawal remains unaffected.

12. Right to lodge complaints with a supervisory authority

If you find the need to lodge a complaint with the relevant supervisory authority, you are free to do so at any time. The contact information for the supervising authority in Bavaria is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
Tel.: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800
Email: poststelle@lda.bayern.de

13. Mandatory provision of your personal data and possible consequences of refusal

To fulfill the tasks outlined under point 3, we require your personal data to communicate with you. Without the relevant contact information, this communication is not possible.

14. Automated decision-making and profiling

No automated decision-making or profiling using your personal data is performed.

15. Change of purpose

If we intend to change the purpose for which your personal data was originally collected, we will inform you in advance in a detailed and transparent manner.

16. Unresolved questions, complaints, or suggestions

If you have any questions, complaints, or suggestions regarding data protection, feel free to contact us. You may also reach out to our Data Protection Officer (see point 2 of this privacy policy).

Status of the Privacy Policy: October 28, 2025

Dear Network Partners and Friends,

with this privacy policy, we fulfill our legal informational obligations according to the General Data Protection Regulation (GDPR) and inform you transparently about the handling of your personal data.

1. Responsible entity

Responsible for the collection and processing of your personal data and for compliance with data protection regulations is:

HCD Consulting GmbH
Billerberg 5
82266 Inning am Ammersee
Germany
Tel.: +49 89 215 36 92-0
Email: info@hcd-consulting.de

2. Data protection contact

Our officially appointed Data Protection Officer can be reached at the following contact details:
HCD Consulting GmbH – Data Protection
Billerberg 5
82266 Inning am Ammersee
Email: datenschutz@hcd-consulting.de

3. Purpose of data collection

Your personal data are processed for the following purposes:

• Making contact and coordinating for potential collaboration
• Aligning on common interests
• Carrying out collaboration
• Sharing experiences

4. Legal basis

The processing of your personal data is based on Article 6(1)(f) of the GDPR.

5. Further details on data usage

To realize our coordination correspondence according to point 3 of this privacy policy, we require a minimum amount of personal data. We always observe the principle of data minimization in this context.

6. Disclosure of your personal data

Internal disclosure of your personal data occurs exclusively for fulfilling contractual obligations or further tasks related to the activities mentioned in point no. 3.

Disclosure within the Corporate Group:
HCD Consulting GmbH is part of a corporate group (including PromoData GmbH, Green IT Solution GmbH, Green IT Services GmbH, and HCD Consulting GmbH).

Within the shared management systems (certified according to ISO 9001, 27001, 45001, and EMAS) and joint internal guidelines, personal data may be shared with other companies in the group if necessary to carry out or support the respective processing activity.
Such a transfer occurs only when the respective processing or task is actually conducted by another company within the group (e.g., IT, HR, or accounting services).

All affiliated companies are contractually and organizationally obligated to comply with data protection regulations.
Personal data may also be transferred to HCD Consulting AG (a wholly-owned subsidiary of HCD Consulting GmbH) in Switzerland if necessary for internal administrative purposes, service delivery, or contract execution (Article 6(1)(b) or (f) GDPR). Switzerland has an adequacy decision by the European Commission, ensuring a level of data protection equivalent to that within the EU; no additional guarantees (e.g., standard contractual clauses) are required.

External disclosure of your personal data may occur under the following circumstances:

• Engaging support services where access to your personal data is necessary or cannot be entirely excluded (e.g., IT support services, services related to invoicing, or tax advisory services).
• Disclosure of your personal data due to legal obligations.
• Sharing of your personal data with additional network partners.

7. Transfer of your personal data to third countries or international organisations (outside the scope of the GDPR)

Your personal data are not transferred to states outside the EU or to international organizations. Should this become necessary in the future, you will be informed in advance, and all necessary measures to protect your data will be taken.

8. Storage duration and deletion

Your personal data are stored only as long as necessary for fulfilling the mentioned purposes or as long as legal retention obligations apply. After these periods, your data will be deleted unless there is consent for longer storage.

