Data protection

Security and protection of your personal data

We consider it our primary responsibility to maintain the confidentiality of the data you provide and to protect it from unauthorised access. For this reason, we apply the utmost care and necessary security standards to ensure maximum protection of your data. The following privacy policy applies comprehensively to our online presence on social and professional platforms as well as our newsletter.

The processing of your personal data is carried out in accordance with the General Data Protection Regulation (GDPR), the German Telecommunications and Telemedia Data Protection Act (TTDSG), and all applicable regional data protection regulations.

Controller pursuant to Article 4 No. 7 GDPR:

Company: x-group GmbH
Address: Düsseldorfer Str. 76, 10719 Berlin
Telephone: 030 683 2826 00
Fax: 030 683 2826 01
Email: team@x-group.de

Data Protection Officer:
Andreas Zinke
Tel.: 030 683 282 600

Email address: a.zinke@x-group.de

Definitions:

The legislator requires that personal data be processed lawfully, fairly, and in a manner that is transparent to the data subject (‘lawfulness, fairness, transparency’). To ensure this, we inform you about individual legal definitions used in this privacy policy:

1. Personal data

‘Personal data’ means any information relating to an identified or identifiable natural person (hereinafter ‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
You are not obliged to provide data. We attempt to establish contact using the data available.

2. Data subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

3. Third party

A third party is any natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

4. Processing

‘Processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3. Restriction of processing

‘Restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future.

4. Profiling

‘Profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

5. Processor

‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

6. Recipient

‘Recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

7. Consent

‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Origin of personal data

1. Information provided by you, e.g. via the contact form for a free initial consultation or through another form of contact.

2. By using this website, data is automatically collected and generated. This includes:

· IP address

· Date and time of the request

· Time zone difference to Greenwich Mean Time (GMT)

· Content of the request (specific page)

· Access status/HTTP status code

· Amount of data transferred in each case

· Website from which the request originates

· Browser

· Operating system and its interface

· Language and version of the browser software.

3. If we are present on social and professional networks and you contact us via such a platform or respond to content we have shared there, we receive data about you via this channel.

Information on the rights of data subjects

1 Right to confirmation (Art. 15 GDPR)

You have the right to obtain confirmation from the controller as to whether or not personal data concerning you are being processed. You may request confirmation at any time using the contact details provided above.

2 Right of access (Art. 15 GDPR)

You have the right to obtain from us at any time, free of charge, information about the personal data stored about you as well as a copy of this data in accordance with the legal requirements.

3 Right to rectification (Art. 16 GDPR)

You have the right to request the immediate rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data, including by means of a supplementary statement.

4 Right to erasure (Art. 17 GDPR)

You have the right to request that personal data concerning you be erased without undue delay where one of the legally stipulated grounds applies and insofar as the processing or storage is not required.

5 Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of processing from us where one of the legal conditions applies.

6 Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, provided that:

1. the processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) or on a contract pursuant to Art. 6(1)(b) GDPR, and

2. the processing is carried out by automated means.

Furthermore, when exercising your right to data portability pursuant to Art. 20(1) GDPR, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

7 Right to object (Art. 21 GDPR)

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions. The controller will no longer process the personal data unless they can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data will no longer be processed for these purposes.

In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

You have the right, on grounds relating to your particular situation, to object to processing of personal data concerning you for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

You may exercise your right to object at any time by contacting the relevant controller.

8 Right to withdraw consent (Art. 7(3) GDPR)

You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.

9 Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority responsible for data protection regarding our processing of personal data.

This right may be exercised by the data subject at any time by contacting the relevant controller.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content—such as ‘your information’ from the initial consultation form—this page uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of your browser changes from ‘http://’ to ‘https://’ and by the padlock symbol in your browser bar.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Information on data processing

1 Purpose of collecting personal data

Contact form on the website

If you send us your information via the ‘Free Initial Consultation’ field, the details you provide in the form, including your contact details, will be stored by us for the purpose of processing your enquiry. We do not share this data without your consent.

The processing of this data is based on Article 6(1)(b) GDPR, provided your enquiry is related to the fulfilment of a contract or is necessary to carry out pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR) if this has been requested; consent can be withdrawn at any time. The data you enter in the contact form will remain with us until you request deletion, withdraw your consent to storage, or the purpose for data storage no longer applies (e.g. after your enquiry has been processed). Mandatory legal provisions—especially retention periods—remain unaffected.

