Privacy Policy

1. Controller

2. Data protection officer

3. Description of the individual processing activities

3.1 Technical provision of the website and server log files

When you visit our website, technically necessary data is processed so that the website can be displayed in your browser and to ensure the stability, security and functionality of the website.

In particular, the following data is processed:

• IP address of the requesting device
• date and time of access
• page or file accessed
• amount of data transferred
• referrer URL
• browser type and browser version
• operating system and device information
• technical communication data

Our website's fonts, images and scripts are served from our own server; no external fonts (e.g. Google Fonts) are loaded.

Purpose: Technical provision of the website and establishing connections; detecting and defending against attacks and misuse, and investigating security incidents. The access logs containing IP addresses are not used for access statistics or usage analysis.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and functional provision of our website and in defending against attacks (cf. Art. 32 GDPR).

Recipients: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, as processor under Art. 28 GDPR. The website is operated in the AWS region Frankfurt am Main (Germany).

Transfer to third countries: The data is processed and stored in the EU. As AWS belongs to a US group, access from the USA cannot be completely ruled out. Amazon Web Services, Inc. is certified under the EU-U.S. Data Privacy Framework; EU standard contractual clauses are in place in addition.

Storage period: The access logs of our content delivery network (Amazon CloudFront) containing the full IP address are kept for 30 days and then deleted automatically. This period is necessary because attacks and misuse are often detected only afterwards, and a security incident then has to be traced back over this period. The application itself only writes error logs; they contain no IP addresses and are deleted after 90 days.

3.2 Cookies

Our website itself does not set any cookies or store any information in your browser. No tracking, analytics or marketing cookies are used. A cookie banner is therefore not required.

Exceptions are services that are only loaded through your active use: the registration form on our event pages (HubSpot, section 3.5) and embedded YouTube videos after you click (section 3.6). These providers may set their own technically necessary cookies.

Legal basis: Section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.

3.4 Interactive 3D graphics / Spline

We use interactive 3D graphics on the homepage and the “Solutions in action” page. The 3D scenes and the rendering software (Spline Viewer) are hosted on our own server. For individual computing modules (WebAssembly), however, your browser connects to servers of Spline Inc. (cdn.spline.design) when the graphic loads.

In doing so, your IP address is transmitted to Spline Inc. No cookies are set and no further data is collected.

Purpose: Displaying interactive 3D graphics for the visual design of the website.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the appealing visual presentation of our website.

Recipients: Spline Inc., USA.

Transfer to third countries: When the graphic loads, the IP address is transferred to the USA. The transfer is based on standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

Further information: https://spline.design/privacy

3.5 Event registration / HubSpot

On the pages about our events, you can register via a form. The form is provided by HubSpot. HubSpot is not used for website tracking or analytics. HubSpot Ireland Ltd. acts as a processor pursuant to Art. 28 GDPR.

When you open an event page, your browser loads the form from HubSpot's servers; in doing so, your IP address is transmitted. The data you enter (in particular name, email address, company) is only transmitted to and stored at HubSpot when you submit the form.

Purpose: Organizing the event, managing participants and communicating with you about the event.

Legal basis: Art. 6(1)(b) GDPR (registration for the event); for loading the form, Art. 6(1)(f) GDPR (legitimate interest in simple online registration).

Storage period: Deletion after the event and its follow-up have been completed, unless statutory retention obligations apply.

Recipients: HubSpot Germany GmbH, Am Söldnermoos 17, 85399 Hallbergmoos; HubSpot Ireland Ltd., 1 Sir John Rogerson's Quay, Dublin 2, Ireland; HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA.

Transfer to third countries: A transfer to the USA cannot be ruled out. HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework. In addition, HubSpot has concluded EU standard contractual clauses.

Further information: https://www.hubspot.com/data-privacy/gdpr

3.6 YouTube links and embedded videos

On our “News & Events” page we show videos from our YouTube channel. We use a two-click solution for this: at first, only a placeholder from our own server is shown. Only when you click the play button is the video loaded from YouTube in privacy-enhanced mode (youtube-nocookie.com). Only then is data transferred to YouTube, in particular your IP address, device and browser data and the page visited. If you are logged in to Google, YouTube may associate the view with your account.

Our server retrieves the list of videos directly from YouTube; none of your data is transmitted in the process.

Our website also contains links to our YouTube channel. When you click a link, you leave our website.

Purpose: Providing supplementary video and tutorial content.

Legal basis: Embedded videos: Art. 6(1)(a) GDPR (consent by clicking the play button), Section 25(1) TDDDG. Links: Art. 6(1)(f) GDPR.

Recipients: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and possibly Google LLC, USA.

Transfer to third countries: A transfer to the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework.

Further information: https://policies.google.com/privacy

3.7 Contact by email or phone

If you contact us directly by email or phone, we process the data you provide, in particular name, email address, phone number, company and the content of your message.

Purpose: Handling your request, communication, documentation of the contact.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures/performance of a contract), Art. 6(1)(f) GDPR (general inquiries).

Transfer to third countries: No targeted transfer to third countries is planned.

Storage period: Deletion after final processing; tax-relevant communication for up to 10 years.

3.8 Applications

If you apply to us, we process your application data, in particular name, contact details, CV, certificates and any other information you provide voluntarily.

Legal basis: Section 26(1) BDSG in conjunction with Art. 6(1)(b) GDPR.

Storage period: Deletion no later than six months after the selection process has ended, unless an employment relationship is established.

3.9 Reporting security incidents / disclosure policy

Security incidents can be reported to security@leitart.de. Reports received are processed for review, handling and documentation.

Legal basis: Art. 6(1)(f) GDPR. Legitimate interest: ensuring IT security and fixing vulnerabilities.

3.10 Links to social media channels

LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you click the links, you leave our website. The operators of the linked platforms are solely responsible for data processing on those platforms.

Legal basis: Art. 6(1)(f) GDPR.

3.11 External links

Our website contains links to external services. When you click them, you leave our website; the respective operator alone is responsible for data processing on the target page:

• Qlik demo tenant (demo-leitart.de.qlikcloud.com): Qlik Technologies Inc.
• data+ website (dataplusextension.com): information on our extension suite data+
• Newsletter sign-up (share-eu1.hsforms.com): sign-up form provided by HubSpot that opens in a new tab. When you open it, your IP address is transmitted to HubSpot (recipients and third-country transfer as in section 3.5)
• Careers portal (jobs.ebk-gruppe.com): job openings and applications via the careers portal of the EBK Group, which belongs to the same group of companies as leitart

Legal basis: Art. 6(1)(f) GDPR.

4. Data subject rights

Subject to the statutory requirements, you have the following rights:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object (Art. 21 GDPR)
• right to withdraw consent given

To exercise your rights: leitart@leitart.de or the data protection officer (section 2).

5. Right to lodge a complaint with the supervisory authority

Berliner Beauftragte für Datenschutz und Informationsfreiheit · Friedrichstr. 219 · 10969 Berlin · www.datenschutz-berlin.de

6. No automated decision-making

We do not use your personal data for automated decision-making, including profiling within the meaning of Art. 22 GDPR.