9. Right to information, erasure, correction, objection, and restriction of use of your personal data

You have the right to request confirmation from us as to whether personal data concerning you are being processed. If so, you have the right to access this personal data and the following information:

• The processing purposes
• The categories of personal data processed
• The recipients or categories of recipients to whom your personal data have been or will be disclosed, especially recipients in third countries or international organizations
• If possible, the planned duration for which your personal data will be stored, or, if not possible, the criteria for determining that duration
• The existence of a right to correction or deletion of the personal data concerning you, or to restriction of processing by us, or a right to object to such processing
• The existence of a right to lodge a complaint with a supervisory authority
• If the personal data were not collected from you, all available information about the source of the data
• The existence of automated decision-making, including profiling, and in such cases, meaningful information about the logic involved, its significance, and the expected consequences for you.

If your personal data are transferred to a third country or an international organization, you have the right to be informed of the appropriate safeguards relating to the transfer. We will provide you with a free copy of your personal data undergoing processing. For any further copies you request, we may charge a reasonable fee based on administrative costs. If you make the request electronically, the information will be provided in a commonly used electronic format, unless specified otherwise. The right to receive a copy may be limited if it adversely affects the rights and freedoms of others.

You have the right to request from us the immediate correction of any incorrect personal data concerning you. Taking into account the processing purposes, you have the right to complete incomplete personal data, including by means of providing a supplementary statement. To exercise this right, you may contact our Data Protection Officer.

You have the right to request the deletion of your personal data stored with us if one of the following criteria is met:

• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
• You withdraw consent on which the processing is based, and there is no other legal basis for the processing.
• The personal data have been unlawfully processed.
• There is a legal obligation to delete the data.
• The personal data were collected regarding offered services of the information society (for individuals under 16 years of age).

Furthermore, you have the right to demand from us the restriction of processing if one of the following conditions applies:

• You contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the data.
• The processing is unlawful, and you oppose the deletion of the personal data and request the restriction of their use instead.
• We no longer require the personal data for the processing purposes, but they are required by you for the establishment, exercise, or defense of legal claims.
• You have objected to processing pending the verification of whether our legitimate grounds override yours.

10. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. You also have the right to transmit these data to another controller without hindrance from us, to whom the personal data have been provided, if the processing is based on consent (per Article 6(1)(a) or Article 9(2)(a) GDPR) or on a contract (per Article 6(1)(b) GDPR) and the processing is carried out by automated means.

When exercising your right to data portability, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The right to data portability may be limited to the extent that it adversely affects the rights and freedoms of others.

11. Right to withdraw consent and retention of granted consents

To the extent that we process your personal data based on a declaration of consent, you have the right to withdraw your consent at any time. However, the legality of the processing carried out on the basis of consent until the withdrawal is not affected by this. The provisions of point 8 of this privacy policy must also be observed with regard to the adherence to storage periods.

12. Right to complain to a supervisory authority

If you see the need to lodge a complaint with the competent supervisory authority, you are free to do so at any time. The address of the competent supervisory authority in Bavaria is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
Phone: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800
Email: poststelle@lda.bayern.de

13. Mandatory provision of your personal data and possible consequences of refusal

There is no obligation on your part to provide your personal data. There is no disadvantage to you if you choose not to provide personal data.

14. Automated decision-making and profiling

No automated decision-making or profiling is carried out with regard to your person using the personal data collected from you.

15. Change of purpose

If we intend to change the purpose for which your personal data were originally collected, we will inform you in advance in a detailed and transparent manner. We will naturally provide you with all legally required information. If the change of purpose involves processing personal data based on a declaration of consent, we will inform you accordingly and ask for your formal consent.

16. Unresolved questions, complaints, or suggestions

You are welcome to contact us with any questions, complaints, or suggestions regarding data protection. If necessary, you can also contact our Data Protection Officer (see point No. 2 of this privacy policy).

Status of the privacy policy: October 28, 2025

This privacy policy aims to inform about the nature, scope, and purpose of the collection and use of personal data in the context of outdoor video surveillance by HCD Consulting GmbH at the Ellwangen location.

HCD Consulting GmbH takes the protection of personal data very seriously, treating it confidentially and in accordance with legal requirements. Due to new technologies and the continuous development of data processing procedures and methods, changes to this privacy policy may occur; therefore, we recommend that you re-read the privacy policy at regular intervals.

Definitions of the terms used (e.g., “personal data” or “processing”) can be found in Article 4 of the GDPR.

1. Responsible entity

Responsible for the collection and processing of your personal data and for compliance with data protection regulations is:

HCD Consulting GmbH
Billerberg 5
82266 Inning am Ammersee
Germany
Phone: +49 89 215 36 92-0
Email: info@hcd-consulting.de

2. Contact form data protection

Our officially appointed Data Protection Officer can be reached at the following contact details:

HCD Consulting GmbH – Data Protection
Billerberg 5
82266 Inning am Ammersee
Email: datenschutz@hcd-consulting.de

3. Purpose of data collection

The video surveillance is aimed at protecting against burglary, theft, and vandalism. In the event of incidents, the recordings should contribute to clarification and may serve as evidence.
No other use of the data occurs.

4. Legal basis

The processing of data is carried out in accordance with GDPR Article 6(1)(f) for the protection of legitimate interests:
“…processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”

5. Further details on data usage

The legitimate interest pursued by HCD Consulting GmbH is the effective protection of the company’s property. Past incidents have shown that video surveillance significantly contributes to the clarification and proof in occurrences.

Furthermore, video surveillance is a recognized means of prevention.
With limited storage time and focus on important and critical areas, the rights and freedoms of individuals are preserved.

6. Disclosure of your personal data

Internal disclosure of your personal data occurs exclusively for the purposes outlined in point 3 of this privacy policy in accordance with the principle of data minimization and other principles of data protection.

Review of the footage is only conducted by a tightly restricted and predetermined group of employees in the event of incidents.

Data are securely stored on HCD Consulting GmbH’s servers within company premises.

Disclosure within the Corporate Group:
HCD Consulting GmbH is part of a corporate group (including PromoData GmbH, Green IT Solution GmbH, Green IT Services GmbH, and HCD Consulting GmbH).

Within the shared management systems (certified according to ISO 9001, 27001, 45001, and EMAS) and joint internal guidelines, personal data may be shared with other companies of the group if necessary for the execution or support of the respective processing activity.
Such sharing occurs only when the processing task is actually carried out by another company within the group (e.g., IT, HR, or accounting services).

All associated companies are contractually and organizationally obliged to comply with data protection regulations.
Data may also be transferred to HCD Consulting AG (a wholly-owned subsidiary of HCD Consulting GmbH) in Switzerland as necessary for internal administrative purposes, service provision, or contract execution (GDPR Article 6(1)(b) or (f)).

Switzerland has an adequacy decision from the European Commission, ensuring a level of data protection equivalent to that in the EU; no additional guarantees are required.

External disclosure of your personal data does not usually occur but may under the following circumstances:

• In the context of investigating incidents and providing evidence, data may be shared with law enforcement authorities.
• During the operation and administration of the video system, HCD Consulting GmbH is supported by TELENOT ELECTRONIC GMBH, Wiesentalstraße 60, 73434 Aalen. During necessary maintenance work (e.g., troubleshooting), it is theoretically possible that service provider staff might view the video footage.
• Additionally, Schwäbisch Hall Facility Management GmbH, Crailsheimer Straße 52, 74523 Schwäbisch Hall, has live access to the camera feed for building surveillance. There is no access to stored videos.

Data processing agreements, as required by GDPR Article 28, are in place with both service providers, ensuring confidentiality and guaranteeing that access is only granted when absolutely necessary and upon instructions from HCD Consulting GmbH (e.g., in case of errors).

7. Transfer of your personal data to third countries or international organisations (outside the scope of the GDPR)

Your personal data are not transferred to third countries or international organizations outside the EU/EEA.

8. Storage duration and erasure

Your personal visitor data are automatically deleted according to the agreed retention periods by “Einfach Gast,” at the latest after 3 months.
Longer storage only occurs if necessary for the clarification of a security-relevant incident. In this case, the data are immediately deleted after the completion of the process.

