Legal

Privacy Policy

This privacy policy informs you about how we handle your data. In order to make the processing of your data comprehensible for you, we would like to provide you with an overview of this processing with the following information. In order to ensure fair processing, this privacy policy contains general information on our handling of your data as well as information on your rights under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

cimt ag (hereinafter referred to as “we” or “us”) is responsible for data processing.

Part I

General information

1. Contact

If you have any questions or suggestions regarding this information or would like to contact us to assert your rights, please send your request to

cimt ag
An der Alster 64
20099 Hamburg

Phone: +49 40 53302-0
Fax: +49 40 53302-22
E-mail: info@cimt-ag.de

2. Legal bases

The data protection term “personal data” refers to all information that relates to an identified or identifiable person.

We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the BDSG. Data processing by us only takes place on the basis of legal permission. We process personal data

only with your consent (Art. 6 (1) (a) GDPR),
for the performance of a contract to which you are party or, at your request, for the implementation of pre-contractual measures (Art. 6 (1) (b) GDPR),
to fulfill a legal obligation (Art. 6 para. 1 letter c) GDPR)
or if the processing is necessary for the purposes of our legitimate interests or the legitimate interests of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (Art. 6 (1) (f) GDPR).

3. Duration of storage

Unless otherwise stated in the following information, we only store the data for as long as is necessary to achieve the purpose of processing or to fulfill our contractual or legal obligations. Such statutory retention obligations may arise in particular from commercial or tax law regulations.

4. Categories of recipients of the data

We use processors within the scope of processing your data. The processing operations carried out by such processors include, for example, hosting, maintenance and support of IT systems, marketing measures or file and data carrier destruction. A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. Processors do not use the data for their own purposes, but carry out the data processing exclusively for the controller and are contractually obliged to guarantee suitable technical and organizational measures for data protection.

We may also transfer your personal data to bodies such as postal and delivery services, your bank, tax consultants/auditors or the tax authorities.

If your data is transmitted to other recipients, we will inform you under the respective processing procedure.

5. Data transfer to third countries

Our data processing may involve the transfer of certain personal data to third countries, i.e. countries in which the GDPR is not applicable law. Such a transfer is permitted if the European Commission has determined that an adequate level of data protection is required in such a third country. If there is no such adequacy decision by the European Commission, personal data will only be transferred to a third country if there are suitable guarantees in accordance with Art. 46 GDPR or if one of the requirements of Art. 49 GDPR is met.

Unless there is an adequacy decision and unless otherwise stated below, we use the EU standard data protection clauses as appropriate safeguards for the transfer of personal data to third countries. You have the option of receiving or viewing a copy of these EU standard data protection clauses. Please contact us at the address given under Contact.

6. Processing when exercising your rights pursuant to Art. 15 to 22 GDPR

If you exercise your rights in accordance with Art. 15 to 22 GDPR, we process the personal data transmitted for the purpose of implementing these rights by us and to be able to provide proof of this. We will only process data stored for the purpose of providing and preparing information for this purpose and for the purposes of data protection monitoring and will otherwise restrict processing in accordance with Art. 18 GDPR.

This processing is based on the legal basis of Art. 6 para. 1 lit. c) GDPR in conjunction with. Art. 15 to 22 GDPR and Section 34 (2) BDSG.

7. Your rights

As a data subject, you have the right to assert your data subject rights against us. In particular, you have the following rights:

In accordance with Art. 15 GDPR and Section 34 BDSG, you have the right to request information as to whether or not we process personal data relating to you and, if so, to what extent.
You have the right to demand that we rectify your data in accordance with Art. 16 GDPR.
You have the right to demand that we erase your personal data in accordance with Art. 17 GDPR and Section 35 BDSG.
You have the right to restrict the processing of your personal data in accordance with Art. 18 GDPR.
In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and to transmit those data to another controller.
If you have given us separate consent to process your data, you can withdraw this consent at any time in accordance with Art. 7 (3) GDPR. Such a revocation does not affect the legality of the processing that was carried out on the basis of the consent until the revocation.
If you believe that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.

8. Right of objection

In accordance with Art. 21 (1) GDPR, you have the right to object to processing based on the legal basis of Art. 6 (1) (e) or (f) GDPR on grounds relating to your particular situation. If we process personal data about you for the purpose of direct marketing, you can object to this processing in accordance with Art. 21 (2) and (3) GDPR.

