Privacy at AKRA

1. responsible person

Responsible for these web pages is

AKRA GmbH
Domstraße 17
20095 Hamburg

Further information about our company and the persons authorized to represent it can be found in our imprint.

2. legal basis of data processing

In order to be able to offer you our website and the associated services, we process personal data on the basis of the following legal grounds:

• Consent (Art. 6 para. 1 lit. a) DSGVO).
• for the fulfillment of contracts (Art. 6 para. 1 lit. b) DSGVO)
• on the basis of a consideration of interests (Art. 6 para. 1 lit. f) DSGVO)
• for the fulfillment of a legal obligation (Art. 6 para. 1 lit. c) DSGVO).

We will refer to the relevant terminology in connection with the respective processing so that you can classify on which basis we process personal data.

If personal data is processed on the basis of your consent, you have the right to revoke your consent at any time with effect for the future.

If we process data on the basis of a balance of interests, you as the data subject have the right to object to the processing of the personal data, taking into account the requirements of Art. 21 DSGVO.

3. What data is processed?

3.1 Access data

When you visit our websites, personal data is processed in order to display the contents of the website on your terminal device.

In order for the pages to be displayed in your browser, the IP address of the terminal device you are using must be processed. In addition, there is further information about the browser of your end device.

We are required by data protection law to also ensure the confidentiality and integrity of the personal data processed with our IT systems.

For this purpose and out of this interest, the following data is logged on the basis of a balancing of interests pursuant to Art. 6 (1) f) DSGVO:

• IP address of the calling computer (for a maximum of 7 days)
• Operating system of the calling computer
• Browser version of the calling computer
• Name of the retrieved file
• Date and time of the retrieval
• Amount of data transferred
• referring URL

The IP address is deleted after 7 days at the latest from all systems used in connection with the operation of these web pages. We can then no longer establish a personal reference from the remaining data.

Our interest in processing is to be able to avert possible dangers to the website, but also to be able to identify and correct errors on the web pages.

3.2 Contact form

We offer a contact form on our website, which you can use to request information about our products or services or to contact us in general. We have marked the data that you are required to enter in order to respond to a request as mandatory fields. Information on other data fields is voluntary.

We need this information to process your request, to address you correctly and to send you a reply. In the case of specific inquiries, data processing is carried out for the fulfillment of a contract or the initiation of a contract in accordance with Art. 6 Para. 1 lit. b) DSGVO. In the case of general inquiries, processing is carried out on the basis of a balancing of interests pursuant to Art. 6 (1) f) DSGVO.

Inquiries received via the contact form on our website are processed by us via e-mail in order to answer your inquiry. In this context, other persons or departments and possibly third parties may also become aware of the form content that you have sent.

The form data is transmitted via the Internet using encrypted connections.

3.3 Application

We are pleased that you are interested in us and want to apply or have applied for a position in our company. In the following, we would like to provide you with information on the processing of your personal data in connection with the application.

We process the data that you have sent us in connection with your application in order to check your suitability for the position (or, if applicable, other open positions in our companies) and to carry out the application process.

The legal basis for the processing of your personal data in this application procedure is primarily Section 26 of the German Federal Data Protection Act (BDSG) in the version applicable as of 25.05.2018 in conjunction with Article 6 (1) lit. b) DSGVO. According to this, the processing of data required in connection with the decision on the establishment of an employment relationship is permissible.

Should the data be required for legal prosecution after the conclusion of the application process, if applicable, data processing may be carried out on the basis of the requirements of Art. 6 DSGVO, in particular to safeguard legitimate interests pursuant to Art. 6 (1) (f) DSGVO. Our interest then consists of legal prosecution.

Data of applicants will be deleted after 6 months in case of rejection.

In the event that you have consented to the further storage of your personal data by means of consent in accordance with Art. 6 Para. 1 lit. a) DSGVO, we will transfer your data to our applicant pool. There, the data will be deleted after two years.

If you are awarded a position during the application process, the data will be transferred from the applicant data system to our HR information system.

Your applicant data will be viewed by the HR department after receipt of your application. Suitable applications are then forwarded internally to the department managers responsible for the respective open position. Then the further procedure is coordinated. In principle, only those persons in the company have access to your data who require it for the proper conduct of our application process.

3.4 Cookies

No cookies are used on our websites.