9. Right to access, erasure, correct, object to, and restrict use of your personal data

You have the right to request confirmation from us as to whether personal data concerning you are being processed. If so, you are entitled to access this personal data and the following information:

• The purposes of processing
• The categories of personal data processed
• The recipients or categories of recipients to whom your personal data have been or will be disclosed, especially recipients in third countries or international organizations
• If possible, the planned duration for which your personal data will be stored, or if not possible, the criteria used to determine that duration
• The existence of a right to correct or delete the personal data concerning you, or to restrict processing by us, or to object to such processing
• The existence of a right to lodge a complaint with a supervisory authority
• If the personal data were not collected directly from you, all available information about the source of the data
• The existence of automated decision-making, including profiling, and in such cases, meaningful information about the logic involved, its significance, and the expected consequences for you.
• If your personal data is transferred to a third country or international organization, you have the right to be informed of the appropriate safeguards relating to the transfer.

We will provide you with a free copy of your personal data undergoing processing. For any further copies you request, we may charge a reasonable fee based on administrative costs. If you make the request electronically, the information will be provided in a commonly used electronic format, unless specified otherwise. The right to receive a copy may be limited if it negatively affects the rights and freedoms of others.

You have the right to request from us the immediate correction of any incorrect personal data concerning you. Taking into account the purposes of the processing, you have the right to complete incomplete personal data, also by providing a supplementary statement. To exercise this right, you may contact our Data Protection Officer.

You have the right to request the deletion of your personal data stored with us if one of the following criteria is met:

• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
• You withdraw consent on which the processing is based, and there is no other legal basis for the processing.
• The personal data have been unlawfully processed.
• There is a legal obligation to delete the data.
• The personal data were collected regarding offered services of the information society (for individuals under 16 years of age).
• Furthermore, you have the right to demand from us the restriction of processing if one of the following conditions applies:
• You contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the data.
• The processing is unlawful, and you oppose the deletion of the personal data and request the restriction of their use instead.
• We no longer need the personal data for the processing purposes, but they are required by you for the establishment, exercise, or defense of legal claims.
• You have objected to processing pending the verification whether our legitimate grounds override yours.

10. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from us, to whom the personal data have been provided, if:

• The processing is based on consent pursuant to point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2), or on a contract pursuant to point (b) of Article 6(1), and;
• The processing is carried out by automated means.

In exercising your right to data portability, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The right to data portability may be limited if it adversely affects the rights and freedoms of others.

11. Right to withdraw consent and maintenance of granted consents

To the extent that we process personal data about you based on a declaration of consent, you have the right to withdraw your consent at any time. However, the legality of the processing carried out based on the consent until its withdrawal is not affected by this. The provisions of point 8 of this privacy policy must also be observed with regard to the adherence to retention periods.

12. Right to complain to a supervisory authority

If you find the need to lodge a complaint with the relevant supervisory authority, you are free to do so at any time. The contact information for the supervising authority in Bavaria is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
Phone: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800
Email: poststelle@lda.bayern.de

13. Mandatory provision of your personal data and possible consequences of refusal

If you do not want recordings of you to be stored, you must stay outside the areas of video surveillance. These areas are clearly marked.

14. Automated decision-making and profiling

No automated decision-making related to your person is performed using the personal data collected from you. No “profiling” (meaningful information about the logic involved as well as the scope and the intended effects of such processing for your person) is carried out with the personal data collected from you.

15. Change of purpose

If we intend to change the purpose for which your personal data was originally collected, we will inform you in advance in a detailed and transparent manner. We will naturally provide you with all legally required information. If the change of purpose involves processing personal data based on a declaration of consent, we will inform you accordingly and ask for your formal consent.

16. Unresolved questions, complaints, or suggestions

You are welcome to contact us with any questions, complaints, or suggestions regarding data protection. If necessary, you can also contact our Data Protection Officer (see point No. 2 of this privacy policy).

Status of the privacy policy: October 28, 2025