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, your enquiry, including all resulting personal data (name, enquiry), will be stored and processed by us for the purpose of handling your request. We do not share this data without your consent.

The processing of this data is based on Article 6(1)(b) GDPR, provided your enquiry is related to the fulfilment of a contract or is necessary to carry out pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR) if this has been requested; consent can be withdrawn at any time. The data you send to us via contact enquiries will remain with us until you request deletion, withdraw your consent to storage, or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory legal provisions—especially statutory retention periods—remain unaffected.

2 Legal basis

The processing of personal data is only lawful if there is a legal basis for the processing. According to Article 6(1)(a–f) GDPR, the legal basis for processing may in particular be:

1. The data subject has given consent to the processing of their personal data for one or more specific purposes;

2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

3. processing is necessary for compliance with a legal obligation to which the controller is subject;

4. processing is necessary in order to protect the vital interests of the data subject or of another natural person;

5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

3 Storage period

Unless a more specific storage period has been specified within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you make a legitimate request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. tax or commercial law retention periods); in the latter case, deletion will take place after these reasons no longer apply.

Use of cookies

(1) In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive and assigned to the browser you are using, and through which certain information flows to the party setting the cookie. Cookies cannot run programmes or transmit viruses to your computer. They are used to make the internet offering more user-friendly and effective overall.

(2) This website uses the following types of cookies, the scope and functionality of which are explained below:

· Transient cookies (see 1.)

· Persistent cookies (see 2.).

1. Transient cookies are automatically deleted when you close the browser. These include, in particular, session cookies. These store a so-called session ID, which allows various requests from your browser to be assigned to the same session. This enables your computer to be recognised when you return to our website. Session cookies are deleted when you log out or close the browser.

2. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete the cookies at any time in your browser’s security settings.

3. You can configure your browser settings according to your preferences, for example, to refuse the acceptance of third-party cookies or all cookies. ‘Third-party cookies’ are cookies set by a third party, i.e. not by the actual website you are currently visiting. Please note that if you deactivate cookies, you may not be able to use all the functions of this website.

4. The Flash cookies used are not captured by your browser but by your Flash plug-in. We also use HTML5 storage objects, which are stored on your device. These objects store the required data independently of the browser you use and do not have an automatic expiry date. If you do not wish Flash cookies to be processed, you must install an appropriate add-on, such as ‘Better Privacy’ for Mozilla Firefox (https://addons.mozilla.org/de/firefox/addon/betterprivacy/) or the Adobe Flash Killer Cookie for Google Chrome. You can prevent the use of HTML5 storage objects by using your browser’s private mode. We also recommend that you regularly manually delete your cookies and browser history.

Use of Google Analytics

(1) This website uses Google Analytics 4, a web analytics service provided by Google Inc. (‘Google’). Google Analytics uses so-called ‘cookies’, text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is generally transmitted to a Google server in the USA and stored there. If IP anonymisation is activated on this website, your IP address will, however, be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before transmission. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator.

(2) The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.

(3) You can prevent the storage of cookies by selecting the appropriate settings in your browser software; however, please note that in this case you may not be able to use all the functions of this website to their full extent. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

(4) This website uses Google Analytics with the extension ‘_anonymizeIp()’. This means that IP addresses are processed in a shortened form, so that they cannot be linked to a specific person. If the data collected about you is personally identifiable, it is immediately excluded and the personal data is deleted without delay.

(5) We use Google Analytics to analyse and regularly improve the use of our website. The statistics obtained allow us to improve our offering and make it more interesting for you as a user. In exceptional cases where personal data is transferred to the USA, Google is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Article 6(1) sentence 1(f) GDPR.
The data processing agreement can be found here: https://business.safety.google/adsprocessorterms/ 

(6) Information from the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of use:

http://www.google.com/analytics/terms/de.html, Übersicht zum Datenschutz: http://www.google.com/intl/de/analytics/learn/privacy.html, sowie die Datenschutzerklärung: http://www.google.de/intl/de/policies/privacy.

(7) This website also uses Google Analytics for a cross-device analysis of visitor flows, which is carried out via a user ID. You can deactivate the cross-device analysis of your usage in your customer account under ‘My Data’, ‘Personal Data’.

Recipients of personal data

We use external service providers (processors), for example for shipping goods, newsletters, or payment processing. A separate data processing agreement has been concluded with the service provider to ensure the protection of your personal data.

We work with the following service providers: