Privacy policy

Thank you for visiting our website www.ipdynamics.de/en and for your interest in our company. With the aim of offering you the highest possible degree of transparency, we inform you below about the type, scope and purpose of the collection, processing and use of personal data that arise in the context of the use of our website. The General Data Protection Regulation (hereinafter referred to as "GDPR") can be downloaded here as a complete document.

Contents

1. Definitions of terms

The following terms that we use within our privacy policy are defined within Art. 4 GDPR. This is only an excerpt from Art. 4 GDPR.
All definitions can be found in the GDPR (available here).

• Personal data (Art. 4 No. 1 GDPR)
  ‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  ‍
• Processing (Art. 4 No. 2 GDPR)
  ‘Processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  ‍
• Pseudonymisation (Art. 4 No. 5 GDPR)
  ‘Pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

• Controller (Art. 4 No. 7 GDPR)
  ‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

• Processor (Art. 4 No. 8 GDPR)
  ‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

• Third party (Art. 4 No. 10 GDPR)
  ‘Third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
‍
• Consent (Art. 4 No. 11 GDPR)
  ‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
‍
• Enterprise (Art. 4 No. 18 GDPR)
  ‘Enterprise’ means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity;

2. Controller pursuant to Art. 4 No. 7 GDPR

IP Dynamics GmbH
Billstrasse 103
20539 Hamburg
Telephone: 040 5727 6767
Email: info@ipdynamics.de
You can access our full legal notice here::
https://www.ipdynamics.de/en/legal-notice

3. Data Protection Officer

You can contact our data protection officer by email: datenschutz@ipdynamics.de or by mail (IP Dynamics GmbH, Billstrasse 103, 20539 Hamburg) with the addition „Attn. Data Protection Officer“.

4. Lawfulness of processing

For each processing operation described in our privacy policy, we will inform you of the legal basis on which the processing is based on. A distinction is made between the following groups of cases in which processing is lawful:

• You have given us your consent to the processing of your personal data for one or more specific purposes (Art. 6 para. 1 sentence 1 lit. a GDPR).
• There is a contract between you and us, for the fulfillment of which the processing takes place or the processing is necessary for the implementation of pre-contractual measures, which take place at your request (Art. 6 para. 1 sentence 1 lit. b GDPR).
• The fulfillment of a legal obligation to which we are subject requires processing (Art. 6 para. 1 sentence 1 lit. c GDPR).
• The protection of your vital interests or those of another natural person requires processing (Art. 6 para. 1 sentence 1 lit. d GDPR).
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Art. 6 para. 1 sentence 1 lit. e GDPR).
• The necessity of processing to protect our legitimate interests or those of a third party, unless your interests or fundamental rights and freedoms, which require the protection of personal data, prevail (Art. 6 para. 1 sentence 1 lit. f GDPR).

5. Storage of data / deletion of data

Within the processing described in our privacy policy, we will inform you of the corresponding storage period or the times of deletion or blocking of data. If no explicit storage period is defined, the data will be deleted or blocked as soon as the purpose or legal basis for storage no longer applies. Data may be stored beyond the defined periods if statutory provisions to which we are subject (e.g. Section 147 AO, Section 247 HGB) provide for a different storage period.

Following the storage period, the personal data will be deleted or blocked unless further storage is required by us on a legal basis. In addition, storage beyond the specified period is possible in the event of a (possible) legal dispute with you or other legal proceedings.

6. Disclosure of personal data

If your personal data is transferred, you will be informed accordingly at the relevant point in our privacy policy. If your personal data is transferred outside the European Economic Area and thus to so-called third countries, you will be informed accordingly at the relevant point in our privacy policy. In general, we only transfer personal data to third countries where the EU Commission has confirmed an adequate level of protection or where we can guarantee the careful handling of personal data on the basis of contractual agreements or other suitable guarantees.

7. Collection of personal data

In the following, we will inform you about the collection of personal data (such as name, email address, address or user behavior). The provision of data is neither legally nor contractually required. You are neither legally nor contractually obliged to provide the data. Please note, however, that it is not possible to use our website without providing the data specified in section 6.1. Automated decision-making, including profiling in accordance with Art. 22 (1) and (4) GDPR, does not take place on our website.

7.1 Use of our website for information purposes only

If you do not register on our website (e.g. in the form of a newsletter) or transmit data to us in any other way (e.g. by using a contact form), only the personal data transmitted by your browser to our server will be collected. This is data that is technically necessary for us to make the website available to you for viewing while ensuring a secure and stable display. This is the following information, which is derived from a log file line:

• Internet Protocol Address (IP address)
• Time and date of the respective access
• Time zone difference to Greenwich Mean Time (GMT)
• The specific page accessed
• Status of access / Hypertext Transfer Protocol (http)
• Amount of data transferred in each case
• Website from which our website is accessed (Referrer URL)
• Internet browser used (incl. language and version)
• Operating system used

The legal basis for the collection of the listed data results from Art. 6 para. 1 sentence 1 lit. f GDPR. We have a legitimate interest in ensuring error-free connection establishment and convenient use of our website as well as analyzing system stability and security and using the data for other administrative purposes.

7.2 Contact by email

If you contact us via the email address provided in section 2 or other email addresses of our company that are published on our website, we will store your email address and other contact details provided in your email (e.g. your name or telephone number) in order to process your request. This data will be deleted immediately as soon as further storage is no longer necessary. If legal storage periods apply with regard to the data, processing will be restricted accordingly instead of the data being deleted. Depending on the reason for sending the email, the legal basis for processing the data results from Art. 6 para. 1 sentence 1 lit. b GDPR or from Art. 6 para. 1 sentence 1 lit. f GDPR, i.e. either for processing the contract concluded with you and for fulfilling our (pre)contractual obligations or is based on our legitimate interest in contacting people interested in our services.

7.3 Applications

7.3.1 Application forms

Job vacancies are published on our website for which you can apply. When you apply, the data you provide will be stored by us and processed for the purposes of the application process. The legal basis for the processing of this data is the fulfillment of our pre-contractual obligations in the context of the application procedure in accordance with Art. 6 para. 1 lit. b GDPR in conjunction with § 26 Federal Data Protection Act (BDSG). furthermore, an additional legal basis may arise from Art. 6 para. 1 lit. f GDPR, if the data processing becomes necessary, for example, in the context of legal proceedings. If applicants voluntarily submit special categories of personal data in accordance with Art. 9 para. 1 GDPR, these will be processed by us in accordance with Art. 9 para. 2 lit. b GDPR. If we request data in accordance with Art. 9 para. 1 GDPR, the data processing is always based on your explicit consent (Art. 9 para. 2 lit. a GDPR). If the application results in an employment relationship, the applicant data will be further processed by us to establish an employment relationship in accordance with Art. 6 para. 1 lit. b GDPR in conjunction with § 26 BDSG. Otherwise, the applicant data will be stored by us exclusively for the duration of the application procedure and at the longest in accordance with the generally recognized and legal storage periods and then deleted (at the latest 6 months after the position has been filled - in order to be able to react to applicant claims under the General Equal Treatment Act (AGG)). This also applies to withdrawn applications. Further data may also be stored beyond this period to fulfill other legal obligations.

7.3.2 Use of the HR software Personio

The data you enter in the application form will first be transferred to our servers, which are located in the data center of the company IPHH Internet Port Hamburg GmbH, Wendenstrasse 408, 20537 Hamburg, Legal notice: https://www.iphh.net/de/impressum.html. We have concluded a corresponding Data Processing Agreement with the company IPHH Internet Port Hamburg GmbH. You can access the privacy policy of IPHH Internet Port Hamburg GmbH here: https://www.iphh.net/en/datasecurity.html. The data is then transferred via an interface (API) to our HR software Personio from Personio SE & Co. KG, Seidlstraße 3, 80335 Munich (hereinafter referred to as "Personio"), Legal notice: https://www.personio.com/legal-notice/. Personio's privacy policy can be found here: https://www.personio.com/privacy-policy/.

Personio uses Amazon Web Services Europe (AWS) as its hosting provider. According to Personio, the AWS data centers are DIN ISO/IEC 27001 and DIN ISO/IEC 27018 certified and guarantee the highest level of data protection security. In addition, all customer data is stored on servers within the European Union. Personio states that it takes additional technical and organizational measures to ensure the security of processing. Further information can be found here:

‍https://assets.ctfassets.net/p03bi75xct27/6TFQJxhCudjHfzhdB9L1OZ/cdfcdbc2a8fe3031bcfa3065213e46fc/2022_AWS_DataSecurity_Brochure_EN.pdf

We have signed a data processing agreement with Personio. The legal basis for data processing is Art. 6 para. 1 lit. b GDPR.

8. Webflow

Our website is hosted by the company Webflow, Inc, 398 11th Street, 2nd Floor, San Francisco, CA 94103 (hereinafter referred to as "Webflow"). Webflow also provides the content management system for our website. We have signed an Data Processing Agreement with the company, which contains the standard contractual clauses for the transfer of personal data to third countries in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (available here in English). You can access Webflow's global privacy policy here: https://webflow.com/legal/privacy. You can access the privacy policy for the EU and Switzerland here: https://webflow.com/legal/eu-privacy-policy.

8.1 Hosting

Webflow hosts our website using the content delivery networks of the US companies Fastly Inc. and Amazon Web Services, Inc. A content delivery network is a network of geographically distributed, possibly interconnected servers. The server closest to the respective user of the website is always used. The CDN used here includes servers in North America and parts of Europe. You can find more information on the following Webflow page: https://webflow.com/blog/what-to-look-for-in-a-web-hosting-service.

8.1.1 Fastly

Webflow hosts our website using the content delivery network of the US company Fastly Inc. 475, Brannan St. #300, San Francisco, CA 94107. You can access the company's privacy policy here: https://www.fastly.com/privacy/.

8.1.2 Amazon CloudFront

Webflow hosts our website using the Content Delivery Network of the US company Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109. The CDN is called Amazon CloudFront. You can access the company's legal notice here (only available in German): https://aws.amazon.com/de/impressum/?nc1=f_cc. You can access the company's privacy policy here: https://aws.amazon.com/privacy/?nc1=h_ls.

8.2 Cloudflare

In order to ensure cross-browser compatibility so that the modern functionality of Webflow pages is also available in older browsers that do not support it natively, Webflow integrates JavaScript using the Cloudflare CDN. The CDN is operated by Cloudflare, Inc, 101 Townsend St., San Francisco, CA 94107. You can access the company's privacy policy here: https://www.cloudflare.com/privacypolicy.

8.3 webflow.com

Additionally, a connection to the domain webflow.com exists. This domain belongs to the company Webflow. Images and other assets that are integrated into our website are hosted there. This domain of the company Webflow is also hosted via the CDNs Fastly and Amazon CloudFront.

8.4 Legal basis

The legal basis for data processing within the meaning of the above is Art. 6 para. 1 sentence 1 lit. b GDPR. In sections 8.1 - 8.3, data is also transferred to countries outside the scope of the GDPR. An EU adequacy decision exists for the countries concerned. The data transfer is therefore permitted without special authorization in accordance with Art. 45 para. 1 GDPR.

9. Streamboxy

For our webinars, we use Streamboxy, a platform provided by Makonis GmbH, Walter-Gropius-Straße 15, 80807 Munich, Germany, as part of data processing. Streamboxy processes the following data of the participants for the provision of the platform: first and last name, email address, telephone number, audio and video of events. This data is passed on to us, and information such as the type of web browser, the operating system used and similar data is also collected when the platform is accessed. you can find further information at: https://en.streamboxy.com/privacy-platform.

10. Cookies

We use cookies on our website. Cookies are small, browser-specific text files that are stored on your hard disk. This provides the site that sets the cookie with certain information, but does not allow programs to be executed or viruses to be transmitted. Cookies are divided into the following classes:

Automated, we only use technical cookies and thus cookies that are essential for the operation of our website on the basis of our legitimate interest within the meaning of Art. 6 para. 1 sentence 1 lit. f GDPR in order to effectively design and continuously improve our website.

We would like to point out that you can prevent the storage of cookies at any time by setting your browser accordingly. We have compiled further information in this context with regard to the most common browsers below, but would like to point out that this may restrict the functionality of our website.

• Mozilla Firefox: https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop
• Microsoft Edge: https://support.microsoft.com/en-gb/windows/manage-cookies-in-microsoft-edge-view-allow-block-delete-and-use-168dab11-0753-043d-7c16-ede5947fc64d
• Google Chrome: https://support.google.com/chrome/answer/95647
• Opera: https://help.opera.com/en/latest/web-preferences/#cookies
• Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac
  

11. CookieFirst

We use the consent management tool CookieFirst of the company Digital Data Solutions B.V., Plantage Middenlaan 42a, 1018DH Amsterdam (hereinafter referred to as "Digital Data Solutions"). The privacy policy of Digital Data Solutions can be found here: https://cookiefirst.com/legal/privacy-policy. We have signed a corresponding Data Processing Agreement with Digital Data Solutions (you can access the contract here: https://cookiefirst.com/legal/data-processing-agreement). In general, personal data is only processed within the borders of the European Union and the countries designated by the European Commission as providing an adequate level of protection. The CookieFirst tool automatically sets cookies and describes the local storage to save the decisions you have made regarding data protection settings. The legal basis results from Art. 6 para. 1 sentence 1 lit.c GDPR, as we thus ensure compliance with legal requirements.

12. Matomo

We use the web analysis tool "Matomo" (https://matomo.org/). Matomo is an open source tool that is maintained by the company "InnoCraft Ltd", 150 Willis St, 6011Wellington, New Zealand, https://www.innocraft.com/ (hereinafter referred to as "InnoCraft") (InnoCraft Ltd. was founded by the developers of Matomo). Matomo creates user profiles in anonymized form, with the help of which we can analyze and optimize our website accordingly. Matomo collects the following data:

• IP address (2 bytes anonymized)
• Page views
• Reference URL without query parameters
• Device properties and
• Browser properties

The data is automatically deleted after 300 days. Matomo's privacy policy can be found here: https://matomo.org/privacy-policy/. Cookies are used when Matomo is used. In this regard, we only use Matomo once you have given us your consent via our consent tool. The legal basis for the use is Art. 6 para. 1 lit. a GDPR if you have given your consent. You can change or revoke your consent at any time by clicking on the "Revocation / change of data protection settings" button located in the footer of the website. InnoCraft itself states (https://matomo.org/gdpr-analytics/) that the data is stored in the EU (Matomo Cloud).

13. LinkedIn Insight Tag

We use the tracking tool "LinkedIn Insight Tag". LinkedIn Insight Tag is a tracking and analysis tool from the company "LinkedIn Ireland Unlimited Company", Wilton Place, Dublin 2, Ireland, https://about.linkedin.com/ (hereinafter "LinkedIn").

With the LinkedIn Insight Tag and data collection, we analyze incoming website visits via LinkedIn and measure our LinkedIn campaigns. We also use the data for retargeting campaigns on LinkedIn.

The LinkedIn Insight Tag uses cookies. These are set as soon as consent has been given via the consent tool. The legal basis for the processing of personal data is Art. 6(1)(a) GDPR.

The LinkedIn Insight Tag processes the following data from visitors to the website:

• URL
• Referrer URL
• Device properties
• Browser properties and
• IP address

The data is anonymized within seven days and deleted within 90 days. LinkedIn uses the anonymized data to provide summarized reports on website visitors and ad performance. This includes information such as:

• Industry
• Job title
• Company size
• Career level and
• Location

Consent can be changed or revoked at any time by clicking on the "Revocation / change of data protection settings" button in the footer of the website.

LinkedIn's privacy policy can be found here:https://www.linkedin.com/legal/privacy-policy‍

We integrate YouTube videos on our website. This is a video portal of the company Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, legal notice: https://www.google.de/contact/impressum.html. The parent company of this Irish-based company is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). Google's privacy policy can be found here: https://policies.google.com/privacy. We have implemented the videos in an "extended data protection mode". If you call up a subpage on which a YouTube video is implemented and play it, Google receives the information about this call and the personal data mentioned in this privay policy is transmitted to Google for purely informational use of the website. This transfer is used by Google to create a user profile and takes place regardless of whether you have a Google account. However, if you do have an account and you are logged into your account when you access a subpage on which a YouTube video is embedded, this data will be linked to your account. This data is stored by Google and used for advertising and/or market research purposes, such as the provision of customized advertising. With regard to storage, please refer to the information provided by Google, available at: https://policies.google.com/technologies/retention‍

We only use YouTube if you have given us your explicit consent to do so via the consent tool (Art. 49 para. 1 sentence 1 lit. a GDPR, Art. 6 para. 1 lit. a GDPR).

15. Career contact form

At career fairs, we provide a contact form at our trade fair stand, which gives you the opportunity to leave your contact details for contacting us about job vacancies.

The following personal data is collected: First and last name, email address, information about which jobs we may inform you about, if applicable, further information entered manually by you. The data is stored exclusively for the purpose of sending job advertisements and other relevant communication regarding job offers.

The storage period is 12 months. If no response is received within this period, the data will be deleted.

You can object to the processing of your data at any time. To do so, send an informal e-mail with the subject "Delete career contact data" to personal@ipdynamics.de.

16. Your rights

Below we inform you about your rights under the GDPR. You can download the GDPR as a complete document here.

• Right to access pursuant to Art. 15 (1) GDPR
  You have the right to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, in addition to the right to information about this personal data, you have the right to be informed about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients to whom your personal data has been disclosed or will be disclosed in the future (in particular to recipients in third countries or international organizations), the storage period or criteria for determining the storage period, the existence of a right to rectification or erasure of the personal data concerning you or the right to object to the processing of your personal data or the criteria used to determine the storage period, the existence of the right to request from us rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing, the existence of the right to lodge a complaint with a supervisory authority, any available information as to the source of the data (where the personal data are not collected by us), the existence of automated decision-making, including profiling and, where applicable, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing.

• Right to rectification pursuant to Art. 16 GDPR
  You have the right to obtain from us without undue delay the rectification of inaccurate personal data and the completion of incomplete personal data concerning you.

• You have the right to demand that we erase the personal data concerning you without undue delay. However, according to Art. 17 para. 3 GDPR, this right does not apply if the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest in the area of public health, for archiving purposes in the public interest or for the establishment, exercise or defense of legal claims.

• Right to restriction of processing pursuant to Art. 18 para. 1 GDPR
  You have the right to demand that we restrict the processing of your personal data if you dispute the accuracy of your personal data (the restriction applies for the period of time that enables us to verify the accuracy), the processing of your personal data is unlawful and you refuse to delete it, we no longer need your personal data for the processing purposes, but you need it to claim, exercise or defend legal claims or you have objected to the processing in accordance to Art. 21 para. 1 GDPR (the restriction applies as long as it is not yet clear whether our legitimate reasons outweigh yours).

• Right to data portability pursuant to Art. 20 GDPR
  You have the right to receive the personal data concerning you from us in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from us (or to have them transmitted directly from us to another controller, where technically possible), where the processing is based on consent or on a contract or is carried out by automated means.

• Right to withdraw consent granted pursuant to Art. 7 para. 3 GDPR
  You have the right to revoke your consent at any time with effect for the future, so that the data processing that was based on your consent can no longer be continued in the future, but the legality of the processing carried out until your revocation is not affected by this.

• Right to lodge a complaint pursuant to Art. 77 GDPR
  Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR. As a rule, you can contact the supervisory authority of your usual place of residence, your place of work or the place of the alleged infringement. Further information on this can be found on the website of the Federal Commissioner for Data Protection and Freedom of Information.

17. Right of objection

In addition to the aforementioned rights, you also have the right to object at any time to the processing of your personal data, which is based on the performance of a task carried out in the public interest or in the exercise of official authority (Art. 6 para. 1 sentence 1 lit. e GDPR) or to safeguard legitimate interests on our part (Art. 6 para. 1 sentence 1 lit. f GDPR), with effect for the future, provided that there are reasons for this arising from your particular situation. If you object, your personal data will no longer be processed unless we can demonstrate compelling legitimate grounds for the processing which outweigh your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. If your personal data is processed for the purpose of direct marketing or profiling, insofar as there is a connection to direct marketing, you have a general right to object without the need for reasons arising from your particular situation. In the event of an objection, we will immediately stop processing the personal data for these purposes.  To exercise your right of revocation or objection, simply send an email to: info@ipdynamics.de

18. Data security

The TLS 1.3 (Transport Layer Security) encryption and communication protocol is used on our website. The TLS certificate used by us and issued by a certification authority enables encrypted data exchange between the web browser and web server, which means that sensitive data cannot be read by third parties. We use the process with the highest encryption level supported by your browser, which is usually 256-bit encryption. The higher the number of bits, the longer the key and the better the protection against third parties.