Privacy Policy
according to the GDPR

Privacy Notice pursuant to Art. 13 GDPR

1. Controller

Gesellschaft für Mittelstandskybernetik mbH
Groß-Berliner Damm 99
12487 Berlin
Germany
Phone: +49 030 814 549 00
Email: leitart@leitart.de

2. Data Protection Officer

LOROP GmbH
Jörg Hoffmann
Landgrafenstraße 16
10787 Berlin
Phone: +49 30 330962627
Email: datenschutz@lorop.de

3. Description of individual processing activities

3.1 Technical provision of the website and server log files

When you access our website, technically necessary data is processed so that the website can be displayed in your browser and to ensure the stability, security, and functionality of our web offering.

In particular, the following data may be processed:
●    IP address of the requesting device,
●    date and time of access,
●    page or file accessed,
●    amount of data transferred,
●    referrer URL,
●    browser type and version,
●    operating system,
●    device information,
●    technical communication data.

Purpose of processing
Technical provision of the website, establishing a connection, system security, error analysis, detection of misuse and attacks.

Legal basis
Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and functional provision of our website.

Recipients
Hosting and website service providers, in particular Wix.com Ltd. or affiliated companies and technical service providers/CDN providers used.
Transfer to third countries

Processing of personal data outside the European Union or the European Economic Area cannot be ruled out. Wix.com Ltd. is based in Israel. An adequacy decision by the European Commission exists for Israel. Insofar as processing takes place in other third countries, in particular the USA, the transfer may be based on an adequacy decision for companies certified under the EU-U.S. Data Privacy Framework or on appropriate safeguards, in particular standard contractual clauses. Wix.com Inc. is certified under the EU-U.S. Data Privacy Framework.

Storage period
Server log files are stored only for as long as necessary for the purposes stated.

3.2 Use of a cookie banner / consent management

Our website may use a cookie banner or consent management tool to obtain, document, and manage consent for cookies and comparable technologies that are not strictly necessary.
In particular, the following data may be processed:
●    consent status,
●    selected cookie/service categories,
●    time of consent or refusal,
●    technical browser and device information,
●    shortened or full IP address, where technically necessary,
●    consent ID or comparable proof-of-consent identifier.

Purpose of processing
Obtaining, managing, and documenting consent, as well as proof of a selection decision compliant with data protection law and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Legal basis
Art. 6(1)(c) GDPR, insofar as the processing serves to fulfil legal documentation obligations. In addition, Art. 6(1)(f) GDPR, insofar as our legitimate interest in legally compliant and user-friendly consent management is affected. Section 25(2) of the TDDDG applies to the storing of or access to technically necessary information on the end device.

Recipients
Hosting and website service providers, in particular Wix.com Ltd. or affiliated companies and technical service providers/CDN providers used.
Transfer to third countries
A transfer to third countries, in particular the USA, cannot be ruled out. Wix.com Inc. is certified under the EU-U.S. Data Privacy Framework.

Storage period
Consent data is stored for as long as necessary to prove consent or refusal. You may also revoke your consent at any time with future effect by revisiting the "Cookie Settings."

3.3 Cookies and comparable technologies

Our website uses cookies and comparable technologies. Cookies are small text files stored on your device. Comparable technologies may read information from your device or store information on it.
The following categories in particular may be used:
●    technically necessary cookies,
●    security cookies,
●    session cookies,
●    preference cookies,
●    analytics and statistics cookies,
●    cookies or comparable technologies from third-party providers, in particular Google Analytics, YouTube, or Google Fonts, insofar as these are embedded externally.
Purposes of processing
Processing takes place for the following purposes:
●    technical provision of the website,
●    maintaining sessions,
●    security functions,
●    display and usability of the website,
●    storing settings,
●    analysing use of our website,
●    optimising our web offering.

Legal basis for processing
Technically necessary cookies and comparable technologies are used on the basis of Section 25(2) of the TDDDG. The subsequent processing of personal data takes place on the basis of Art. 6(1)(f) GDPR.