9. Data Protection Officer

You can reach our data protection officer using the following contact details:

Herting Oberbeck Rechtsanwälte Partnerschaft
Hallerstr. 76, 20146 Hamburg
Germany
Email: datenschutzbeauftragter@cimt-ag.de

Part II

Data processing on our website

When you use the website, we collect information that you provide yourself. In addition, certain information about your use of the website is automatically collected by us during your visit to the website. Under data protection law, the IP address is also considered personal data. An IP address is assigned to every device connected to the Internet by the Internet provider so that it can send and receive data.

1. Processing of server log files

When using our website for purely informational purposes, general information that your browser transmits to our server is initially stored automatically (i.e. not via registration). By default, this includes: browser type/version, operating system used, page accessed, the previously visited page (referrer URL), IP address, date and time of the server request and HTTP status code. The processing is carried out to protect our legitimate interests and is based on the legal basis of Art. 6 para. 1 letter f) GDPR. This processing is for technical administration, website security and internal analysis purposes. The stored data will be deleted after seven days unless there is a justified suspicion of unlawful use based on concrete evidence and further examination and processing of the information is necessary for this reason. We are not in a position to identify you as a data subject on the basis of the stored information. Art. 15 to 22 GDPR therefore do not apply in accordance with Art. 11 para. 2 GDPR, unless you provide additional information that enables your identification in order to exercise your rights set out in these articles.

2. Newsletter

a. Registration and deregistration

We offer you the opportunity to subscribe to our newsletter. After registration, we will inform you regularly about the latest news on our offers. A valid e-mail address is required to register for the newsletter. To verify your e-mail address, you will first receive a registration e-mail, which you must confirm via a link (double opt-in). If you subscribe to the newsletter on our website, we process personal data such as your e-mail address and your name on the basis of the consent you have given. The processing is based on the legal basis of Art. 6 para. 1 letter a) GDPR. You can revoke your consent at any time with effect for the future, for example via the “Unsubscribe” link in the newsletter or by contacting us via the channels mentioned above. The legality of the data processing operations that have already taken place remains unaffected by the revocation. When you register for the newsletter, we also store your IP address and the date and time of registration. The processing of this data is necessary in order to be able to prove that consent has been given. The legal basis arises from our legal obligation to document your consent (Art. 6 para. 1 letter c) in conjunction with Art. 7 para. 1 GDPR). Art. 7 para. 1 GDPR).

b. Newsletter analysis

We also analyze the reading behavior and opening rates of our newsletter. We evaluate the data generated when our emails are delivered and retrieved in aggregated and anonymized form (delivery rate, opening rate, click rates, unsubscribe rate, bounce rate, visits, completions) in order to measure the use and success of the emails. The legal basis for the analysis of our newsletter is Art. 6 para. 1 letter f GDPR and the processing serves our legitimate interest in optimizing our newsletter. You can object to this at any time by contacting one of the contact channels listed above.

On the other hand, we also evaluate the data generated when you access and use these e-mails (time of opening, hyperlinks clicked on, documents downloaded) as well as transaction data on downstream websites in connection with your e-mail address in order to provide you with personalized information on this basis in the future, which takes your interests and needs into account in the best possible way. We use the anonymous and personal data collected to provide you with personalized content and individualized information in our advertising emails and downstream websites. The legal basis for data processing in the context of e-mails is Art. 6 para. 1 letter a) GDPR. You can revoke your consent at any time with effect for the future, for example via the “unsubscribe” link in the newsletter or by contacting us via the channels mentioned above.

c. Service provider

We use the Salesforce service of Salesforce, Inc. (USA) to manage subscribers, send the newsletter and analyze it. Your e-mail address is therefore transmitted by us to Salesforce. The processing is carried out on our behalf and is based on the legal basis of Art. 6 letter f GDPR and serves our legitimate interest in the optimization and economic dispatch of our newsletter. If you do not want your data to be processed by Salesforce, you should not subscribe to the newsletter or unsubscribe from it.

We use Salesforce’s Processor Binding Corporate Rules for the Processing of Personal Data as appropriate safeguards for transfers to third countries: https://c1.sfdcstatic.com/content/dam/web/en_us/www/documents/legal/misc/Salesforce-Processor-BCR.pdf

Users can find further information on data protection at Salesforce in Salesforce’s privacy policy: https://www.salesforce.com/company/privacy/

3. Contact forms and workbook requests

a. Contact forms

On our website, we provide forms that you can use to contact us, request a call back or an initial consultation, or request our workbook. In doing so, we process the data you enter (name, company, email address and – if provided – telephone number, area of interest and your message) as well as technical information about the request (page on which the form was submitted, language, time). Mandatory fields are marked as such.

