Our Data
Privacy Statement
Data protection information for job seekers, employees and freelancers
Duty to provide information pursuant to Articles 13 and 14 GDPR when collecting personal data.
You can find the German version of our Data Privacy Statement here.
With respect to the applicability of this data protection information to subcontractors, it is naturally assumed that personal data concerning a director, for example, is actually processed.
1. Joint controllers’ names and contact details
AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH as joint controller within the meaning of Article 26 GDPR
represented by the Directors
Birketweg 21
80639 Munich, Germany
2. Data Protection Officer’s contact details
AVANTGARDE Experts GmbH
Claudia Keul, Birketweg 21, 80639 Munich, Germany
Email: dp-experts(at)avantgarde-experts.de, +49 (0)89 264 84 73 15
AVANTGARDE Talents GmbH
Claudia Keul, Birketweg 21, 80639 Munich, Germany
Email: dp-tal(at)avantgarde-talents.de, +49 (0)89 264 84 73 15
3. Purposes for which data is processed, data categories, data sources and legal basis of data processing
3.1. Purposes for which data is processed:
Together with third parties commissioned by us, we process personal data:
- to contact you (again) as a job seeker, to contact you at your request and to initiate an application process (recruitment, acquisition measures);
- to contact you as a prospective contractual partner or to contact you at your request and to initiate a business relationship or specific contractual relationship (contracting);
- to be able to conduct an application process, in particular by sending your candidate profile to our customers and any of the customer’s upstream managed service providers (MSPs), coordinating customer interviews and conducting them with you (recruitment);
- to be able to present you personally or your company to our customers in the field of contracting (including acting as a freelancer agent);
- to conduct application and, if necessary, briefing interviews, e.g. via video call (Microsoft Teams);
- to be able to effectively negotiate and conclude a contract, particularly to hold contractual negotiations, to prepare draft contracts by using various software tools, etc. (Recruitment, HR, Sales); and
- to be able to implement a concluded contract (HR, accounting);
- to conduct surveys to ensure the legally accurate performance of our contracts, as well as to continuously improve ourselves as a service provider (performance of contractual relationship).
3.2. The following categories of data are relevant:
- Title
- First and last name
- For subcontractors: company
- Home address
- For subcontractors: registered office
- Telephone number/mobile phone number
- Date of birth
- Email address
- Salary expectations (hourly rate)
- Professional training
- School education
- Professional experience
- Nationality
- Availability, flexibility
- Photo/Face in the context of a video call
- Other information from your résumé, letters of reference, certificates
3.3. Data sources
- You personally, if you proactively share your personal data to contact us (business cards, etc.)
- You personally, if and to the extent that you share your personal data when you contact us (acquisition) or as part of the application process
- You personally, if and to the extent that you are already one of our customers and we have received your personal data from you in the context of the contractual relationship, including for the purpose of initiating contractual relationships with candidates
- Any contact persons in your company who you know personally
- Other third parties, e.g. credit agencies or address service providers which send us personal data as permitted by law
- Publicly accessible (job) portals on which you have personally made your personal data public
- Other publicly accessible sources, such as debtor lists, land registers, commercial and association registers, media, permissibly obtained or lawfully provided to us by other third parties (a credit agency or an address service provider)
3.4. Categories of data recipients
- Authorities, to fulfil legal notification obligations.
- IT service providers for the maintenance of our IT infrastructure.
- Debt collection service providers and legal professionals, in order to collect receivables and enforce claims through the courts.
- Service providers who provide and maintain our job seeker pool
- Reciprocal customers / applicants / subcontractors and MSPs
3.5. Legal bases
3.5.1. Data processing based on our legitimate interests (Article 6 (1) sent. 1 lit. f GDPR)
We base the processing of your personal data in connection with the aforementioned acquisition measures on our primary legitimate interest in contacting you as a prospective candidate and contractual partner for our customer projects which are to be set out in further detail. The same applies to the temporary transfer and storage of your personal data in our job seeker/talent pool for as long as a specific acquisition measure with any connected recruitment process lasts, and we may assume that you wish to be contacted regarding jobs.
3.5.2. Data processing for the purpose of performing a future or current contract with us (Article 6 (1) sent. 1 lit. b GDPR)
Naturally, we also process your personal data for the purpose of initiating a contract, i.e. on the basis of Article 6 (1) sent. 1 lit. b GDPR, if in individual cases, information from your résumé needs to be checked/verified, if references are required or if you wish to provide references, and by requesting information from former schools, technical colleges, universities and former employees, provided that data processing for the data subjects is permitted under the data protection legislation.
If a contract for services or work is concluded with you as a freelancer, we will process your data to implement the contract for services or work. The legal basis for this is Article 6 (1) sent. 1 lit. b alt. 1 GDPR.
3.5.3. Data processing on the basis of your consent (Article 6 (1) sent. 1 lit. a GDPR)
If and to the extent that you consent to us continuing to contact you following a specific acquisition measure, i.e. contacting you by telephone, post or email in particular, the legal basis for this is your declaration of consent which you have issued to us (Article 6 (1) sent. 1 lit. a GDPR).
Your consent also permits us, for the duration your data is stored, to contact you for purposes related to internal surveys and direct advertising, as described in your declaration of consent. The legal basis is Article 6 (1) sent. 1 lit. a GDPR.
4. Obligation to provide personal data
The provision of personal data is necessary for the purpose of concluding a contract (temporary agency work contract or contract for services or work) with AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH. Failure to provide the data would make it impossible to conduct the application process or conclude a contract.
5. Automated decision-making including profiling
The joint controllers do not carry out any profiling measures.
6. Data transfers to third countries
Data transfers to countries outside of the EU and the EEA (“third countries”) may take place in the context of the administration, development and operation of IT systems.
Data will only be transferred in the following cases:
- the transfer is permissible because it satisfies the statutory requirements, or because you have consented to the data transfer; and
- the special requirements for transfers to third countries are met.
7. Duration of data storage
Personal data will be stored until the purpose for which it was collected is achieved. Personal data may also be stored for the performance of activities that are in the public interest or related to the exercise of a public authority. Additionally, personal data may be stored for as long as legal interests are in the process of being exercised or defended.
Documents from unsuccessful applicants will be stored for up to six months on the basis of the General Equal Treatment Act (AGG) and the Code of Civil Procedure (ZPO).
If you have consented to the storage of your application in a job seeker pool, the data will be stored for as long as your declaration of consent remains legally effective and valid.
If an employment contract is concluded, we will store your personal data for the duration of the employment. The same applies to contracts for work or services concluded with freelancers. Personal data may also be stored for the performance of activities that are in the public interest or related to the exercise of a public authority. Additionally, personal data may be stored for as long as legal interests are in the process of being exercised or defended.
The employee file will be stored for a period of three years after the employment has ended and until the expiry of the statutory limitation period, commencing on the day the claim falls due. Individual documents from the employee file (e.g. payroll accounts, leave of absence certificates) will be stored for up to six years (in accordance with the Income Tax Act and Tax Code) or up to ten years (in accordance with the Commercial Code).