Cookies that are not technically necessary, in particular analytics, statistics, or marketing cookies, are only used on the basis of your consent pursuant to Section 25(1) of the TDDDG. The subsequent processing of personal data takes place on the basis of Art. 6(1)(a) GDPR.

You may revoke your consent at any time with future effect.
Recipients of your data
Recipients may include:
●    Wix,
●    Google Ireland Limited,
●    Google LLC,
●    other technical service providers,
●    analytics and statistics service providers, insofar as embedded.

Transfers to third countries
When third-party providers are embedded, data may be transferred to third countries, in particular the USA or Israel. Israel has an adequacy decision. For transfers to the USA, certification under the EU-U.S. Data Privacy Framework or EU standard contractual clauses may in particular apply.

Storage duration
The storage period depends on the respective cookie. Session cookies are generally deleted at the end of the session. Persistent cookies remain stored for the specified duration or until you delete them.

3.4 Web analytics / Google Analytics

The website may use functions of Google Analytics to obtain statistical information on the use of the website and to continuously improve it.
In particular, the following data may be processed:
●    pages visited,
●    time spent on the site,
●    click paths and interactions,
●    approximate location data,
●    device type,
●    browser and operating system data,
●    referrer information,
●    date and time of the visit,
●    IP address or technical information derived from it,
●    cookie IDs, user identifiers, or comparable online identifiers, insofar as these are used.

Purpose of processing
Analysis of the use of our website, reach measurement, statistical evaluation of user interactions, improvement of content, structure, and usability, as well as optimisation of our online offerings.

Legal basis
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you may revoke at any time with future effect.

Insofar as cookies or comparable technologies are stored on or read from your device, this takes place on the basis of your consent pursuant to Section 25(1) of the TDDDG.

Recipients
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and, where applicable, Google LLC, USA.

Transfer to third countries
A transfer to the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework.

Storage period
We have limited the retention period for analytics data. We have no complete control over the storage period of data that Google processes for its own purposes beyond this. Further information is provided by Google at the following link:
https://policies.google.com/privacy
You may revoke your consent at any time with future effect via the "Cookie Settings."

3.5 Google Tag Manager

Our website uses Google Tag Manager or Google Tag. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Tag Manager or Google Tag is used for the technical management and delivery of tags on our website. Tags are small code elements used to embed services such as web analytics or marketing services. When you access our website, a connection to Google's servers, in particular www.googletagmanager.com, may be established. In doing so, technical information, in particular the IP address, browser and device information, referrer URL, and time of the page visit, may be transmitted to Google.
According to our configuration, Google Tag Manager itself does not create any independent user profiles. However, other services, in particular Google Analytics, may be triggered via Google Tag Manager. These services are described separately in this privacy notice.

Purposes of processing
Processing takes place for the technical management and control of embedded services, in particular for the integration and triggering of analytics and statistics services on the basis of your consent.

Legal basis for processing
Insofar as Google Tag Manager or Google Tag is used solely for the technical management of services requiring consent, and these services are only triggered after your consent, processing takes place on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the efficient and technically secure management of the services used on the website.
Insofar as services that are not technically necessary, in particular Google Analytics, are triggered via Google Tag Manager, or information is stored on or read from your device, this only takes place on the basis of your consent pursuant to Section 25(1) of the TDDDG and Art. 6(1)(a) GDPR.

Recipients of your data
Recipients of the data may include Google Ireland Limited and, where applicable, Google LLC and other Google companies.

Storage duration
According to our configuration, Google Tag Manager itself does not store personal data for analytics purposes. The storage period of the services embedded via Google Tag Manager depends on the information provided for the respective services, in particular Google Analytics.

Transfers to third countries
A transfer of personal data to the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework. Insofar as further transfers to third countries take place, Google bases these on appropriate safeguards pursuant to Art. 44 et seq. GDPR.

3.6 Google Maps

Google Maps is embedded on the website to display our location.
When the map function is accessed, personal data may be transmitted to Google, in particular:
●    IP address,
●    location data, insofar as enabled by browser settings,
●    device and browser information,
●    date and time of access,
●    referrer URL,
●    usage and interaction data with the map.

Purpose of processing
Display of our location and facilitation of route planning.

Legal basis
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you may revoke at any time with future effect.

Recipients
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and, where applicable, Google LLC, USA.

Transfer to third countries
A transfer to the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework.

Storage period
We have no complete control over the storage period at Google. The storage period is governed by Google's settings and data protection provisions. Further information is provided by Google at the following link:
https://policies.google.com/privacy

3.7 YouTube
Our website contains, in the "DATAPLUS" menu area under "Tutorials," a link to YouTube content. By clicking the link, you leave our website and access the YouTube offering. Only from that point on can personal data, in particular IP address, device and browser information, and usage data, be processed by YouTube or Google. YouTube videos are not directly embedded on our website.

Purpose of processing
The link serves to provide users with supplementary tutorial, informational, and video content relating to our services and products.

Legal basis
The legal basis for providing the link is Art. 6(1)(f) GDPR. Our legitimate interest lies in the user-friendly provision of supplementary information and assistance regarding our offerings.

Recipients
When the link is clicked, the provider of the YouTube service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, may also be involved in further processing.
Transfer to third countries
When using YouTube, processing of personal data outside the European Union or the European Economic Area, in particular in the USA, cannot be ruled out. Insofar as data is transferred to the USA, the transfer may be based on an adequacy decision for companies certified under the EU-U.S. Data Privacy Framework or on appropriate safeguards, in particular standard contractual clauses.

Storage period
We have no influence on the storage period of data processed by YouTube or Google. The data protection notices and settings of Google or YouTube apply. By merely providing the link, we do not store any additional personal data related to YouTube on our website.

3.8 Embedded YouTube videos

Description
Our website, in particular in the "News" section, may contain embedded videos from the provider YouTube. The provider of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you access a page with an embedded YouTube video, personal data may be transmitted to Google. This may include, in particular, the IP address, device and browser information, referrer URL, the subpage accessed, the time of access, and information about interaction with the video.
Where possible, we embed YouTube videos so that personal data is only transmitted to YouTube once you actively load or play the video. If you are simultaneously logged into your Google or YouTube account, Google may associate your use with your account.

Purpose of processing
Embedding YouTube videos serves to illustrate news, informational, tutorial, and technical content, as well as to provide multimedia content in a user-friendly manner.

Legal basis
The legal basis for loading and playing embedded YouTube videos is your consent pursuant to Art. 6(1)(a) GDPR. Insofar as information is stored on or read from your device in the process, this also takes place on the basis of your consent pursuant to Section 25(1) of the TDDDG. You may revoke your consent at any time with future effect.

Recipients
The recipient of the data is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, may also be involved in further processing.

Transfer to third countries
When using YouTube, processing of personal data outside the European Union or the European Economic Area, in particular in the USA, cannot be ruled out. Insofar as data is transferred to the USA, the transfer may be based on an adequacy decision for companies certified under the EU-U.S. Data Privacy Framework or on appropriate safeguards, in particular standard contractual clauses.

Storage period
We have no final influence on the storage period of data processed by YouTube or Google. The data protection information of Google or YouTube is decisive. We store data processed in connection with your consent on our website only for as long as necessary for the documentation and management of your consent.

3.9 Contact via contact form, email, or telephone

The website offers a contact form as well as telephone and electronic means of contact. The contact form contains fields in particular for first name, last name, email address, company, subject, and message.
When you contact us, we process the data you provide, in particular:
●    name,
●    email address,
●    telephone number, if provided,
●    company,
●    subject,
●    content of the message,
●    time of contact,
●    technical metadata of the transmission,
●    other information you voluntarily provide.

Purpose of processing
Handling your inquiry, communicating with you, answering follow-up questions, documenting the contact.

Legal basis
Art. 6(1)(b) GDPR, insofar as your inquiry is directed at the conclusion or performance of a contract.

Art. 6(1)(f) GDPR, insofar as it concerns general inquiries. Our legitimate interest lies in the appropriate handling of incoming inquiries and communication with interested parties, business partners, and other contacts.

Recipients
Internal responsible departments, IT and hosting service providers, email service providers, and, where applicable, affiliated companies or investee companies, insofar as necessary to handle your inquiry.

Transfer to third countries
A targeted transfer of your personal data to a third country is not planned.

Storage period
Inquiries are deleted as soon as they have been finally processed and no statutory retention obligations or legitimate documentation interests preclude this. Business letters and tax-relevant communications may regularly be retained for up to six or ten years in accordance with statutory requirements.

3.10 Applications

If you apply to us, we process the application data you submit. This applies in particular to applications by email, post, or other means of communication.
In particular, the following data may be processed:
●    name, address, and contact details
●    application documents such as cover letter, CV, references, and qualification certificates
●    information on education, work experience, and skills
●    communication data
●    any other information voluntarily provided
●    where applicable, special categories of personal data, insofar as you voluntarily provide these, e.g. information on a severe disability

Purposes of processing
Conducting the application process, assessing your suitability, communicating with you, deciding on the establishment of an employment relationship.

Legal basis
Section 26(1) of the German Federal Data Protection Act (BDSG) in conjunction with Art. 6(1)(b) GDPR, insofar as the processing is necessary for the decision on establishing an employment relationship.
Art. 6(1)(f) GDPR, insofar as the processing is necessary to assert, exercise, or defend legal claims.

Art. 6(1)(a) GDPR, insofar as you grant us explicit consent, e.g. for extended inclusion in an applicant pool.

Recipients
Internal responsible departments, in particular management, HR staff, and involved managers with relevant responsibilities. IT, email, and hosting service providers may also have access as part of technical provision. Disclosure to further recipients only takes place insofar as necessary or legally required.

Transfer to third countries
A targeted transfer of your personal data to a third country is not planned.

Storage period
Unless statutory retention periods provide otherwise, we delete your data as soon as it is no longer required for the purpose of its collection. Data is deleted no later than six months after the selection process has concluded. Your application data will be deleted at your request at any time. If an administrative procedure is initiated on the basis of the submitted data, the longer retention periods applicable to that record-keeping shall apply.

3.11 Newsletter

You can subscribe to our newsletter on our website. For this purpose, we process in particular:
●    email address,
●    name, if applicable,
●    time of registration,
●    confirmation of registration,
●    IP address at registration and confirmation,
●    proof of consent,
●    unsubscribe data, if applicable.

Purposes of processing
Processing takes place for the following purposes:
●    sending the newsletter,
●    informing about products, services, news, and offers,
●    proof of consent,
●    managing registrations and unsubscriptions,
●    prevention of misuse.

Legal basis for processing
The legal basis for sending the newsletter is your consent pursuant to Art. 6(1)(a) GDPR.
Logging the registration takes place on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in being able to prove proper consent.
Insofar as the newsletter is sent to existing customers for our own similar goods or services, processing may be based on Art. 6(1)(f) GDPR under the conditions of Section 7(3) of the German Act Against Unfair Competition (UWG).

Recipients of your data
Recipients may include:
●    internal responsible staff,
●    newsletter service providers, if used,
●    hosting and IT service providers,
●    email dispatch service providers.

Transfers to third countries
Transfers to third countries may occur if a newsletter or email service provider outside the EU or EEA is used. In this case, the transfer only takes place where appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place.

Storage duration
Your newsletter data is stored until you revoke your consent or unsubscribe from the newsletter. After unsubscribing, data may be stored for a reasonable period to prove previously granted consent, generally up to three years from the end of the year in which the unsubscription occurred, unless longer storage is required for legal defence purposes.

3.12 Appointment booking via HubSpot Meetings

The contact page offers the option of booking an introductory appointment via HubSpot Meetings. The link leads to a HubSpot Meetings page.
When using the appointment booking function, in particular the following data may be processed:
●    first name, last name,
●    email address,
●    company,
●    telephone number, if requested,
●    requested appointment,
●    communication content or details of the matter,
●    calendar and booking data,
●    technical access data,
●    where applicable, IP address, browser, and device information.

Purpose of processing
Providing online appointment booking, planning and conducting meetings, communicating with interested parties and business partners.

Legal basis
Art. 6(1)(b) GDPR, insofar as the appointment booking serves to initiate or perform a contract.

Art. 6(1)(f) GDPR, insofar as the appointment booking serves general contact purposes. Our legitimate interest lies in efficient appointment management.
Recipients
HubSpot Germany GmbH or HubSpot Ireland Ltd. and HubSpot, Inc., as well as their sub-processors.

Transfer to third countries
A transfer to the USA cannot be ruled out. HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework.

Storage period
Appointment booking data is deleted as soon as it is no longer required for the handling of the appointment and follow-up communication, unless statutory retention obligations or legitimate documentation interests preclude this.

3.12 Reporting security incidents / disclosure policy

The website contains a disclosure policy and names the email address security@leitart.de for security incidents. If you report a security incident or vulnerability, we process the information you provide, in particular contact details, technical information, a description of the incident, and communication content.

Purpose of processing
Processing takes place to receive, review, handle, and document security reports, to secure our systems, to communicate with reporting persons, and to track and remediate potential vulnerabilities.

Legal basis
The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in ensuring IT security, vulnerability handling, and the secure provision of our services. Insofar as legal obligations are affected, Art. 6(1)(c) GDPR may additionally apply.

Recipients
Recipients are internal responsible departments, in particular IT and security personnel, as well as, where applicable, external IT, security, or legal service providers, insofar as necessary for handling.

Transfer to third countries
A transfer to third countries is generally not intended. However, it cannot be ruled out insofar as the IT or communication service providers used process data outside the EU or EEA.

Storage period
Data is stored for as long as necessary for the review, handling, documentation, and follow-up of the report. Longer storage may take place insofar as necessary for IT security, legal prosecution, legal defence, or the fulfilment of statutory obligations.

3.13 External link to the Qlik demo tenant

The website contains a "Demo Tenant" link that leads to demo-leitart.de.qlikcloud.com. By clicking it, you leave our website and access an external Qlik Cloud environment.

Purpose of processing
The link serves to provide a demo environment and to demonstrate functions and services related to Qlik and Dataplus.

Legal basis
The legal basis for providing the link is Art. 6(1)(f) GDPR. The legitimate interest lies in presenting and demonstrating our services.

Recipients
When the link is clicked, the operators or technical service providers of the target environment are the recipients of personal data.

Transfer to third countries
Whether a transfer to third countries takes place depends on the technical setup of the target environment and the service providers used there.

Storage period
We have no influence on the storage period of the target environment. The data protection notices and technical settings in place there are decisive.

3.14 Links to social media channels

Our website links to the following social media channels:
LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland
LinkedIn's privacy notice: https://www.linkedin.com/legal/privacy-policy

3.15 External link to "moringa studios"

The footer of the website links to "Webdesign moringa studios." By clicking it, you leave our website and access the website of the external web design provider.

Purpose of processing
The link serves to indicate the web design service provider.

Legal basis
The legal basis for providing the link is Art. 6(1)(f) GDPR. The legitimate interest lies in naming the service provider involved in the design of the website.

Recipients
When the link is clicked, the operator of the target page is the recipient of personal data.

Transfer to third countries
Whether a transfer to third countries takes place depends on the technical setup of the target page.

Storage period
We have no influence on the storage period of the target page. The data protection notices in place there are decisive.

4. Rights of data subjects
Subject to the statutory requirements, you have the following rights:
●    right of access
●    right to rectification
●    right to erasure
●    right to restriction of processing
●    right to data portability
●    right to object
●    right to withdraw consent given
To exercise your rights, you may contact us at any time using the contact details given above.

5. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law.

6. No automated decision-making

We do not use your personal data for automated decision-making, including profiling, within the meaning of Art. 22 GDPR.