Privacy Policy for website visitors and job applicants

This Privacy Policy is intended for (i) all website visitors (https://combine-consulting.com) and (ii) all job applicants.

Personal data is any information relating to an identified or identifiable natural person. This Privacy Policy explains how your personal data is processed in connection with a visit to the website and what rights and choices you have available.

1. General information

1.1 Name and contact details of the data controllers

Data controller 1 for processing:

Name: combine Consulting GmbH
Address: Leopoldstraße 28 a, 80802 Munich, Germany
Telephone: +49 (0) 89 416 12 12 0
Email: info@combine-consulting.com

(“combine Consulting”)

Data controller 2 for processing:

Name: combine design GmbH
Address: Leopoldstraße 28a, 80802 Munich, Germany
Telephone: +49 (0) 89 416 1212 0
Email: info@combine-design.de

(“combine design”)

combine Consulting and combine design jointly referred to as “we” or “us”.

1.2 Joint responsibility

combine Consulting and combine design are the joint controllers within the meaning of Art. 26 GDPR for this website, where the responsibility for specific processing/a specific service is not explicitly assigned to one of the two controllers in this Privacy Policy.

We have entered into an agreement on joint processing under Article 26 GDPR.

Accordingly we use a common infrastructure for the technical implementation of this website.

In implementing this common technical infrastructure, it is in principle possible for both controllers to access the (personal) data collected via this website from server log files, cookies, social plug-ins, newsletters, as well as the enquiries and applications transmitted, or to request disclosure from the other controller with regard to the data concerning the respective controller.

At the same time, however, both controllers (combine Consulting and combine design) remain responsible for meeting their obligations under the GDPR, e.g. to maintain a register of processing activities, to conduct a data protection impact assessment or to consult the supervisory authorities, and to take appropriate technical and organisational security measures for the data to be processed, and for ensuring that processing operations are carried out in accordance with the provisions of data protection legislation.

Where processing operations are carried out jointly and personal data is transmitted between each other for this purpose, this is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is to save resources within the group and to make processes more effective.

1.3 Data protection officer

The data protection officer represents both combine Consulting and combine design and can be contacted at:

Email: datenschutz@dataguard.de

2. Processing of personal data by us

Below you can see the processing activities via the website as well as selected processing activities outside this website for which combine Consulting and combine design are joint controllers. Based on the type of personal data, it will be explained to you for which purposes and on what legal basis the personal data will be processed as well as for how long the personal data will be stored.

2.1 Website visit for purely informational purposes

If you visit the website for purely informational purposes without actively providing data in any way, only the Internet connection data that your browser transmits to our server is processed.

Type of personal data Processing purposes and legal basis
Server log files
Browser type and browser version; operating system used;
The visitor’s Internet service provider;
IP address;
Date and time of the server request;
Referrer URL;
Websites that the visitor accesses via our website.
When you visit our website, information is automatically processed in “server log files”, which your browser automatically transmits to us. This data is collected both for the future optimisation of our online services and for data protection control and data security. There is no evaluation of the data for marketing purposes in this context.

The processing of this data is based on Art. 6(1)(f) GDPR.

 

The data will be erased as soon as it is no longer necessary to achieve the purpose for which it was collected. Where data is collected for provision of the website, this is the case once the respective session is terminated. If the data is stored in server log files, this must be done by no later than after seven days. Data may be stored for longer than this. In this case, the IP addresses are deleted or alienated, so that it is no longer possible to attribute the calling client.

The personal data listed in this clause 2.1 is automatically collected by our IT systems when you visit the website. Without processing the personal data, the website may not be displayed at its best.

2.2 Contact via contact form/email

If you contact us using the contact form or by email, for example to find out more about our products and services and for other enquiries from you, we process the personal data listed below.

Type of personal data Processing purposes and legal basis
Contact form/email

Specified contact data (name, phone number, address, reason for contact, etc.), email address; IP address.

 

 

 

 

 

If you contact us via the website, request information material or a catalogue, the information you provide in the contact form or in your email will be recorded for the purpose of processing the request and the associated technical administration, and in the event that follow-up questions arise, and thus processed by the person responsible to whom the request is addressed. The other personal data processed during the sending process serves to prevent misuse of the contact form/email contact and to safeguard the security of our information technology systems.

In the case of pre-contractual measures, the processing of this data is based on Art. 6(1)(b) GDPR.
Otherwise because of the mutual interest in processing in accordance with Art. 6(1)(f) GDPR.

Under this clause 2.2, we store your personal data only as long as it is necessary for the transmission of the information you have requested from us and the establishment of the possible business relationship with us. This contact ends when it can be inferred from the circumstances that the matter in question has been conclusively resolved.