3.5 Analysis services for websites, tracking

**Plausible.io

We use the web analytics tool "Plausible" on our website to understand and improve the use of our website. This tool is installed on our own servers. No personal data is collected in connection with the tool. Thus, no cookies are set or other information is stored in the browser.
You can find more information about the provider at: Plausible Insights OÜ, Västriku tn 2, 50403, Tartu, Estonia. https://plausible.io/. Privacy notices: https://plausible.io/data-policy

4. purposes of processing personal data

We process the aforementioned data for the operation of our website and for the fulfillment of contractual obligations to our customers or the protection of our legitimate interests.

In the case of inquiries from you outside of an active customer relationship, we process the data for the purposes of sales and advertising. You can object to the use of your personal data for advertising purposes at any time.

5. links to social networks

On our website, we link to the presences in the social networks (Facebook, Twitter, XING and LinkedIn).

If you visit these sites, your personal data will be processed by the respective providers. The providers of Facebook and LinkedIn are based in the USA, which means that your data is transferred to a third country. If you do not wish this to happen, please remain on this website.

In the following, we provide you with data protection notices, insofar as it is a joint processing of your data with the providers of the social networks.

5.1 Facebook

Insofar as you visit the website of Facebook and there specifically our offer, it applies that in principle Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland), as a subsidiary of Meta Inc. from the USA, is responsible for the processing of personal data of the Facebook page.

With regard to individual phases of the processing - here specifically the so-called "Insights" function - we are jointly responsible with Facebook. In this respect, we have reached an agreement with Facebook on joint responsibility, the content of which you can view here.

We operate the Facebook page to draw attention to our services and products and to contact you as a visitor and user of this Facebook page.
We have no interest in collecting and further processing your individual personal data for analysis or marketing purposes.

The operation of this Facebook page including the processing of users' personal data is based on our legitimate interests (Art. 6 para. 1 lit. f. DSGVO) in a timely and supportive information and interaction opportunity for and with our users and visitors.

The transfer of data for the purpose of processing may take place to service providers and vicarious agents employed by us. Provided that these comply with the applicable legal provisions. To this end, we have concluded corresponding contractual agreements with these parties regarding data protection.

We will only pass on your personal data to other recipients if this is required by law, if you have given your consent or if we are authorized to pass it on. If these requirements are met, recipients of personal data may include public bodies and institutions (e.g. law enforcement agencies).

Processing of personal data by Facebook

Facebook uses cookies, i.e. small text files that are stored on the various end devices of the user, to store and further process this information. If the user has a Facebook profile and is logged in to it, the storage and analysis also takes place across devices.

Facebook's privacy policy contains further information on data processing: https://www.facebook.com/about/privacy/.
Opt-out options can be set here: https://www.facebook.com/settings?tab=ads.

Facebook Inc, the US parent company of Facebook Ireland Ltd, is based in the USA. This means that data may be transferred to a third country. The conditions for this can be found at https://www.facebook.com/legal/terms/dataprocessing/update.

For legal protection, Facebook has issued so-called standard contractual clauses in addition. Further information is available at: https://www.facebook.com/legal/EU_data_transfer_addendum.

The transmission and further processing of personal data of users to third countries, such as the USA, as well as the associated possible risks for users cannot be excluded by us as the operator of the site.

Information on the use of the Site Insights as well as the agreement on joint data processing can be found at https://www.facebook.com/legal/terms/page_controller_addendum.

Statistical data Via the so-called "Insights" of the Facebook page, statistical data of different categories can be accessed by us. These statistics are generated and provided by Facebook. As the operator of the site, we have no influence on the generation and presentation. We cannot turn off this function or prevent the generation and processing of the data. For a selectable period of time as well as for the categories fans, subscribers, reached persons and interacting persons, the following data is provided to us by Facebook in relation to our Facebook page:

Total number of page views, "Like" comments, page activities, post interactions, reach, video views, post reach, comments, shared content, responses, proportion of men and women, origin based on country and city, language, calls and clicks in the store, clicks on route planners, clicks on phone numbers. Data on the Facebook groups linked to our Facebook page is also provided in this way. Due to the constant development of Facebook, the availability and processing of the data changes, so that we refer to the aforementioned privacy policy of Facebook for further details.