We process this data in order to handle and answer your request, to send you a confirmation of receipt and to get in touch with you. The legal basis is Art. 6 (1) (b) GDPR insofar as your request is aimed at concluding a contract, and otherwise Art. 6 (1) (f) GDPR. Our legitimate interest lies in answering requests and in acquiring and supporting customers.

b. Workbook requests

Companies can request our workbook via our website, which we send to you by email. The workbook is intended exclusively for companies that wish to use the solutions described in it themselves. Before sending it, we therefore check on the basis of the company name provided, the email domain and publicly available information about the company (e.g. company website, search results) whether this requirement is met; in cases of doubt, a manual check is carried out. The legal basis is Art. 6 (1) (b) GDPR (provision of the requested workbook) and Art. 6 (1) (f) GDPR. Our legitimate interest lies in providing the workbook only to the intended target group and in staying in touch with interested parties.

c. Technical processing and service providers

The forms are processed on our web server using the WordPress plugin Contact Form 7. To protect against spam, we use Friendly Captcha (see section 5). The form data is then transmitted via an encrypted interface to the automation platform n8n of n8n GmbH, Novalisstraße 10, 10115 Berlin, Germany, which processes the request further on our behalf.

Your request is stored in our CRM system Salesforce of Salesforce, Inc., 415 Mission Street, San Francisco, CA 94105, USA – for new contacts as a lead, for existing contacts as an activity. The processing is carried out on our behalf on the basis of a data processing agreement. For any transfer to third countries, the safeguards of Salesforce described under section II.2 (newsletter) apply (Processor Binding Corporate Rules).

Emails in connection with your request (internal notification, confirmation of receipt, sending of the workbook) are sent via Microsoft 365 (Exchange Online) of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

d. Storage period and right to object

We store your data for as long as this is necessary to process your request and for any resulting customer relationship, and delete it as soon as it is no longer required for this purpose and no statutory retention obligations prevent deletion. You can object at any time to processing based on our legitimate interests (see section I.8).

4. Webinars

We organize online webinars for our customers and interested parties. Registration requires the processing of personal data (name, e-mail address and, if applicable, employer), which you provide to us via the input mask. The processing of the data provided is carried out for the purpose of providing the service and is based on the legal basis of Art. 6 para. 1 letter b GDPR.

To conduct the webinar, we use Teams, a service provided by Microsoft Ireland Operations Limited. (Ireland, EU). Before entering the webinar room, you will be asked to enter your name. Please note that this name may be seen by other webinar participants. If you do not wish this to happen, you can enter only your initials instead.

By registering for the webinar, you agree to be contacted by our sales team afterwards. We offer you participation in our webinar in return for your contact details and your consent to receive further information about our services. This processing is carried out on the legal basis of Art. 6 para. 1 letter a GDPR. You can withdraw your consent at any time by clicking on the unsubscribe link in the email or by contacting us at the above address.

We use salesforce, a service of Salesforce, Inc. (USA), to manage your data. We use Salesforce’s Processor Binding Corporate Rules for the Processing of Personal Data as appropriate safeguards for transfers to third countries: https://c1.sfdcstatic.com/content/dam/web/en_us/www/documents/legal/misc/Salesforce-Processor-BCR.pdf

The data will be deleted as soon as it is no longer required for the purpose for which it was collected.

5. Friendly Captcha

On our website, we use the Friendly Captcha service of Friendly Captcha GmbH, Am Anger 3–5, 82237 Wörthsee, Germany, to protect our forms against spam and misuse by automated programs and bots.

For this purpose, Friendly Captcha processes technically necessary information, in particular connection data such as the IP address as well as information about the browser and device environment and about the interaction with our website. According to the provider, the IP address is anonymised using a one-way hashing procedure before it is stored. Friendly Captcha does not use HTTP cookies and does not store any data permanently in the browser.

The processing is carried out to safeguard our legitimate interests and is based on Art. 6 (1) (f) GDPR. Our legitimate interest is to protect our website and the forms provided on it against spam, bots and other abusive automated use. Friendly Captcha processes the data on our behalf.