8. Rights of data subjects
Unless specified otherwise, the data processing falls under the responsibility of AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH, Birketweg 21, 80639 Munich, Germany, as joint controllers. You may, at any time, request information about the data stored by us and request the rectification of inaccurate data. You also have the right to restrict the data processing, the right to data portability in a machine-readable format, and the right to deletion of your data once it is no longer needed.
Furthermore, you have the right to object to the use of your data for purposes based on public or legitimate interests at any time. In so far as we process your data on the basis of consent that you have given, you may withdraw your consent with future effect at any time. We will stop processing your data for the purposes stated in the declaration of consent upon receipt of your revocation notice. Please send your revocation or objection notice to:
AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH
zu Hd. Datenschutzbeauftragte/FAO: Data Protection Officer
Birketweg 21
80639 Munich, Germany
Email: dp-experts(at)avantgarde-experts.de or dp-experts(at)avantgarde-talents.de
9. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority at any time. The authority responsible for us is: Bavarian State Office for Data Protection, PO Box 606, 91511 Ansbach, Germany. You may also contact your locally responsible supervisory authority.
***
Are you a current or prospective customer? You can find our data protection information here
If you are interested in finding out more about data processing on our website, please see our general data protection information here
Data protection information for current and prospective customers
Duty to provide information pursuant to Articles 13 and 14 GDPR when collecting personal data. You can find the German version of our Data Privacy Statement here.
With respect to the applicability of this data protection information, it is naturally assumed that personal data concerning a director or contact person for a current or prospective customer is actually processed.
1. Controller's name and contact details
AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH as joint controller within the meaning of Article 26 GDPR
represented by the Directors
Birketweg 21
80639 Munich, Germany
2. Data Protection Officer’s contact details
AVANTGARDE Experts GmbH
Claudia Keul, Birketweg 21, 80639 Munich, Germany
Email: dp-experts(at)avantgarde-experts.de, +49 (0)89 264 84 73 15
AVANTGARDE Talents GmbH
Claudia Keul, Birketweg 21, 80639 Munich, Germany
Email: dp-experts(at)avantgarde-talents.de, +49 (0)89 264 84 73 15
3. Purposes for which data is processed, data categories, data sources and legal basis of data processing
3.1. Purposes for which data is processed:
Together with third parties commissioned by us, we process personal data:
- to contact you as a prospective contractual partner at your request and to initiate a business relationship or specific contractual relationship;
- to contact you (again) as a prospective customer and to initiate a contractual relationship (recruitment, acquisition);
- to be able to hold pre-contractual negotiations and have discussions with you as a direct contact person/company representative;
- to be able to introduce our candidates to you as a contact person/company representative or to plan joint interviews and hold them, etc.;
- to be able to effectively negotiate and conclude a contract, particularly to hold contractual negotiations, to prepare draft contracts etc. (sales);
- to be able to implement a contract that has been concluded (including billing, i.e. creating, saving, sharing and using your data to create and send invoices); and
- to be able to send you targeted, relevant advertisements or other notifications we think you will be interested in, for example to:
- invite you to various events like the Digital Experts Talk; or
- to conduct surveys, e.g. on customer satisfaction.
3.2. The following categories of data are relevant:
- Title
- First and last name
- Company
- Registered office
- Telephone number/mobile phone number
- Email address
3.3. Data sources
- You personally, if you proactively share your personal data to contact us (business cards, etc.)
- You personally, if and to the extent that you share your personal data when you contact us
- You personally, if and to the extent that you are already one of our customers and we have received your personal data from you in the past in the context of the contractual relationship
- Any contact persons in your company who you know personally
- Other third parties, e.g. credit agencies or address service providers which send us personal data as permitted by law
- Publicly accessible portals on which you have personally made your personal data public
- Other publicly accessible sources, such as debtor lists, land registers, commercial and association registers, media, permissibly obtained or lawfully provided to us by other third parties (a credit agency or an address service provider)
- Other third parties (e.g. our candidates or temporary staff) and other restricted sources (e.g. professional networks like XING and LinkedIn).
- In addition, if you access our website or read or click on an email from us, we will also automatically collect specific data or obtain it by you providing it to us. For more information, please see our Cookie notice and Data protection information website
3.4. Categories of data recipients
- Authorities, to fulfil legal notification obligations.
- IT service providers for the maintenance of our IT infrastructure.
- Debt collection service providers and legal professionals, in order to collect receivables and enforce claims through the courts.
- Credit agencies and scoring providers for creditworthiness information, for the assessment and processing of payments.
- Service providers with whom we cooperate in order to perform our contractual obligations owed to you, specifically managed service providers (MSPs).
- Credit institutions and payment service providers for settlements.
- Service providers who provide and maintain our customer management system.
3.5. Legal bases
3.5.1. Data processing based on our legitimate interests (Article 6 (1) sent. 1 lit. f GDPR)
We base the processing of your personal data in connection with the aforementioned acquisition measures on our primary legitimate interest in contacting you as a prospective customer and contractual partner for our services. The same applies to the temporary transfer and storage of your personal data in our customer relationship system for as long as a specific acquisition measure with any direct recruitment or contract conclusion process lasts, and we may assume that you wish to be contacted in the context of the ongoing business relationship.
3.5.2. Data processing for the purpose of performing a future or current contract with us (Article 6 (1) sent. 1 lit. b GDPR) and for the fulfilment of legal obligations (Article 6 (1) sent. 1 lit. c GDPR in conjunction with Section 8 (1) of the Act on Temporary Agency Work (AÜG))
Naturally, we also process your personal data for the purpose of initiating a contract, i.e. on the basis of Article 6 (1) sent. 1 lit. b GDPR, if in individual cases, a specific job is available through a ‘search’ or has already been agreed.
If a temporary agency work contract or contract for services or work is concluded or an agency contract is concluded with you as a customer representative, we will also process your data to implement the contract in question, particularly with respect to the legal obligations of the temporary work agency and the user under the Act on Temporary Agency Work (AÜG). The legal basis for this is Article 6 (1) sent. 1 lit. b alt. 1 GDPR. The legal basis for a corresponding legal obligation is Article 6 (1) sent. 1 lit. c GDPR in conjunction with Section 8 (1) AÜG (equal pay).
3.5.3. Data processing on the basis of your consent (Article 6 (1) sent. 1 lit. a GDPR)
If and to the extent that you consent to us continuing to contact you following a specific acquisition measure, i.e. contacting you by telephone, post or email in particular, the legal basis is your declaration of consent which you have issued to us (Article 6 (1) sent. 1 lit. a GDPR).
Your consent also permits us, for the duration your data is stored, to contact you for purposes related to internal surveys and direct advertising, as described in your declaration of consent. The legal basis is Article 6 (1) sent. 1 lit. a GDPR.
4. Obligation to provide personal data
The provision of personal data is necessary for the purpose of concluding a contract (temporary agency work contract or contract for services or work) with AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH. Failure to provide the data would make it impossible to conduct the candidate application process or conclude a contract.
5. Automated decision-making including profiling
The joint controllers do not carry out any profiling measures.
6. Data transfers to third countries
Data transfers to countries outside of the EU and the EEA (“third countries”) may take place in the context of the administration, development and operation of IT systems.
