Datenschutz Pflichtverordnung

III. Privacy policy regarding processing on our website

Here you will find information about data processing on our website.

‍

IIII.1. Website in general

‍Purpose of processing
Presentation of the company, provision of services, and/or sale of products, as well as communication via the Internet. The purpose of data processing on this website is to provide information about the products and services of our company/association and, if necessary, to process applications, with the option for users to contact specific contact persons within the company.

‍

General
If you have provided us with personal data, we will use it to respond to your inquiries, to advise you and process contracts concluded with you, and for technical administration. Your personal data will only be passed on or transferred to third parties if this is necessary for the purpose of contract processing, if it is necessary for billing purposes, or if you have given your prior consent. You have the right to revoke your consent at any time with effect for the future; see "Right of revocation" for more information.

‍

The legal basis for the collection, processing, and disclosure of data within the scope of contract execution is Art. 6 para. 1 lit. b GDPR.

This data will be deleted after the applicable statutory retention periods have expired. If we are not subject to any statutory retention obligations, the data will be deleted once the purpose for which it was collected no longer applies.

You have the right to access and object to the data we have stored about you at any time. For more information, see "Rights of data subjects" and "Right of revocation."

‍

III.2. Server data collection

Purpose of processing
When you visit our website, various data (server statistics) is automatically stored that your browser transmits to our provider's server: Among other things, the IP address of your device, the date and time of access, the name and URL of the files accessed, the website from which you accessed our site or from which you were redirected to our site (referrer URL), the browser used and, if applicable, the operating system of your device and the name of your provider are logged.

We process the aforementioned data for the purposes of establishing a smooth connection and ensuring system security. This data is not merged with other data sources. The IP address is anonymized. The connection data is automatically deleted, usually after a maximum of thirty days. If the website is misused, log data that needs to be retained for evidence purposes will be stored until the incident has been clarified.

‍

The legal basis is Art. 6 (1) (f) GDPR and § 25 (2) TDDDG (however, in this case only data such as browser or header information that is inevitably transmitted when our website is accessed or due to the (browser) settings of the end device). This is not to be considered "access to information already stored on the end device." Our legitimate interest pursuant to Art. 6 (1) (f) GDPR arises from our desire to ensure the secure operation of the website and to detect any attacks.

III.3. Contact form and email inquiries

Purpose of processing
When you use a contact form on our website, we collect and store your name and email address for the purpose of responding to your inquiry. Providing your phone number for a callback is optional. If you send us a contact request by email, we collect and store your email address and the data contained in the email.

‍

The legal basis is Art. 6 (1) (a) GDPR, as you consent to the above-mentioned processing of your data when using the form or sending an email. In addition, the legal basis also arises from Art. 6 (1) (b) GDPR, as the storage of the data is necessary for the fulfillment of a pre-contractual or possibly later contractual relationship.

The data will be deleted once the purpose for storing it no longer applies, i.e., after your email/contact form inquiry has been answered or once the matter associated with the inquiry has been conclusively clarified.

You have the right to withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent.

You can find information on your right to erasure and access under "Rights of data subjects."

‍

III.4. Newsletter

Purpose of processing
If you would like to receive the newsletter offered on the website, we need your name for personal contact and an email address. Registration for the newsletter is done using a double opt-in procedure. This means that after registering, you will receive an email asking you to confirm your registration. This procedure prevents unauthorized persons from registering with your email address. Your registration for the newsletter is logged (storage of the registration and confirmation time and the IP address). With the help of the logging, the registration process can be verified in accordance with legal requirements.

We use Mailchimp, an email marketing service provided by The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Ste 5000, Atlanta, GA 30308, USA, to send our newsletter. Your email address and any other data you provide, such as your first and last name, will be transmitted to Mailchimp for the purpose of sending the newsletter. Mailchimp stores and processes this data on its servers in the USA. Mailchimp complies with the requirements of the EU-U.S. Privacy Shield Agreement to ensure an adequate level of data protection.