When the global infrastructure of Friendly Captcha is used, requests may also be processed outside the European Union or the European Economic Area, depending on the location of the user. Insofar as personal data is transferred to third countries, this is done in compliance with the requirements of Art. 44 et seq. GDPR.

Further information on data protection at Friendly Captcha can be found in the provider’s privacy policy at https://friendlycaptcha.com/legal/privacy/.

6. Cookies

We use cookies and similar technologies on our website. Cookies are small text files that are stored by your browser when you visit a website. This identifies the browser used and can be recognized by our web server. We use so-called “session cookies”, which are deleted when the browser session ends. Other cookies (“persistent cookies”) are automatically deleted after a specified period, which may vary depending on the cookie.

The use of cookies is in part technically necessary for the operation of our website. We also use cookies and similar technologies to measure analytics about the reach of our website and to analyze the use of our website. We also use cookies and similar technologies to track user behavior across websites and devices.

Cookies are stored on the user’s computer. As a user, you therefore have full control over the use of cookies. You can delete cookies in the security settings of your browser at any time. You can object to the use of cookies through your browser settings in principle or for specific cases. The Federal Office for Information Security provides further information on this at https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Cyber-Sicherheitsempfehlungen/Updates-Browser-Open-Source-Software/Der-Browser/JavaScript-Cookies-Fingerprints/javascript-cookies-fingerprints_node.html

Information on how cookies and similar technologies are used by us can be found below under the description of the specific processing activity. Further information on the cookies used on our website can also be found on our consent banner.

You can also change your cookie settings here:

7. Consent management via Borlabs

This website uses Borlabs. The Borlabs consent banner enables users of our website to give their consent to certain data processing operations or to withdraw their consent. Borlabs also supports us in being able to provide proof of the declaration of consent. For this purpose, Borlabs processes information on the declaration of consent and further log data on this declaration. Cookies are also used to collect this data.

The processing of this data is necessary in order to be able to prove that consent has been given. The legal basis arises from our legal obligation to document your consent (Art. 6 para. 1 letter c) in conjunction with Art. 7 para. 1 GDPR). Art. 7 para. 1 GDPR).

8. Google Analytics

We use the Google Analytics service provided by Google Ireland Limited (Ireland, EU) on our website.

Google Analytics is a web analytics service that allows us to collect and analyze data about user behavior on our website. Google Analytics enables us to measure interaction data from different devices and from different sessions. This allows us to put individual user actions into context and analyze long-term relationships.

Google Analytics uses cookies for this purpose, which enable us to analyze the use of our website. In addition, personal data in the form of IP addresses, device identifiers and information about interaction with our website is processed. Some of this data is information that is stored on the device you are using. In addition, further information is stored on your device via the cookies used.

Google will process the data collected in this way on our behalf in order to evaluate the use of our website by users, to compile reports on the activities within our website and to provide us with further services associated with the use of our website and the use of the Internet.

The setting of cookies and the further processing of personal data described here takes place with your consent. The legal basis for data processing in connection with the service is Article 6(1)(a) GDPR. You can revoke this consent at any time via our consent management tool with effect for the future.

We only use Google Analytics with activated IP anonymization. This means that the IP address transmitted by the user’s browser is shortened by Google. The transmitted IP address is not merged with other data. The IP address is truncated on servers in the EU.

The data on user actions is stored for a period of 2 months and then automatically deleted. Data whose storage period has expired is automatically deleted once a month.

Further information on how data from websites or apps in the Google network is used for advertising purposes can be found in Google’s information at: www.google.com/policies/technologies/ads/.

9. Cloudflare

We use the Cloudflare service from Cloudflare Inc (USA) on our website to display content. For such integration, it is technically necessary to process your IP address so that the content can be sent to your browser.

Your data is processed on the basis of Art. 6 para. 1 letter f GDPR and is based on our legitimate interest in the optimization and economic operation of our website.

When using the service, a transfer of your data to the USA cannot be ruled out. Please note the information in the section “Data transfer to third countries”. Further information on data protection at Cloudflare can be found in Cloudflare’s privacy policy at https://www.cloudflare.com/privacypolicy/.

10. Integrated third-party services and content

We use services and content provided by third-party providers on our website (hereinafter collectively referred to as “content”). We use a two-click solution for integration. When using the two-click solution, no connection to the third-party provider is initially established, but a placeholder is first loaded from our own server. This can be a preview image for the integrated maps or videos. Contact with the “third-party server” is only established after a further click on the respective placeholder. The IP address is therefore only transmitted when you confirm this by clicking on it.