Data will only be transferred in the following cases:
- the transfer is permissible because it satisfies the statutory requirements, or because you have consented to the data transfer; and
- the special requirements for transfers to third countries are met.
7. Duration of data storage
Personal data will be stored until the purpose for which it was collected is achieved. Personal data may also be stored for the performance of activities that are in the public interest or related to the exercise of a public authority. Additionally, personal data may be stored for as long as legal interests are in the process of being exercised or defended.
Documents from unsuccessful applicants will be stored for up to six months on the basis of the General Equal Treatment Act (AGG) and the Code of Civil Procedure (ZPO).
If you have consented to the storage of your application in a job seeker pool, the data will be stored for as long as your declaration of consent remains legally effective and valid.
If an employment contract is concluded, we will store your personal data for the duration of the employment. The same applies to contracts for work or services concluded with freelancers. Personal data may also be stored for the performance of activities that are in the public interest or related to the exercise of a public authority. Additionally, personal data may be stored for as long as legal interests are in the process of being exercised or defended.
The employee file will be stored for a period of three years after the employment has ended and until the expiry of the statutory limitation period, commencing on the day the claim falls due. Individual documents from the employee file (e.g. payroll accounts, leave of absence certificates) will be stored for up to six years (in accordance with the Income Tax Act and Tax Code) or up to ten years (in accordance with the Commercial Code).
8. Rights of data subjects
Unless specified otherwise, the data processing falls under the responsibility of AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH, Birketweg 21, 80639 Munich, Germany as joint controllers. You may, at any time, request information about the data stored by us and request the rectification of inaccurate data. You also have the right to restrict the data processing, the right to data portability in a machine-readable format, and the right to deletion of your data once it is no longer needed.
Furthermore, you have the right to object to the use of your data for purposes based on public or legitimate interests at any time. In so far as we process your data on the basis of consent that you have given, you may withdraw your consent with future effect at any time. We will stop processing your data for the purposes stated in the declaration of consent upon receipt of your revocation notice. Please send your revocation or objection notice to:
AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH
zu Hd. Datenschutzbeauftragte/FAO: Data Protection Officer
Birketweg 21
80639 Munich, Germany
Email: dp-experts(at)avantgarde-experts.de or dp-tal(at)avantgarde-talents.de
9. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority at any time. The authority responsible for us is: Bavarian State Office for Data Protection, PO Box 606, 91511 Ansbach, Germany. You may also contact your locally responsible supervisory authority.
***
Are you an applicant, candidate, subcontractor or freelancer? You can find our data protection information here
If you are interested in finding out more about data processing on our website, please see our general data protection information here
Data protection information for for participants AVANTGARDE Experts Events
Duty to provide information pursuant to Article 13 GDPR when collecting personal data of participants.
The Privacy Policy for Applicants and Sub-Contractors and the Privacy Policy for Prospects and Customers also apply.
1. Controller’s name and contact details
AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH as joint controller within the meaning of Article 26 GDPR
represented by the Directors
Birketweg 21
80639 Munich, Germany
2. Data Protection Officer’s contact details
AVANTGARDE Experts GmbH
Claudia Keul, Birketweg 21,80639 Munich, Germany
dp-experts(at)avantgarde-experts.de, +49 89 883 990
AVANTGARDE Talents GmbH
Claudia Keul, Birketweg 21,80639 Munich, Germany
dp-expertsl@avantgarde-talents.de, +49 89 883 990
3. Categories of personal data processed and purposes of processing
In order to perform the respective photo and/or video recordings at our events and/or to send information about and/or invitations to AVANTGARDE E&T events, we, as well as third-party data processors commissioned by us, process the following data pertaining to you insofar as you have provided us with this data in advance or during processing:
- First name and surname
- Address data
- Telephone number/mobile phone number
- Email address
- Recordings (photo, audio and video recordings)
- Applicant data, if applicable, see Privacy Policy for Applicants and Contractors
- Customer data, if applicable, see Privacy Policy for Prospects and Customers
4. Legal bases: Contract performance, Art. 6 (1) (1) b) GDPR, and on the basis of your declaration of consent, Art. 6 (1) (1) c) GDPR.
Avantgarde E&T process your personal data for the purpose of performing the event contract concluded with Avantgarde E&T. The legal basis in this case is: Art. 6 (1) (1) b) or 2 GDPR. With regard to the processing of biometric data, i.e. photos, film and sound recordings as well as the processing of communication data for information purposes, we refer to the declaration of consent given by you.
5. Obligation to provide personal data
The provision of personal data is necessary for the performance of the event contract with AVANTGARDE E&T. Failure to provide this data would mean that it would not be possible to send out invitations or newsletters relating to AVANTGÀRDE E&T events, or at least that it would not be possible to take photo or make sound and image recordings.
6. Automated decision-making including profiling
The joint controllers do not carry out any profiling measures.
7. Data transfers to third countries
Data transfers to countries outside of the EU and the EEA (“third countries”) may take place in the context of the administration, development and operation of IT systems. Data will only be transferred in the following cases:
- the transfer is permissible because it satisfies the statutory requirements, or because you have consented to the data transfer; and
- the special requirements for transfers to third countries are met.
8. Recipients of data and data sources
8.1. Categories of data recipients
To the extent permitted by law, we share personal data internally with those departments that are involved in the conclusion and performance of the event contract and the implementation of this declaration of consent (Marketing, HR, Legal, Data Protection Officer) and, if necessary, with the following external parties:
Service providers for the preparation, processing, performance of recordings
IT service providers for the maintenance of our IT infrastructure
Marketing partners (e.g. PR agencies, social media platforms)
Customers and prospects
8. 2. Data sources
We process personal data that we have received from you within the scope of our contractual relationships or on the basis of your consent (including implied consent).
9. Duration of data storage
The personal data is stored for the duration of the contractual relationship. Personal data may also be stored for the performance of activities that are in the public interest or related to the exercise of a public authority. Additionally, personal data may be stored for as long as legal interests are in the process of being exercised or defended.
Individual documents will be stored for up to six years (in accordance with the Income Tax Act and Tax Code) or up to ten years (in accordance with the Commercial Code).
10. Rights of data subjects
Unless specified otherwise, the data processing falls under the responsibility of AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH, Birketweg 21, 80639 Munich, Germany, as joint controllers. You may, at any time, request information about the data stored by us and request the rectification of inaccurate data. You also have the right to restrict the data processing, the right to data portability in a machine-readable format, and the right to deletion of your data once it is no longer needed.
Furthermore, you have the right to object to the use of your data for purposes based on public or legitimate interests at any time. In so far as we process your data on the basis of consent that you have given, you may withdraw your consent with future effect at any time. We will stop processing your data for the purposes stated in the declaration of consent upon receipt of your revocation notice. Please send your revocation or objection notice to:
AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH
Birketweg 21
80639 Munich, Germany
Email: dp-experts(at)avantgarde-experts.de or dp-experts(at)avantgarde-talents.de
11. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority at any time. The authority responsible for us is: Bavarian State Office for Data Protection, PO Box 606, 91511 Ansbach, Germany. You may also contact your locally responsible supervisory authority.