You can revoke your consent to the storage of your email address and first and last name for the purpose of personal communication and their use for sending the newsletter with associated performance measurement at any time. A link to unsubscribe is provided at the end of each newsletter. In order to be able to prove that consent was previously given for an email address that has been unsubscribed, we may store it for up to 2 years before deleting it.

‍

Legal basis for sending newsletters and the associated performance measurement:
This is based on the consent of the recipients in accordance with Art. 6 (1) (a) GDPR, Art. 7 GDPR in conjunction with § 7 (2) No. 3 UWG (German Unfair Competition Act) or on the basis of the legal permission in accordance with § 7 (3) UWG.

As well as Art. 6 (1) (f): Our legitimate interest in measuring success arises from identifying the reading habits of our users based on the opening of newsletters, opening times, and the links clicked on, in order to be able to create and send them interest-based and useful content.

‍

The legal basis for logging is Art. 6 (1) (f) GDPR. Our legitimate interest arises from the fact that we use a secure and user-friendly newsletter system that is useful for sending newsletters and protects the personal data of newsletter subscribers. It also allows us to verify consent.

You are entitled to request information about the data we have stored about you and, if the data is incorrect, to request that it be corrected or, if the data storage is inadmissible, to request that it be deleted. You also have the right to lodge a complaint with a supervisory authority (see section on right to lodge a complaint).

‍

III.5. Cookies

Purpose of processing
Our website uses standard cookies that are stored in your internet browser (e.g., Firefox, Google Chrome, Microsoft Edge, Safari) or on your computer (i.e., your operating system) when you visit our site. With the help of cookies, which contain a specific string of characters and, if applicable, additional information, our website recognizes your internet browser when you visit it.

When you visit our website, we store your selection in the cookie banner (consent and preference settings) so that your decision is taken into account on future visits. For this purpose, a technical storage object (cookie or local storage) is stored on your device, in which, among other things, the consent status, a timestamp, and, if applicable, a pseudonymous identifier are stored. If necessary, consent can also be documented pseudonymously on the server side in order to be able to prove that you have given or revoked your consent.

The storage is carried out to fulfill our legal obligations and to manage your preferences (legal basis: Art. 6 (1) (c) GDPR in conjunction with § 25 (2) TTDSG or Art. 6 (1) (f) GDPR; for setting/changing cookies based on your consent: Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TTDSG).

You can change or revoke your settings at any time using the cookie button at the bottom left of the browser window.

‍

The storage period is 12 months, unless you delete the data beforehand. Please note that this may affect the functionality of our website. If you object to the use of cookies, an opt-out cookie will be set to store your preference.

‍

III.6. Additional tools, plugins, and scripts

III.6.1. Webflow/Cloudflare
We host our website with the provider Webflow Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter "Webflow"). Webflow provides the infrastructure for the display and administration of our website. Through the Webflow infrastructure, our website data is also delivered via the network of Cloudflare Inc., 101 Townsend Street, San Francisco, CA 94107, USA (hereinafter "Cloudflare"). Cloudflare serves as a reverse proxy and optimizes loading times and security (e.g., defense against DDoS attacks). Webflow and Cloudflare set technically necessary cookies to ensure the security of the connection and stability of the website. These cookies do not store any personal identification information and are used exclusively for the functionality of the security features. The cookies are only valid for the duration of your browser session and are deleted when you leave our site.

‍

The legal basis is your consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. In addition, our legitimate interest in accordance with Art. 6 (1) (f) GDPR and § 25 (1) TDDDG is to enable you to use our website in a user-friendly, efficient, and secure manner.

You can disable the acceptance of these cookies at any time in the cookie manager on our website. Please note that this may affect the functionality of our website. If you object to the use of cookies, an opt-out cookie will be set to store your preference.

‍

III.6.2. Amazon Cloudfront
We use Amazon CloudFront, a service provided by Amazon Web Services (AWS), to quickly deliver global content (e.g., images). The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. CloudFront provides copies of our website content on servers distributed worldwide to minimize loading times for you. If data is transferred to the US, we base this on the EU-US Data Privacy Framework.