The data processing takes place with your consent and is based on Art. 6 para. 1 letter a) GDPR.

We have integrated content from the following services provided by third parties into our website:

“YouTube” of YouTube LLC (USA) for displaying videos.

When using Google services, we cannot rule out the transmission of the processed data to Google LLC (USA), which is based in the USA. Please note the information in the section “Data transfer to third countries”.

11. Salesforce Marketing Automation

We use the marketing automation system of Salesforce (“Salesforce MAS”) from Salesforce, Inc. (USA) on our website. Salesforce MAS is a special software for recording and analyzing the use of a website by website visitors. When you visit our website, Salesforce MAS records your click path and uses this to create an individual user profile using a pseudonym. Insofar as Salesforce MAS processes personal data, the processing is carried out exclusively on our behalf and in accordance with our instructions.

Your data is processed on the basis of your consent in accordance with Art. 6 (1) (a) GDPR.

Cookies are set on your end device to integrate the service. The setting of cookies and access to information stored on the device you are using takes place with your consent in accordance with Section 25 (1) TDDDG, which you can revoke at any time with effect for the future via our Consent Management Tool. When using the service, a transfer of your data to the USA cannot be ruled out. We use Salesforce’s Processor Binding Corporate Rules for the Processing of Personal Data as suitable guarantees for the transfer to third countries: https://c1.sfdcstatic.com/content/dam/web/en_us/www/documents/legal/misc/Salesforce-Processor-BCR.pdf. Further information on data protection at Salesforce can be found in Salesforce’s privacy policy at https://www.salesforce.com/company/privacy/

12. Hotjar (web analysis & user feedback)

Our website uses Hotjar, a web analysis tool from Hotjar Ltd., to better understand user behaviour and optimise our website accordingly. Hotjar enables us to evaluate clicks, mouse movements, scrolling behaviour and interactions on our website, for example.

The following information is collected:

IP address of the end device (in anonymised form),
screen size,
device type,
browser information,
geographical location (country),
preferred language.

Data processing is carried out exclusively on the basis of your consent in accordance with Art. 6 (1) (a) GDPR, which you can give via our cookie banner. You can revoke your consent at any time via the cookie settings. Further information on data processing by Hotjar can be found at: https://www.hotjar.com/legal/policies/privacy/

13. Google Ads

On our website, we use the Google Ads service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to draw attention to our offers with advertisements. With conversion tracking, we record whether visitors who have reached our website via one of our ads subsequently submit a form. The measurement is carried out via the Google tag and Google Analytics (see section 8), whose events we transfer to Google Ads. In addition, we use audiences created in Google Analytics to show ads again to visitors to our website on other Google services such as YouTube, Gmail or Google Discover (remarketing). We only receive statistical evaluations and cannot identify you personally.

The processing is based on your consent pursuant to Art. 6 (1) (a) GDPR. Cookies are set and information on your device is accessed with your consent pursuant to Section 25 (1) TDDDG, which you give via our consent management tool and can withdraw there at any time with effect for the future. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. Further information can be found in Google’s privacy policy at https://policies.google.com/privacy.

Part III

Visiting one of our social media pages

We have a company page on several social media platforms. In this way, we would like to offer further opportunities for information about our company and for exchange. Our company has company pages on the following social media platforms:

Facebook of Meta Platforms Ireland Limited, (Ireland, EU), hereinafter referred to as “Meta”;
Instagram of Meta Platforms Ireland Limited, (Ireland, EU), hereinafter referred to as “Meta”;
LinkedIn of LinkedIn Ireland Unlimited Company, (Ireland, EU), hereinafter referred to as “LinkedIn”;
XING of NEW WORK SE, (Germany, EU), hereinafter referred to as “XING”;

When you visit or interact with a profile on a social media platform, personal data about you may be processed. The information associated with a social media profile used also regularly constitutes personal data. This also includes messages and statements made using the profile. In addition, certain information is often automatically collected during your visit to a social media profile, which may also constitute personal data.

1. Visiting a social media page

When you visit our social media page, which we use to present our company or individual products from our range, certain information about you is processed. The operators of the social media platforms are solely responsible for this processing of personal data. Further information on the processing of personal data can be found in their privacy policies, which we link to below:

Meta (https://www.facebook.com/privacy/explanation). Meta offers the option of objecting to certain data processing; information and opt-out options in this regard can be found at https://www.facebook.com/settings?tab=ads;
LinkedIn (https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy);
XING (https://privacy.xing.com/de/datenschutzerklaerung/druckversion)

Some social media platform operators collect and process event data and profile data and provide us with statistics and insights for our pages in anonymized form, which help us gain insights into the types of actions people take on our site (so-called “page insights”). These Page Insights are created on the basis of certain information about people who have visited our site. This processing of personal data is carried out by the social media operators and us as joint controllers. The processing serves our legitimate interest in evaluating the types of actions taken on our site and improving our site based on these findings. The legal basis for this processing is Article 6(1)(f) GDPR.

We cannot assign the information obtained via Page Insights to individual user profiles that interact with our pages. We have entered into agreements with the operators of the social media platforms on processing as joint controllers, in which the distribution of data protection obligations between us and the operators is defined. Details on the processing of personal data for the creation of Page Insights and the agreement concluded between us and the operators can be found at the following links:

You also have the option of asserting your rights against the operators. You can find further information on this under the following links:

We have agreed with Meta and LinkedIn that the Irish Data Protection Commission is the lead supervisory authority overseeing processing for Page Insights. You always have the right to lodge a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or any other supervisory authority.

2. Communication via social media sites

We also process information that you have provided to us via our company page on the respective social media platform. Such information may include the username used, contact details or a message to us. This processing is carried out by us as the sole controller. We process this data on the basis of our legitimate interest in contacting people who make inquiries. The legal basis for data processing is Article 6(1)(f) GDPR. Further data processing may take place if you have given your consent (Art. 6 para. 1 letter a GDPR) or if this is necessary to fulfill a legal obligation (Art. 6 para. 1 letter c GDPR).

Part IV

Further data processing

1. Contact by e-mail

If you send us a message via the contact e-mail provided, we will process the data transmitted for the purpose of responding to your request.

We process this data on the basis of our legitimate interest in getting in touch with enquiring persons. The legal basis for data processing is Art. 6 (1) (f) GDPR.

2. Contractual relationship

In order to establish or execute the contractual relationship with our customers, suppliers and business partners, it is regularly necessary to process the personal data provided to us, such as the name and contact details of the respective contact persons. The legal basis for this processing is Art. 6 (1) (f) GDPR and we base this processing on our legitimate interest. Further data processing may take place if you have given your consent (Art. 6 (1) (a) GDPR) or if this serves to fulfill a legal obligation (Art. 6 (1) (c) GDPR).

3. Applications

If you apply via the application form on our website, we process the data you provide. This includes in particular your name, contact details, date of birth, the desired position and your application documents. We use this data exclusively to carry out the application process. The legal basis is Art. 6 (1) (b) GDPR in conjunction with Section 26 BDSG.

Protection against spam. To protect the form against automated entries, we use Friendly Captcha (see section II.5).

Storage and processing. Your application is automatically stored in a protected area of our HR department in Microsoft 365 (SharePoint, Planner, Teams). We control the transfer via the automation platform n8n (cloud service of n8n GmbH, Berlin, as processor; transfers to third countries only on the basis of the EU Standard Contractual Clauses). Only the persons responsible for the application process have access.

Evaluation of documents with AI. For pre-sorting, we extract information from your CV, such as the language of the documents, using a language model operated internally by us. The data does not leave our systems. No automated decision within the meaning of Art. 22 GDPR takes place; decisions on your application are made exclusively by people.

Screening against sanctions lists. To comply with the EU sanctions regulations, we compare your name and date of birth with the sanctions lists of the European Union in order to avoid employing sanctioned persons and to protect ourselves against resulting liability risks. The legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR in complying with the EU sanctions regulations.

Storage period. If no employment relationship is established, we delete your application documents six months after your rejection. This period serves to defend against any legal claims. In addition, we store your name and the date of your application for up to twelve months after receipt of the application in order to be able to defend ourselves against placement claims by recruitment agencies if a person introduced to us by an agency is later hired by us directly. This storage is based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR in the traceability of past applications for the purposes mentioned.

Talent pool. If you have given your consent in the form, we will include you in our talent pool for up to 24 months and may contact you about suitable positions. The legal basis is Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future, for example by email to karriere@cimt-ag.de.