***
Are you an applicant or freelancer? Then see our privacy notice here.
Are you an interest or a customer? You can find the privacy policy here.
Website Data Privacy Statement in accordance with Articles 13 and 14 GDPR
The following data protection information provided pursuant to Article 13 et seq. GDPR serves the obligation to provide information at the time personal data is collected. The German version of our data privacy statement can be found here.
Gender notice: All designations that refer to a person are meant for both genders, including in cases where the masculine form was used to facilitate a better reading flow.
AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH (hereinafter collectively referred to as“we/us” or “the joint controllers”) are jointly responsible for the data processing (as joint controllers within the meaning of Article 26 GDPR).
1. Controller's name and contact details
AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH
Birketweg 21
80639 Munich, Germany
represented by the Directors
2. Contact details of the Data Protection Officer
AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH
Claudia Keul, Birketweg 21, 80639 Munich, Germany
Telephone: +49 (0)89 264 84 73 15
Email: dp-experts(at)avantgarde-experts.de and dp-experts(at)avantgarde-talents.de
- Contact details, including
- Email address
- Telephone number
- Mobile phone number
- Organisation
- IP address of the requesting computer
- Date and time of access
- Name and URL of the accessed file
- Website from which the access is made (referrer URL)
- Browser used and, if applicable, the operating system of your computer as well as the name of your access provider
- First name and last name
- Website from which the access is made (referrer URL)
- Browser used and, if applicable the operating system of your computer as well as the name of your access provider
- Cookie ID
- Pages visited
- Duration of website visit
- Usage data of the website
- Content in which the user is interested
- Clicked advertising
- Web requests
- Cookie information
- Referrer URL
- Browser language
- Browser type
- Device information
- Videos watched
4. Data processing purposes
4.1. Provisioning and use of the website
When you access and use our website, we will collect the personal data that is automatically transmitted to our server by your web browser. This information will be stored temporarily in a so-called log file. When you use our website, we will collect the following data, which is technically necessary to display our website to you and warrant its stability and security:
- IP address of requesting computer
- Date and time of access
- Name and URL of the accessed file
- Website from which the access was made (referrer URL)
- Browser used and, if applicable, the operating system of your computer and the name of your access provider
The above data necessary to display the website will be deleted as soon as it is no longer needed. The collection of the data for providing the website and storage of the data in log files is strictly necessary for the purpose of operating the website. Users cannot object against the collection and recording of data in this context. The data may be stored for longer periods in cases where a longer storage period is prescribed by a statutory provision.
4.2. Contact form
Our website www.avantgarde-experts.de offers a contact form, which you can use to contact us. When you use the contact form, the following personal data will be processed in addition to the details you have entered into the contact field:
- First and last name
- Email address
- Telephone number
The disclosure of your name and your email address serves the purpose of understanding your enquiry and appropriately responding to it. Using the contact form will not disclose any personal data to third parties. Further details about your company and its address as well as your availability over the phone are voluntarily, and you may use these fields to add further specifics to your enquiry. The personal data processed via the contact form will be deleted as soon as your inquiry was processed and the concerned issue was fully clarified with you. The data may be stored for longer periods in cases where a longer storage period is prescribed by a statutory provision.
4.3. Contacting us by email
You may contact us at any time by sending your specific inquiry and relevant information to our email address. There is no obligation to use the contact form. If you use email to contact us, the following personal data will be processed in addition to those contained in your email:
- Email address
- Name
The disclosure of your name and your email address serves the purpose of understanding your enquiry and appropriately responding to it. Contacting us by email will not disclose any personal data to third parties. The personal data processed via your email contact will be deleted as soon as your inquiry was processed and the concerned issue was fully clarified with you. The data may be stored for longer periods in cases where a longer storage period is prescribed by a statutory provision.
4.4. Sending newsletters (job alerts) and transactional emails
You have the option of subscribing to a free newsletter (job alert) on our website. We need your email address to be able to send you this on a regular basis.
Your data is shared with our newsletter service provider to allow us to send the newsletter. We use the ‘double opt-in procedure’ when sending newsletters, i.e. we will only send the newsletter to you if you have confirmed your subscription by clicking on a link contained in a confirmation email that has been sent to you. We want to ensure that only you, as the owner of the provided email address, are able to subscribe to newsletters. You must confirm this promptly after receiving the confirmation email, as your newsletter subscription will otherwise be automatically deleted from our database.
Your email address will only be saved for as long as you are subscribed to the newsletter. After you unsubscribe from our newsletter, your email address will be deleted. We will also send other automated transactional emails in addition to the newsletter/job alert. These are called ‘triggered emails’. They are triggered by an action such as placing an order for one of our merchandise items or creating a customer account. The system automatically sends the corresponding emails after the action takes place. For example, it might send an email confirming that a user account has been created, confirming a subscription, providing account notifications or providing dispatch notifications, etc.
4.5. Registration for our events
The personal data you disclose to us when registering for one of our events will only be processed for the purpose of organising the respective event. The processing of personal data in this context will usually serve the following purposes: invitation management by email, sending registration confirmations by email, sending reminders ahead of the event by email, sending further information or changes at short notice to the registered event participants, optimisation of the event planning. The data transmitted to us usually includes:
- First and last name
- Organisation or company
- Contact details, incl.
- Email address
We will use the personal data if we need to contact you to explain any potential changes to the event, information to the event agenda, and the generation of necessary.
5. Use of cookies
Our website uses certain cookies. Cookies are small files that are sent to the browser on your computer and stored there temporarily when you visit our web pages. Cookies are harmless for your computer. They cannot execute programs and do not contain any viruses.
Our website also uses session cookies, which are deleted automatically when you close your browser. These types of cookies allow us to collect your session ID. This makes it possible to allocate different requests from your browser to a common session and allows us to recognise your computer at a later visit to our website. These cookies are necessary for technical reasons in order to enable you to visit our website and use the functions offered on it. Cookies for advertising purposes or third-party cookies are also used on our websites. Further information on cookies can be found in our cookie notice.
6. Marketing/tracking and analysis tools
6.1. Cookie bot
This tracking tool stores the user's cookie acceptance settings for cookies from the current domain. The cookies enable the website to remember user actions and preferences (e.g. language selection) and to recognise returning visitors. This allows us to analyse trends and offer a more efficient website experience. You may at any time change your browser settings (e.g. Mozilla Firefox Apple Safari, Google Chrome, Opera, Internet Explorer) to prevent the storage of cookies and/or delete cookies from your device. Instructions can be found using your Internet browser's help function.
6.2. Google tag manager
This website uses the “Google Tag Manager” service. The Tag Manager is a tool for the management of tags, which are used in online marketing for tracking purposes. Since the Tag Manager by itself only serves the purpose of managing other services, (e.g. Google Analytics etc.), it does not process any personal data.