‍

Legal basis: The use of Amazon Cloudfront is based on Art. 6 (1) lit. f GDPR and § 25 (1) TDDG. Our legitimate interest lies in enabling you to use our website in a user-friendly and efficient manner.

‍

III.6.3. Weglot
Purpose of processing
We use the Weglot translation service provided by Weglot SAS, 138 rue du Faubourg Saint-Martin, 75010 Paris, France (hereinafter "Weglot") on our website. Weglot enables us to automatically provide our content in different languages. When you access a translated version of our website, your browser establishes a connection to Weglot's servers. Technical data (e.g., IP address and the URL accessed) is transmitted in order to deliver the appropriate translation content. Weglot uses technical cookies to provide translation functions. These are used exclusively to store the language you have selected during your visit and to ensure that the content is displayed correctly.

‍

Legal basis: The use of Weglot is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the accessibility and international orientation of our website.

‍

III.6.4. Vimeo
Purpose of processing
To showcase our services, we use audiovisual media that we publish with the provider Vimeo Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA (hereinafter "Vimeo") and embed on our website. Cookies are set when Vimeo content is embedded on our site. They enable the proper playback of embedded Vimeo videos and help to store the user's preferences when playing videos.

‍
Legal basis: Use is based exclusively on your consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

‍

III.6.5. Youtube
Purpose of processing
To present our services, we use audiovisual media that we publish on YouTube, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter "YouTube"). Cookies are set when YouTube content is embedded on our site. They enable the proper playback of embedded YouTube videos and help to store the user's preferences when playing videos.

Legal basis: Use is based exclusively on your consent in accordance with Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG.

III.6.6. Spotify
Purpose of processing
To showcase our services and for advertising purposes, we use audio material that we publish with the provider Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden (hereinafter "Spotify") and embed on our website. Cookies are set when Spotify content is embedded on our site. They enable the proper playback of embedded Spotify media and help to store the user's preferences when playing audio.

‍

Legal basis: Use is based exclusively on your consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

‍

III.6.7. Google Analytics
Purpose of processing
For the purpose of designing our websites in line with user needs and continuously optimizing them, we use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics enables us to analyze user behavior on our website (e.g., page views, length of stay, click paths). Cookies and similar technologies (such as local storage) are used for the analysis to recognize your device. The data helps us to optimize the website. In Google Analytics (GA4), the anonymization of IP addresses is enabled by default. Your IP address is truncated by Google within member states of the EU or in other signatory states to the Agreement on the European Economic Area before it is transferred to the USA. Google is certified under the EU-U.S. Data Privacy Framework. Nevertheless, it cannot be ruled out that data may be transferred to the parent company Google LLC in the USA.

‍

Legal basis: Use is based exclusively on your consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

Note on the processing of your data collected on this website in the USA by Vimeo, Cloudflare, Amazon, and Google: The European Court of Justice considers the USA to be a country with an inadequate level of data protection according to EU standards. In particular, there is a risk that your data may be processed by US authorities for control and surveillance purposes, possibly without any legal recourse.

‍

IV. Data protection information regarding the processing of data belonging to our customers and business partners

‍

IV. 1. Customer data/prospective customers

Purpose of processing
We process data that we receive in the course of our business relationship with you. We receive this data directly from you, either in the form of inquiries from interested parties and contact requests, order placements, or order processing (see "Information on data collection and processing").

‍

Legal basis: Data collection and processing is necessary for the performance of the contract and is based on Art. 6 (1) (b) GDPR. Use for direct marketing is based on Art. 6 (1) (f) GDPR. It is in our legitimate interest to draw your attention to special offers by means of direct marketing. The data will not be passed on to third parties unless required by law, e.g. to the tax office within the framework of tax laws. The data will be deleted as soon as it is no longer required for the purpose of its processing or after the expiry of the statutory retention periods (e.g., accounting documents relevant for tax and commercial law: 10 years; commercial and business letters: 6 years; records of suppliers, type, quantity, purchase, delivery: 3 years).