We collect the personal data listed in clause 2.2 directly from you when you provide the personal data yourself. Without processing of the personal data (with the exception of any voluntary information), it is not possible to provide the services listed in this clause 2.2.

2.3 Job application

During applications via our website, but also in the case of applications in other ways, we process the following personal data as described below.

Type of personal data Processing purposes and legal basis
Job application data

(i) Personal details:
Name, private contact details (email address, telephone number, postal address).

(ii) Other technical information:
CV, letters of recommendation, cover letter, work permit, previous employment, educational history, languages spoken, skills relevant to employment, and references.

(iii) Information provided during the remainder of the application process (some required by law) such as:
Date and place of birth, marital status, number of children, driving licence information and disability status, if applicable.

The processing of the above personal data in connection with an application, which may be made by email, via a company page (social media presence, see clause 2.6), or by post, is necessary for the selection of suitable employees, the notification of the decision on an application, the coordination of the application process (e.g. personal interview) and the establishment of an employment relationship.

 

The processing of this data is based on Section 26(1) first sentence Federal Data Protection Act (BDSG).

 

We collect the personal data mentioned in this clause 2.3 directly from you as an applicant during the application process.

If your application to us is unsuccessful, we will store this personal data for three months after notifying you of this decision. The legal basis for the processing of the data is then, in addition to the above, Art. 6 (1)(f) GDPR. Our legitimate interest is to use this personal data, if necessary, in relation to legal disputes with applicants, in particular in connection with the General Equal Treatment Act (AGG).

2.4 Cookies and analytics services

(a) Information regarding cookies

We use „cookies“ on the website for various purposes. Cookies do not damage your computer and do not contain viruses. Cookies are there to make our offer more user-friendly, effective and safe. Some elements of our website require that the requesting browser be identifiable even after changing pages. Cookies are small text files that are stored on your device and saved by the browser.

(b) Information regarding session cookies

The website currently uses session cookies, which are used in particular for the functioning of language settings, remembering search terms and showing and hiding the cookie banner.

This is done by processing the language settings, the search terms entered, the frequency of page views, the use of website functions and the cookie preference using the following cookies:

uncode_privacy[consent_types]; uncode_privacy%5Bprivacy_bar%5D.

The data processing is based on the legal basis of Art. 6(1)(f) GDPR. Our legitimate interest is the provision/optimisation of our website.

The above data will be processed as long as it is necessary to achieve this purpose. As a rule, the storage period of session cookies is the period until the end of your visit to the website. Depending on the type of your browser, restoring the previously visited page may be activated in the preferences, so that the session cookies can also be stored longer.

You can prevent cookies from being saved by setting your browser software accordingly; we would like to point out that in this case you will not be able to use all functions of the website to their fullest extent.

(c) Information regarding Google Analytics

In addition, our website collects and stores personal data from you using the web analysis service software of Google LLC for statistical analysis of user behaviour and thus for optimisation and marketing purposes. The information recorded includes, but is not limited to:

IP address, date and time of page view, click path, information about the browser and device you are using, pages visited, referrer URL (website from which you accessed our website), location data and order activity.

Google uses this information to evaluate the use of our website by visitors and to compile reports on website activity. By evaluating the data obtained, we are able to compile information about the use of the individual components of our website. This helps us to continuously improve our website and its user-friendliness.

We have extended the use of Google Analytics with the configuration parameter „anonymizeIP“. This means that your IP address is only recorded in abbreviated form. In this respect, your data will be processed exclusively in pseudonymous form.

Since Google uses this personal data to evaluate the use of our website by visitors and to compile reports on website activity, we have entered into an order processing agreement with Google. Since personal data may be transferred to Google’s server in the USA, we have also concluded standard contractual clauses, as they are called, with Google.

The legal basis for the data processing of your personal data by means of Google Analytics is Art. 6(1)(a) GDPR.

You can prevent cookies from being saved by setting your browser software accordingly; we would like to point out that in this case you will not be able to use all functions of the website to their fullest extent.

Alternatively, you can withdraw this consent at any time in our cookie consent tool […]. The legality of the data processing operations that have already taken place remains unaffected by the withdrawal.

The data will be erased as soon as it is no longer necessary for our recording purposes. In our case, this is the case after 24 months.

In addition, Google may also use your personal data for its own purposes, such as profiling. Despite the standard contractual clauses, government agencies in the USA may also have access to this personal data. For more information on how Google Analytics uses your data, please refer to Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=en.

(c) Information regarding Matterport

Our website contains virtual tours that are integrated via the portal my.matterport.com. The operator of this portal is Matterport, Inc, 352 E. Java Dr. Sunnyvale, CA 94089, USA.

As soon as you click on a virtual tour on our website, a connection is established to Matterport’s servers. This will tell the Matterport server which of our pages you have visited. In addition, Matterport obtains your IP address. This also applies if you are not logged in to Matterport or do not have an account with Matterport. The information collected by Matterport is transmitted to the Matterport server in the USA. If you are logged into your Matterport account, you allow Matterport to directly associate your surfing habits with your personal profile. You can prevent this by logging out of your Matterport account.

The legal basis for the transfer of this data to Matterport in the USA for the display of the virtual tour integrated into our website is your consent under Art. 6(1)(a) GDPR.

The above data will be processed for transmission as long as it is necessary to achieve this purpose. However, this data processing by us ends at the latest when the virtual tour is closed and the data is erased. You can therefore withdraw your consent to the processing of your personal data in connection with the display of a virtual tour at any time by closing the virtual tour. The legality of the data processing operations that have already taken place remains unaffected by the withdrawal.

For more information on the purpose and scope of data collection and processing by Matterport, please refer to Matterport’s privacy policy. There you will also find more information about your rights and privacy settings: matterport.com/en/legal/privacy-policy. Matterport also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework.

2.5 Newsletter

Furthermore, we process your personal data when you register for our newsletter.

Type of personal data Processing purposes and legal basis
Login data:
Email address,
Form of address,
First name,
Surname,
IP address of the calling computer, date and time of registration.
When registering for the newsletter, the data from the input screen and technically required data is processed by us. This data is collected for the purpose of sending the newsletter ordered. The collection of other personal data as part of the subscription process is to prevent the misuse of the services or of the email address used.

The processing of this data is based on Art. 6(1)(a) GDPR.

Subscription to our newsletter takes place using a process known as double opt-in. After registration you will receive a confirmation email from us, in which you have to confirm the registration again. This entire process is documented and stored. This includes both the storage of the login and confirmation time, as well as your IP address. The data will not be disclosed to third parties.

Your email address and the other data provided by you will be stored for as long as your subscription to the newsletter is active.

You can withdraw your consent to the processing of your personal data in connection with the sending of the newsletter at any time by unsubscribing to the newsletter. Please use the link provided at the end of the newsletter to unsubscribe. The legality of the data processing operations that have already taken place remains unaffected by the withdrawal.

2.6 Social media

(a) Icons leading to company pages and share icons

In addition to the website, we also maintain joint company pages (company profiles) on various social media providers in order to communicate with the visitors, interested parties and applicants active there and to be able to inform you about our services and open job positions.

In this context, on our website, for the integrated icons (Xing, Twitter, Instagram, LinkedIn) of the social media providers we only use simple links, which do not establish a connection to the respective social media platform when our website is loaded. Similarly, links to our YouTube videos are just simple links that do not connect to YouTube when our website loads.

The same applies to the „share icons“ (Facebook, Twitter, Pinterest, LinkedIn, Xing), which allow you to share certain content on our website via your social media account.

(b) Processing of your data when you visit our company pages

(i) YouTube, Xing and Twitter

Where you visit one of our company pages on YouTube, Xing or Twitter by clicking on the social media link/simple link or directly and use the contact options provided there (including a comment function), your personal data will be processed by us there to the extent determined under clause 2.2 and (if applicable) 2.3.

In addition, your personal data collected via the social media provider’s own website (our company page) will also be transmitted to the provider of the social media platform and processed by the social media platform itself. It is likely that, in addition to storing the data you specifically entered on this social media platform, other information will also be processed by the social media provider. If you are logged in with your personal user account of the respective network while visiting such a social media platform, the social media platform can assign the visit to your account. If you do not wish it be assigned, you must log out of your account before visiting our company website and delete the cookies if necessary. For more information on the purpose and scope of data processing there and on the further processing and use of your data, please refer to the privacy policy of the respective social media provider:

YouTube

YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy Policy: https://policies.google.com/privacy

Xing

Xing is operated by New Work SE, Dammtorstraße 29-32, 20354 Hamburg, Germany.
Privacy policy: https://privacy.xing.com/en

Twitter

Twitter is operated by Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland.
Privacy policy: https://twitter.com/en/privacy

Finally, YouTube, Xing and Twitter give us access to statistical data, as it is called (in particular: YouTube: the number of visitors to our company page, the volume of interactions, the average duration of video playbacks, the number of daily active users, access sources, demographic data (information on which countries and cities our visitors come from and statistics on the gender ratio of our visitors); Xing/Twitter: the number of visitors to our company page, the volume of interactions, information on which countries and cities our visitors come from and statistics on the gender ratio of our visitors) generated by the social media providers from the personal data they themselves collect and made available to us in anonymised form. Conclusions about individual users and access to individual users are not possible for us.

(ii) Instagram and LinkedIn

Also where you visit such a company page of ours on Instagram or LinkedIn by clicking on the social media link or directly and use the contact options provided there (including a comment function), your personal data will be processed by us to the extent determined under clause 2.2 and (if applicable) 2.3.

Data processing by us is carried out on the basis of balancing of interests under Art. 6(1)(f) GDPR. With the processing of personal data, we pursue the interest of providing visitors/users with a range of topical information as well as interaction opportunities on our company pages.

For these company pages, we are joint data controllers with Instagram and LinkedIn, respectively, within the meaning of the GDPR. As the joint controllers of these company pages, we have entered into agreements with Instagram and LinkedIn that govern, among other things, the conditions for use of the company page. When you visit our company pages on Instagram or LinkedIn, the respective social media providers process personal data from you. Part of the personal data collected and processed on the occasion of the use of our company pages is made available to us in aggregated form via the „Insights“, as they are called (user statistics). The user statistics created (in particular: Instagram: activity information (reactions: Like/Hearts, comments, how shared or saved, how many viewed profile in response to a story, clicks on links in profile), demographic data; LinkedIn: posts (number, how often a post was displayed, number, how often post and company were clicked on, likes, comments, shares), followers (whether organic or not, demographic data), visitors (how often the same visitor, demographic data)) are transmitted to us exclusively in anonymised form. We do not have access to the underlying data in each case. For more detailed information on data processing, in particular with regard to user statistics, refer to the agreements on data privacy responsibility:

For LinkedIn:

https://legal.linkedin.com/pages-joint-controller-addendum

For Instagram:

https://www.facebook.com/legal/terms/page_controller_addendum

The extent to which the social media providers collect and process personal data in addition can be found in the privacy policies linked below. In this respect, we have no influence on whether Instagram or LinkedIn transmits personal data to third parties. In particular, it is possible that personal data will be processed outside the European Union by Instagram Inc. or LinkedIn Inc. based in the USA.

LinkedIn

LinkedIn is operated by LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland
Privacy policy: https://www.linkedin.com/legal/privacy-policy

Instagram

Instagram is operated by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Privacy policy: https://help.instagram.com/519522125107875

3. Recipients of the personal data

We share your personal information with the following recipients:

3.1 To process personal data for the aforementioned purposes, we use processors who process the personal data on our behalf. In doing so, we retain control over the respective personal data and remain the data controller.

3.2 For payment processing in the course of orders, we transmit payment information to banks or payment service providers, if required by the payment method.

3.3 Where necessary, we transmit contact information to logistics companies to carry out the shipment of goods.

3.4 In individual cases, at your request, we may share the personal data required for ordering with our international representative offices (other companies in the group of companies). Unless there is an adequacy decision by the European Commission for the respective third country outside the European Economic Area, this is done on the basis of Art. 49(1)(b) GDPR.

3.5 We transmit personal data in individual cases to courts, law enforcement agencies, supervisory authorities, other authorities, tax advisers and lawyers, if this is legally permissible and necessary.

4. Automated decision-making

We will not use your personal data to make automated decisions (including profiling) concerning you that have legal effect on you or similarly significantly affect you.

5. Your rights

With regard to the processing of your personal data by us, you have the following rights. In connection with processing operations carried out by either controller (clause 1.2), you may also contact either of them for this purpose.

5.1 According to the legal provisions, you have the following rights:

  • The right to be informed about your personal data: this allows you to obtain a copy of the personal data we process about you and to verify that we are processing it lawfully;
  • The right to rectify the personal data we process about you: this allows you to have incomplete or inaccurate data corrected;
  • The right to erasure of your personal data: this allows you to request that we erase or remove personal data if we have no further reason to continue processing it;
  • The right to object to the processing of your personal data where the processing is based on our legitimate interests (or those of a third party) and where grounds arise from your particular situation for objecting to the processing on said basis. In particular, you have the right to object if we process your data for direct marketing purposes;
  • The right to restrict the processing of your personal information: this allows you to request that the processing of your personal information be suspended, for example, if you want us to determine its accuracy or the basis for processing; and
  • Under certain circumstances, the right to transfer your personal data to another controller.

5.2 If you have given us your consent for the processing of your personal data, you have the right to withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until withdrawal.

5.3 You have the right to lodge a complaint to a competent supervisory authority at any time.