Further information about the Tag Manager can be found at: https://www.google.com/intl/de/tagmanager/use-policy.html
6.3. Google Analytics
This website uses Google Analytics, a web analysis service provided by Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, Irland („Google“). Google Analytics uses various methods that allow us to analyse the use of our website. The use of Google Analytics causes personal data to be transmitted to and stored on Google servers in the USA. The function „_anonymizelp“, or „ga('set', 'anonymizeIp', true)“ is used to truncate your IP address (i.e. deleting the last three digits) before sending the data. The data processing is based on Article 6 (1) sent. 1 lit. f GDPR and/or Article 8 (1) lit. b of the e-Privacy Regulation. The data processing is thus based on your consent. Further information about data protection and the functions of Google Analytics can be found at http://www.google.com/analytics/terms/de.html.
To prevent the collection of cookie-generated personal data related to their website use, including their IP address, by Google and the processing of this data by Google, users may also download and install the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
Further information about data protection and the functions of Google Analytics can be found at http://www.google.com/analytics/terms/de.html.
Alternatively, you can also deactivate Google Analytics by clicking on this link.
6.4. Google Ads (previously Google AdWords)
This website makes use of the “Google Ads” service. The service is operated by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Google Ads serves the purpose of “conversion tracking”, i.e. it provides us with information about what happens after you have clicked on one of our ads. This is done by using cookies with a limited validity.
The following data is collected and processed with the help of Google Ads:
- Cookie ID
- Pages visited
- IP address
- Duration of website visit
- Website usage data
- Content the user is interested in
- Clicked ads
- Web requests
- Cookie information
- Referrer URL
- Browser language
- Browser type
The personal data will be stored for as long as they are needed to achieve the purpose of processing the data. The data will be deleted once they are no longer needed for achieving the purpose.
The data processing may also result in the data being transmitted to the following recipients in addition to Google Ireland Limited:
- Google LLC.
- Alphabet Inc.
The processing of data by Google Ads may result in data being transmitted to the USA. The security of the transmission is warranted by standard contractual clauses, which assure that the processing of personal data is subject to a security level that is comparable to the level afforded by the GDPR. To the extent standard contractual clauses are insufficient to warrant an adequate level of security, the consent management system Usercentrics will first obtain a declaration of consent in accordance with Article 49 (1) lit. a GDPR from you.
6.5. Youtube
This website uses YouTube to embed videos on our website. The necessary software is operated by Google Ireland Limited Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. The integration of YouTube contents takes place in the “extended data protection mode”. This assures that YouTube does not automatically store cookies on your device. As a result, YouTube will not collect any information about visitors for as long as they do not watch the video.
Clicking on the video will cause your IP address to be transmitted to YouTube, which will indicate to YouTube that you have watched the video. If you are logged into your YouTube account, this information will also be linked to your user account. You can prevent this from happening by logging out of your YouTube account before accessing the video. Accordingly, YouTube may collect and process the following data:
- IP address
- Referrer URL
- Device information
- Videos watched
The data processing may also result in the data being transmitted to the following recipients in addition to Google Ireland Limited:
- Google LLC.
- Alphabet Inc.
The processing of data by YouTube may cause data to be transmitted to the USA. The security of the transmission is warranted by standard contractual clauses, which assure that the processing of personal data is subject to a security level that is comparable to the level afforded by the GDPR. To the extent standard contractual clauses are insufficient to warrant an adequate level of security, the consent management system Usercentrics will first obtain a declaration of consent in accordance with Article 49 (1) lit. a GDPR from you.
6.6. WiredMinds GmbH
Our website uses the pixel-code technology of WiredMinds GmbH (www.wiredminds.de) to analyse visitor behaviour. This involves processing the IP address of a visitor. The processing is carried out exclusively for the purpose of collecting company-relevant information such as the company name. IP addresses of natural persons are excluded from further use (whitelist procedure). The IP address is not stored in LeadLab under any circumstances. When processing the data, it is in our particular interest to protect the data protection rights of natural persons. Our interest is based on Art. 6 para. 1 lit. (f) GDPR. The data collected by us does not allow any conclusions to be drawn about an identifiable person at any time.
WiredMinds GmbH uses this information to create anonymous user profiles relating to the behaviour of visitors to our website. The data obtained in this way is not used to personally identify visitors to our website.
Exclude from tracking (A technically necessary cookie is set to permanently exclude you from tracking by WiredMinds LeadLab on this website)
6.7. Facebook Custom Audiences and Facebook Pixel
Our website also uses Facebook Custom Audiences for website personalisation and optimisation purposes. The following data is collected and processed with the help of Facebook Custom Audiences:
- Facebook user ID
- IP address
- Browser information
- Non-sensitive custom data
- Facebook cookie information
- Referrer URL
- Pixel-specific data
- Pixel ID
- Social media friend network
- Usage data/user behaviour
- Views and interactions with content and ads and services
- Viewed content
- Device information
- Marketing campaigns success
- Transaction information
- Hardware/software type
- Browser type
- Device operating system
- Geographic location
- Cookie ID
- Information from third-party sources
- User agent
- Conversions
The personal data will be stored for as long as they are needed to achieve the purpose of processing the data. The data will be deleted once they are no longer needed for achieving the purpose.
In addition to Facebook Ireland Limited, the data processing may also result in the data being transmitted to the following recipients:
Facebook Inc.
Our website uses “Facebook Pixel”, a service provided by Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA (referred to as “Facebook” hereafter). Facebook Pixel allows Facebook to only serve our ads on Facebook, also called “Facebook Ads”, to users who have previously visited our website, including in particular users who have expressed an interest in our online services or certain topics or products. Facebook Pixel allows us to analyse whether a user was forwarded to our website after clicking on one of our Facebook Ads. Facebook Pixel uses cookies, which are small text files that are stored locally on your computer in your web browser's temporary memory.
If you are logged into your Facebook account, your visit to our online service will be recorded in your user account. The data collected about you are anonymous to us and do not allow for any conclusions with regard to the identity of users. Facebook may however link the data with your Facebook user account. We do not have any influence on the scope and further downstream use of the data collected when the Facebook Pixel is used by Facebook. The information available to us indicates that Facebook will receive notification that you have accessed the relevant part of our website or clicked on one of our ads. If you have a Facebook user account and are logged into this account, Facebook can link the visit to your user account. Even if you are not registered with Facebook or are not logged into your account, Facebook may still obtain and store your IP address and other identification data about you.
It is expressly noted that this setting will be deleted if you delete your cookies. Another way to deactivate cookies that serve advertising or reach measurement purposes is to use the following websites:
optout.networkadvertising.org
www.aboutads.info/choices
http://www.youronlinechoices.com/uk/your-ad-choices
Please note that this setting will also be deleted if you delete your cookies. Information from the third-party service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Further data protection information from the third-party provider can be found on the following Facebook web page: www.facebook.com/about/privacy.
Information about the Facebook Pixel can be found on the following Facebook web page: https://www.facebook.com/business/help/651294705016616
6.8. Instagram
Our online services may feature buttons and content provided by Instagram, a service offered by: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. These features may include contents such as images, videos, text or buttons for users to express how they feel about the contents, the authors of the contents, or to subscribe to our own posts. If the user is an Instagram member, Instagram will be able to link the user's access of above content and functions to their user profiles. Instagram's data privacy statement: http://instagram.com/about/legal/privacy/.
An up-to-date overview of the cookies used on our website can be found here: Cookie Declaration
6.9. LinkedIn
Our website uses the Retargeting Tool and the Conversion Tracking function provided by LinkedIn Ireland, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn”). For this purpose, our website has an integrated LinkedIn Inside Tag, which allows us to collect statistical information about your visit and use of our website, and on this basis provide us with relevant aggregate statistics. The tag is also used to serve interest-specific and relevant offers and recommendations to you after you have obtained information about certain services, information and offers on our website. The data relevant in this context is stored in a cookie. If a user has not logged out of his LinkedIn profile before using our website, LinkedIn will proceed to place a cookie and create a link to the user. Users who wish to prevent this from happening will have to log out of their profile. Further data protection information can be found in LinkedIn's data privacy statement.
In most cases, the following data is collected and processed in this context:
- IP address
- Device information
- Browser information
- Referrer-URL
- Timestamp
The processing of data by LinkedIn may cause data to be transmitted to the USA and Singapore.
6.10. MS Bookings (Microsoft Outlook Service)
Our websites use various Microsoft tools that allow users to book appointments with certain contact persons. These tools can also be used for smaller events. The user enters his name and email address. The inquiries are sent directly to the respective contact persons at AVANTGARDE. They are used on a confidential basis.
Microsoft's data privacy statement for Microsoft Bookings can be found at https://privacy.microsoft.com/de-de/privacystatement. Further information on the rights of users can also be found at that link. Microsoft will process some or all of the data in the USA.
6.11. Use of Friendly Captcha for spam protection
Our website uses the "Friendly Captcha" service. This service is provided by Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany. Friendly Captcha is an innovative, data protection-friendly protection solution to make it more challenging for automated programmes and scripts (so-called "bots") to use our website. For this purpose, we have integrated a programme code from Friendly Captcha into our website (e.g. for contact forms) so that the visitor's end device can establish a connection to the Friendly Captcha servers in order to receive a calculation task from Friendly Captcha. The visitor's end device solves the calculation task (puzzle), which requires certain system resources, and sends the calculation result to our web server. This contacts the Friendly Captcha server via an interface and receives a response as to whether the puzzle has been solved correctly by the end device. Depending on the result, we can add security rules to requests via our website and, for example, process or reject them.
Friendly Captcha processes and stores the following data in the above-mentioned process
- Anonymised IP address of the requesting computer
- Information about the browser and operating system used
- Anonymised counter per IP address to control the cryptographic tasks
- Website from which the access took place
The data is used only to provide protection against spam and bots as described above. Friendly Captcha does not set or read any cookies on the visitor's end device. IP addresses are only stored in hashed (one-way encrypted) form and do not allow us or Friendly Captcha to draw any conclusions about an individual person. If personal data is collected, it will be deleted after 30 days at the latest and we have concluded a contract for order processing with Friendly Captcha GmbH. The data processing by Friendly Captcha is therefore carried out exclusively in accordance with instructions and on our behalf in accordance with Art. 28 GDPR.
6.12. Microsoft (Bing Ads)
Most of the users causes Microsoft to place cookies that analyse user behaviour on our website. This presupposes that the user came to our website after clicking on a BingAds ad. The cookie provides us with information about the total number of users who have clicked the respective ad. The IP address is not stored and no personal information related to the identity of our users is disclosed. The following data is collected and processed with the help of BingAds:
- Employment metrics
- Number of visits
- Bounce rates
- Microsoft Click-ID
- Digital signature
- UET-ID tag
- URLs
- Referrer URL
- Page title
- Conversions
- Screen height
- Screen width
- Browser language setting
- Visit duration
- Screen colour depth
- Page response times
- Ads clicked on
The personal data will be stored for as long as they are needed to achieve the purpose of processing the data. The data will be deleted once they are no longer needed for achieving the purpose. The processing of data by BingAds may cause data to be transmitted to the USA. The security of the transmission is warranted by standard contractual clauses, which assure that the processing of personal data is subject to a security level that is comparable to the level afforded by the GDPR. To the extent standard contractual clauses are insufficient to warrant an adequate level of security, the consent management system Usercentrics will first obtain a declaration of consent in accordance with Article 49 (1) lit. a GDPR from you.
6.13. TikTok Advertising
Our website uses the TikTok Advertising service. TikTok Advertising is an online advertising program by TikTok Information Technologies UK Limited, One London Wall, London EC2Y 5EB (“TikTok”). In this regard, information about website use is collected by the aforementioned controllers and TikTok Information Technologies UK Limited with joint responsibility as “joint controllers” within the meaning of Article 26 GDPR through the use of cookies and similar technologies, e.g. device identifiers, and is sent to TikTok Information Technologies UK Limited. When you use the website, your end device’s device identifier is determined and the tracking data sent to TikTok on this basis. Data sent to TikTok Information Technologies UK Limited is further processed, where TikTok Information Technologies UK Limited bears sole responsibility under data protection law. Such information sent to TikTok can be assigned to you personally using other information TikTok has saved about you as a result of you having an account on the social network “TikTok”, for example. The information collected can be used to display interest-related advertising for our products and/or services in your TikTok account (retargeting). The information collected can also be aggregated by TikTok and this aggregated information can then be used by TikTok for its own advertising purposes and for third-party advertising purposes. This allows TikTok to determine certain interests of yours based on your browsing habits on this website and use this information to advertise products and services from third parties. TikTok may also merge the information collected with other information TikTok has collected about you via other websites and/or in connection with the use of the social network “TikTok” to save a profile for you. This profile can be used for advertising purposes. If TikTok Information Technologies UK Limited processes your data as the sole controller under data protection law, your data may be sent from TikTok Information Technologies UK Limited to the USA. You can find more information about data protection at TikTok here.
6.14. Affiliate marketing (transaction queries, lead generation, cross-device tracking)
We use various affiliate marketing methods on our websites together with our affiliate service providers. Here, your personal network data is collected, stored and processed, etc. through or by way of transaction queries, (cross-device) tracking for business intelligence purposes and lead generation. (Cross-device) tracking means the processing of personal network data that relates to a data subject’s journey across websites on multiple end devices with the purpose of redirecting the data subject to websites, apps or services of Avantgarde E & T GmbH. Transaction queries means the processing of personal network data that relates to a data subject’s journey across websites and is carried out at the controller’s request to re-evaluate the assignment of data subject redirections to the controller’s websites, applications or services through tracking or cross device tracking. Business intelligence means the processing of personal network data for the purpose of understanding use with respect to interaction with the controller’s websites, apps or services. Lead generation means the processing of personal network data for the purpose of generating sales leads for the controller.
7. Legal bases
Article 6 (1) (f) GDPR is generally the legal basis for the data processing mentioned. Processing of the data mentioned is required in the following cases for the respective purpose pursued and thus functions as a safeguard for our legitimate interests in this regard. General data processing: to provide the website: processing of the data mentioned is required to provide the website and therefore functions as a safeguard for the legitimate interests of our company. The data processing described above for the purpose of responding to a request you have sent to us via the contact and order form or by email is also based on Article 6 (1) (f) GDPR. With respect to both the email address and the contact form, the provision of an interface to communicate with you is based on our legitimate interest, which is usually aligned with your interest in contacting us quickly and easily. In the context of event registration and organisation, we particularly use personal data to get in touch to explain any changes in the process and to provide information about the event. The data processing described above for the purpose of event organisation is also based on Article (6) (1) (f) GDPR. Proper organisation of events held by us and appropriate support for registered attendees are both in our interest. This interest is generally aligned with your interests as a registered attendee.
We use Friendly Captcha exclusively to detect and prevent the illegal use of our website. This data processing is carried out on the basis of Art. 6 para. 1 sentence 1 lit. f) GDPR. Our legitimate interest is to ensure the security of our web services and to prevent their misuse for automated spying and SPAM. Further information on Friendly Captcha and the privacy policy of Friendly Captcha GmbH can be found at the following link: Privacy policy for end users - Friendly Captcha
Marketing tools: the legal basis for processing is your consent in accordance with Article 6 (1) (a) GDPR. If you don’t want the data mentioned to be collected and processed via the respective tools, e.g. Google Ads, Facebook Custom Audiences, BingAds, YouTube, TikTok Advertising, etc., you can refuse consent or withdraw it at any time with effect for the future.
We use the retargeting tool and conversion tracking of LinkedIn Ireland, Wilton Plaza, Wilton Place, Dublin 2, Ireland ("LinkedIn"). For this purpose, the LinkedIn Insight Tag is integrated on our website, which enables LinkedIn to collect and analyse statistic data about your visit and the usage of our website to provide us with aggregated statistics on this basis. The service is also used to show you more relevant offers and recommendations based on your interests after you have viewed certain services, information and offers on the website. The relevant information is stored in a cookie. Unless the user logs out of their LinkedIN profile and uses our website, a cookie is set via LinkedIN and a connection to the user is generated. If the user wishes to avoid this, they have to log out of their profile. Further information on data processing can be found in LinkedIn's privacy policy.
8. Categories of data recipients
- IT service providers for the maintenance of our IT infrastructure.
- Debt collection service providers and legal professionals, in order to collect claims and enforce them through the courts.
- Third parties in the context of the marketing and tracking tool described above
9. Obligation to make data available
Users must provide their name and address. A contract is not incepted with our company if this information is withheld. All other data is disclosed on a voluntary basis.
10. Automated decision-making including profiling
The joint controllers do not carry out any profiling measures.
11. Data transfer to third countries
Data transfers to countries outside of the EU and the EEA (“third countries”) may take place in the context of the administration, development and operation of IT systems. Data will only be transferred in the following cases:
- The transfer is permissible because it satisfies the statutory requirements, or because you have consented to the data transfer and
- the special requirements for transfers to third countries are satisfied.
12. Duration of data storage
If to the extent you do not subsequently enter into a contract with us or grant your consent to us, we will only store data processed by us for the duration of the respective measure and not longer than until the respectively pursued purpose has been achieved. If you do enter into a contract with us, we will store your personal data for the duration of the contract term. Personal data may also be stored for the performance of activities that are in the public interest or related to the exercise of a public authority. Additionally, personal data may be stored for as long as legal interests are in the process of being exercised or defended.
If you have consented to the storage of your application in a job seeker pool, the data will be stored for as long as your declaration of consent remains legally effective and valid.
Individual documents will be stored for up to six years (in accordance with the Income Tax Act and Tax Code) or up to ten years (in accordance with the Commercial Code).
13. Rights of data subjects
Unless specified otherwise, the data processing falls under the responsibility of AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH, Birketweg 21, 80639 Munich, Germany as joint controllers. You may at any time request information on the data stored by us and request the correction of inaccurate data. You also have the right to restrict the data processing, the right to data portability in a machine-readable format, and the right to deletion of your data once they are no longer required.
You further have the right to at any time object against the use of your data for purposes based on public or legitimate interests. In as far as we process your data on the basis of a declaration of consent issued by you, you may at any time revoke such declaration with prospective effect. We will stop processing your data for the purposes stated in the declaration of consent upon receipt of your revocation or objection notice. Please send your revocation or objection notice to:
AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH
Birketweg21
80639 Munich, Germany
Email: dp-experts(at)avantgarde-experts.de and dp-experts(at)avantgarde-talents.de
12. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority at any time. The authority responsible for us is: Bavarian State Office for Data Protection, PO Box 606, 91511 Ansbach, Germany. You may also contact your locally responsible supervisory authority.
***
Are you a job candidate or freelancer? Review our data protection information here.
Are you a current or prospective customer? Our data privacy statement can be found here.
Privacy Policy for the whistleblower protection process; internal reporting point
Duty to provide information pursuant to Articles 13 and 14 GDPR when collecting personal data.
The German version of our data privacy statement can be found here.
1. Controller's name and contact details
AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH
Birketweg 21
80639 Munich, Germany
represented by the Directors
AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH (hereinafter collectively referred to as ‘we/us’ or ‘the joint controllers’) are collectively responsible for data processing (within the meaning of Article 26 GDPR).
2. Data Protection Officer’s contact details
AVANTGARDE Experts GmbH
Claudia Keul, Birketweg 21, 80639 Munich, Germany
T: +49 89 264 84 73 15
Email: dp-experts(at)avantgarde-experts.de
AVANTGARDE Talents GmbH
Claudia Keul, Birketweg 21, 80639 Munich, Germany
T: +49 89 264 84 73 15
Email:dp-experts(at)avantgarde-talents.de
3. Purposes for which data is processed and legal basis of data processing
- Acceptance of reports, see Article 6(1)(1)(c) GDPR in conjunction with Section 7(1) and Section 10 HinSchG (German Whistleblower Protection Act)
To enable any unlawful circumstances within the specific disclosure made to the internal reporting point or whistleblowing officer to be identified, the circumstances to which the issue relates are recorded during a confidential (telephone) conversation, or, if applicable, via similarly confidential written or electronic, encrypted correspondence. Within this framework, the declarations of consent necessary for the execution of the whistleblower protection process may also be sought from the whistleblower; they will be provided in written form as a minimum.
- Special case: communication via the transmission of images/sound, see Article 6 (1)(1)(c) GDPR in conjunction with Section 16(3) and Section 11(3) and (4) HinSchG
If necessary, a declaration of consent to (telephone) communication via the transmission of images and sound (Section 16(3) HinSchG) (not sound recording) is to be sought and filed - Special case: reports made via telephone & production of sound recordings, Article 6(1)(1)(c) GDPR in conjunction with Section 11(2) HinSchG
If necessary, a declaration of consent to the production of a sound recording pursuant to Section 11(2) HinSchG - Special case: disclosure of information regarding the identity of the whistleblower to third parties on the basis of consent, see Article 6(1)(1)(c) GDPR in conjunction with Section 9(3)(2), (4)(1) HinSchG
If necessary, a declaration of consent to the disclosure of identity-related information pursuant to Section 9(3)(2) and (4)(1) HinSchG
- Special case: communication via the transmission of images/sound, see Article 6 (1)(1)(c) GDPR in conjunction with Section 16(3) and Section 11(3) and (4) HinSchG
- The scheduling of an appointment for an individual meeting with the whistleblowing officer, see Article 6(1)(1)(c) GDPR in conjunction with Section 16(3) HinSchG
If necessary, an individual appointment with the whistleblower will be arranged (via email/telephone) by the whistleblowing officer to enable a meeting.
- Documentation of receipt of reports and communication with the whistleblower, see Article 6(1)(1)(c) GDPR in conjunction with Section 11 and Section 17 HinSchG The following actions are undertaken so that any unlawful circumstances within the specific disclosure made to the internal reporting point or whistleblowing officer can be processed in an orderly fashion:
- the point in time at which the report is received will be documented and the whistleblower sent a confirmation of receipt, see Section 11(1) and Section 17(1)(1) HinSchG
- the point in time at which any necessary consent is granted by the whistleblower, and the content of the same, will be documented, see Section 11(1) HinSchG
- a (follow-up) appointment will be scheduled for an individual meeting, see Section 16(3) HinSchG
- the content of the report will also usually be documented by archiving the relevant email/written correspondence and, if necessary, by production of a summary/verbatim record, see Section 11(2)(3) HinSchG
- the agreement of the whistleblower to the contents of the record will be documented, see Section 11(4) HinSchG
- contact will be made with the whistleblower, see Section 17(1)(3) HinSchG
- further information will be sought from the whistleblower if applicable, see Section 17(1)(5) HinSchG
- Appraisal of the content of the report with reference to the objective scope of application of the HinSchG, see Article 6(1)(1)(c) GDPR in conjunction with Section 17(1)(2), (4) HinSchG
To enable any unlawful circumstances within the specific disclosure made to the internal reporting point or whistleblowing officer to be processed, the content of the report is initially reviewed with respect to the objective scope of application of the HinSchG and the validity of the report. This involves the personal data of the whistleblower and any potential ‘perpetrators’ being processed.
- Clarification of the issue & involvement of groups of individuals internal to the company, see Article 6(1)(1)(c) GDPR in conjunction with Section 9(4)(2) and Section 18(1) HinSchG
If necessary, the issue will be clarified internally with the involvement of any groups of individuals engaged in a potential breach, such as specialist departments and executive management.
- Clarification of the issue & involvement of groups of individuals internal to the company, see Article 6(1)(1)(c) GDPR in conjunction with Section 9(3)(2) HinSchG
If necessary, the issue will be clarified internally (and, by extension, information regarding the whistleblower’s identity will be disclosed) with the involvement of any groups of individuals engaged in a potential breach, such as specialist departments and executive management, taking into account the whistleblower’s consent.
- Clarification of the issue & involvement of groups of individuals internal to the company, see Article 6(1)(1)(c) GDPR in conjunction with Section 9(3)(1) HinSchG
In individual cases, investigating disclosures may necessitate the involvement of executive management or specialist departments and, by extension, the disclosure of information regarding the identity of the whistleblower, i.e. the processing of personal data.
- Implementation of follow-up measures & involvement of groups of individuals internal to the company, see Article 6(1)(1)(c) GDPR in conjunction with Section 9(3)(2), (4)(3) and Section 18(1) HinSchG
In individual cases, implementing follow-up measures in excess of merely investigating disclosures may necessitate the involvement of executive management or specialist departments and, by extension, the disclosure of information regarding the identity of the whistleblower, i.e. the processing of personal data.
- Disclosure of information on the basis of an official/judicial order, see Article 6(1)(1)(c) GDPR in conjunction with Section 9(2)(1–5) and (4)(4–8) HinSchG, & information on disclosure
In individual cases, information about the identity of the whistleblower may be disclosed to official bodies and the courts, i.e. public authorities, on request. In this case, the whistleblower may be informed of the disclosure and the reason for this in advance by the internal reporting point.
- Documentation of reports & conclusion of the process, see Article 6(1)(1)(c) GDPR in conjunction with Section 11 and Section 18(2) et seq. HinSchG
Furthermore, the content of the clarification will be documented (stored) by the internal reporting point (and only this body) in the interests of traceability. In particular, this applies to the whistleblower’s declarations of consent collected in the course of the clarification of the facts. In each case, a concluding set of instructions will be drawn up by the internal reporting point. They may include reference to the entity actually responsible, the cessation of internal investigations, handover to a different entity at the Controller, handover to the responsible authority and, if applicable, follow-up measures.
- Storage of reports in general, see Article 6(1)(1)(c) GDPR in conjunction with Section 11(5) HinSchG
The internal reporting point shall store information regarding reports received for at least three years from the date of their receipt.
4. Categories of personal data
- First name and surname
- Email address, if applicable
- Postal address, if applicable
- Telephone number, if applicable
- Mobile number, if applicable
- Time at which a report was received
- Time and content of the consent given pursuant to the HinSchG, if applicable
- Content of correspondence (in bullet points)
- Disclosure
- Content of notification received
- Content of any follow-up correspondence
- Content of a sound recording, if applicable
- Content of a verbatim record, if applicable
5. Obligation to provide personal data
Personal data must be provided for some disclosures to be clarified, but the provision of such data is voluntary. Failure to provide this data would mean we are unable to clarify a situation that has been reported.
6. Automated decision-making including profiling
The joint controllers do not carry out any profiling measures.
7. Data transfers to third countries
Data transfers to countries outside of the EU and the EEA (“third countries”) may take place in the context of the administration, development and operation of IT systems. Data will only be transferred in the following cases:
- the transfer is permissible because it satisfies the statutory requirements, or because you have consented to the data transfer; and
- the special requirements for transfers to third countries are met.
8. Recipients of data and data sources
8.1. Categories of data recipients
Data is not transferred to external third parties.
8.2. Data sources
We process personal data that we have received from you or a whistleblower as part of the whistleblowing process.
9. Duration of data storage
Personal data of relevance to whistleblower protection is stored for at least three years, pursuant to Section 11(5) HinSchG. Personal data may also be stored for the performance of activities that are in the public interest or related to the exercise of a public authority. Additionally, personal data may be stored for as long as legal interests are in the process of being exercised or defended. Individual documents will be stored for up to six years (in accordance with the Income Tax Act and Tax Code) or up to ten years (in accordance with the Commercial Code).
10. Rights of data subjects
Unless specified otherwise, the data processing falls under the responsibility of AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH, Birketweg 21, 80639 Munich, Germany, as joint controllers. You may, at any time, request information about the data stored about you by us and request the rectification of inaccurate data. You also have the right to restrict the data processing, the right to data portability in a machine-readable format, and the right to deletion of your data once it is no longer needed.
Furthermore, you have the right to object to the use of your data for purposes based on public or legitimate interests at any time. If we process your data on the basis of your consent,
you can revoke this consent at any time with future effect. We will stop processing your data for the purposes stated in the declaration of consent upon receipt of your revocation notice. Please send your revocation or objection notice to:
AVANTGARDE Experts GmbH & AVANTGARDE Talents GmbH
Birketweg 21
80639 Munich, Germany
Email: dp-experts(at)avantgarde-experts.de or dp-experts(at)avantgarde-talents.de
11. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority at any time. The authority responsible for us is: Bavarian State Office for Data Protection, PO Box 606, 91511 Ansbach, Germany. You may also contact your locally responsible supervisory authority.