You have the right to object to the use of your data for direct marketing purposes at any time. In addition, you are entitled to request information about the data we have stored about you and, if the data is incorrect, to request its correction or, if the data storage is inadmissible, to request its deletion. You also have the right to lodge a complaint with a supervisory authority (see section on right to lodge a complaint).

‍

Duration of data storage

After the contractually agreed service has been provided, your personal data will be stored for 3 years for the purpose of the statutory warranty, for 6 years for the purpose of executing follow-up orders (requested at the time of conclusion of the contract or at a later date), and for 10 years for tax purposes.

‍

Deletion of data
Your personal data will be deleted at the latest after the aforementioned periods have expired, unless there are legal retention obligations or legitimate interests on our part that justify longer storage.

‍

IV. 2. Suppliers

Purpose of processing

We process data that we receive in the course of our business relationship with you. We receive this data directly from you when you place an order or during order processing (see "Information on data collection and processing").

Legal basis:
Data collection and processing is necessary for the performance of the contract and is based on Art. 6 (1) (b) GDPR. The data will not be passed on to third parties unless required by law, e.g. to the tax office within the framework of tax laws. The data will be deleted as soon as it is no longer required for the purpose of its processing or after the expiry of the statutory retention periods (e.g., accounting documents relevant for tax and commercial law: 10 years; commercial and business letters: 6 years; records of suppliers, type, quantity, purchase, delivery: 3 years).

‍

IV. 3. Applications

Purpose of processing
Applications online, by email, or by post: If you apply to us in response to a job advertisement, we will collect your personal data such as your first name, last name, address, telephone number, email address, attachments (cover letter, resume, references, photo) and store it for the duration of the selection process.

Your data will only be used by authorized persons in the Human Resources department or management for processing as part of the selection process. Your personal data will not be passed on to third parties.

If the specific position you are applying for has already been filled, but your profile makes you a suitable candidate for future employment, we will obtain your express consent before storing or forwarding your application, unless you have already consented to such storage or forwarding in your application.

If you send us an unsolicited application using our general contact email address, the content of your application email may be viewed by unauthorized personnel. There is a requirement that application documents be forwarded to the HR department immediately without being opened. If you would like to avoid this, please contact us by telephone before submitting your unsolicited application so that we can provide you with the contact details of the appropriate contact person.

‍

The legal basis is Article 6(1)(b) GDPR, for the processing of pre-contractual measures.

Unless you inform us otherwise, the data will be deleted six months after completion of the application process or, in the case of postal applications, destroyed. Due to the long application and selection periods for trainees, we store their data in Germany for up to 18 months. If you have given us your consent to store your application data for a longer period of time for future job offers, we will retain your data in accordance with your consent.

Provided that the relevant legal requirements are met, you have the following rights: the right to information about your data stored by us; correction, deletion, restriction of the processing of your data or objection to the processing, as well as data portability. Furthermore, you can of course request the deletion or destruction of all your application documents at any time by sending us an email to: datenschutz@whydobirds.de.

‍

IIV. 4. Events and workshops (on-site, in-house, and virtual)

Purpose of processing

Registration for events and workshops can be done using a registration form. When you use our registration form, we collect and store your first and last name, company name, and email address, depending on the form. If you register by email, we collect and store your email address and the data contained in the email.

We use this personal data exclusively for event and workshop purposes. This enables us to confirm participation, exchange information in advance, answer questions, create name tags and participant lists if necessary, and send out documentation afterwards.

When using video conferencing systems in the context of online workshops or video calls, we use service providers (Microsoft Teams, Zoom, or Webex) within the scope of commissioned data processing.

To join an online workshop or video call, you may be required to provide a name. You can also use a pseudonym. Your details will be stored by the service provider.

If you enable access to your microphone or video camera, audio and video data will be processed and played back. You can disable access at any time using the buttons with the corresponding icons. You can still participate even if you disable access. It is also possible to exchange text messages in a group chat. These messages may be visible to all participants.

If you select the "Share screen" function, the content displayed on your screen will be shown to all other participants. Before using this function, you should therefore ensure that no sensitive data is displayed on your screen. You can deactivate the function at any time by clicking the corresponding button.

If the online workshop or video call is recorded, you will see a red icon on the screen and will be informed in advance. In this case, we will store video and audio data.

Please note: When you visit the websites of the respective service provider or install the provider's application on your device, the processing of personal data is governed exclusively by the service provider's privacy policy.

‍

The legal basis for processing is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the effective implementation of online workshops and video calls. Within the framework of an existing or impending contractual relationship, Art. 6 (1) (b) GDPR also serves as the legal basis for processing. Recording will only take place if we have informed you of this in advance and you have consented to the recording. In this case, the legal basis is Art. 6 (1) (a) GDPR.

The data will be deleted after the applicable statutory retention periods have expired. If this does not apply, the data will be deleted when the purpose for which it was stored no longer applies.

You can find information on your right to erasure and access under "Rights of data subjects."

‍

V. Data protection information regarding our presence on social networks and platforms

‍

why do birds GmbH maintains corporate accounts on Facebook, Instagram, LinkedIn, Vimeo, YouTube, and Spotify. As this is sometimes discussed differently in the area of data protection, we would like to inform you accordingly here.

We operate these presences on the basis of our legitimate interest in communicating with users active there and offering information on the networks/platforms.

‍

Legitimate interests (Art. 6 para. 1 (f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

Since this always involves data processing by the network providers (usually for market research and advertising purposes) and this processing sometimes takes place outside the European Union, our websites are only aimed at users who are active there and who have consciously agreed to the terms of use of the respective providers.

In doing so, US providers undertake to offer guarantees of a level of data protection comparable to EU data protection standards.

‍

When weighing up and implementing this, we take particular account of the following:
No exclusive information on social networks and platforms, but purely information about posts and events on our own website.

No promotion or advertising of our presence outside of the respective networks/platforms—i.e., no explicit solicitation of users who have not agreed to the terms of use.

Regular evaluation of social media/platform presence and risk assessments.

The relevant information on data protection and the privacy policies can be found below:

‍

Facebook
Meta Platforms, Inc., 1 Meta Way, Menlo Park, California, 94025, United StatesPrivacy Policy: https://www.facebook.com/privacy/policy/

Instagram
‍Instagram, LLC, 1601 Willow Rd Menlo Park California 94025, Parent company: Meta Platforms, Inc., 1 Meta Way, Menlo Park, California, 94025, United StatesPrivacy policy: https://help.instagram.com/155833707900388

LinkedIn
LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, IrelandPrivacy policy: https://www.linkedin.com/legal/privacy-policyOpt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Vimeo
Vimeo Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USAPrivacy policy: https://vimeo.com/legal/privacy/policy

Youtube
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USAPrivacy policy: https://www.youtube.com/howyoutubeworks/privacy/

Spotify
‍Spotify AB, Regeringsgatan 19, 11153 Stockholm, Sweden
Privacy policy: https://www.spotify.com/de/legal/privacy-policy/

I. Responsible body

Publisher of the website and responsible for data processing
‍

II. Rights of data subjects

Your rights as a data subject

‍

III. Privacy policy regarding processing on our website

Here you will find information about data processing on our website.

‍

IIII.1. Website in general

III.6. Additional tools, plugins, and scripts

IV. Data protection information regarding the processing of data belonging to our customers and business partners

V. Data protection information regarding our presence on social networks and platforms

I. Responsible body

Publisher of the website and responsible for data processing‍

II. Rights of data subjects

Your rights as a data subject

‍

III. Privacy policy regarding processing on our website

Here you will find information about data processing on our website.

‍

IIII.1. Website in general

III.6. Additional tools, plugins, and scripts

IV. Data protection information regarding the processing of data belonging to our customers and business partners

V. Data protection information regarding our presence on social networks and platforms

Publisher of the website and responsible for data processing
‍