We use this data, which is available in aggregated form, to make our posts and activities on our Facebook page more attractive to users. For example, we use the distributions by age and gender for an adapted address and the preferred visiting times of the users for a time-optimized planning of our posts. Information about the type of end devices used by visitors helps us to adapt the visual design of the posts accordingly. In accordance with the Facebook Terms of Use, which each user has agreed to as part of creating a Facebook profile, we can identify subscribers and fans of the site and view their profiles and other shared information from them.

User rights

Since only Facebook has full access to user data, we recommend that you contact Facebook directly with any requests for information or other questions about your rights as a user (e.g., right to deletion). If you need assistance with this or have any other questions, please feel free to contact us by email at datenschutz@akra.de. If you no longer wish to have the data processing described here in the future, please cancel the connection of your user profile to our site by using the functions "I no longer like this page" and/or "Do not subscribe to this page anymore."

5.2 Twitter

You also have the option of sharing our content on the social network Twitter, Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA.

When you click on the "Re-Tweet" button, the web pages you visit are linked to your Twitter account and made known to other users. In the process, data is also transferred to Twitter. Details on how your data is handled by Twitter as well as your rights and settings options for protecting your personal data can be found in Twitter's privacy policy: https://twitter.com/de/privacy

5.3 Xing

You also have the option of sharing our content on the social network of XING AG, Dammtorstraße 30, 20354 Hamburg Germany.

A storage of personal data of you about the call of this website is not made thereby. In particular, no IP addresses are stored by XING. Nor will your usage behavior be evaluated. You can read the current information on data protection with regard to the "Share Button" as well as other relevant information here: https://dev.xing.com/plugins/share_button/privacy_policy

5.4 LinkedIn

You also have the option of sharing our content on the social network LinkedIn, of LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043.

When you click on the LinkedIn button, the web pages you visit are linked to your LinkedIn account and disclosed to other users. In the process, data is also transferred to LinkedIn. Details on the collection of data and your legal options as well as setting options can be found here: https://www.linkedin.com/legal/privacy-policy

5.5 Instagram

We operate an Instagram page that you can follow on the operator platform itself. The operator is the company Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA 94025, USA. The Instagram service is one of the Facebook products provided by Facebook Ireland Limited.

If you click on the "Follow" button of our Instagram page, it will be apparent to the responsible parties and all other Instagram users that you are a fan of our page. As long as you are logged into your Instagram account and visit our Instagram profile, Facebook can associate this with your Instagram profile. We expressly point out that Facebook stores the data of its users (e.g. personal information, IP address, etc.) and may also use this for business purposes. If you would like to avoid Facebook processing personal data that you have transmitted to us, please contact us by other means. You can find more information about Facebook's data processing in Facebook's privacy policy at https://help.instagram.com/519522125107875 .

Insofar as the data you provide to us via Facebook is also or exclusively processed by Facebook (Insights data), we are joint data controllers within the meaning of the GDPR with Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The associated data processing takes place on the basis of an agreement between joint controllers pursuant to Art. 26 DSGVO, which you can view here: www.facebook.com/legal/terms/page_controller_addendum .

You can contact Facebook's data protection officer via the online form at https://www.facebook.com/help/contact/540977946302970.
Facebook provides us with so-called page insights for our Instagram page: https://help.instagram.com/788388387972460?helpref=related&ref=related .

This is aggregated data that allows us to learn how people interact with our page. Page Insights may be based on personal data collected in connection with an individual's visit to or interaction with our Site and its content.

You can object to the processing of your data for the aforementioned purposes at any time by changing your settings in your Instagram user account at https://www.instagram.com/accounts/privacy_and_security/ accordingly.

We operate our Instagram page within the framework of the balance of interests pursuant to Article 6(1) f) DSGVO in order to present ourselves to and communicate with Instagram users and other interested persons. The processing of users' personal data is based on our legitimate interest in an optimized company presentation.

6. voluntary information

Insofar as you voluntarily provide data to us, e.g. in forms, and these are not required for the fulfillment of our contractual obligations, we process this data on the legitimate assumption that the processing and use of this data is in your interest.

7. passing on of data

Data that you provide to us will generally not be disclosed to third parties, with the exceptions mentioned above. In particular, your data will not be disclosed to third parties for their advertising purposes.

However, we may use service providers for the operation of this website or for other products or services of ours. Here it may happen that a service provider obtains knowledge of personal data We select our service providers carefully - especially with regard to data protection and data security - and take all measures required by data protection law for permissible data processing.

8. data processing outside the european union

Insofar as personal data is processed outside the European Union, you can find this in the previous explanations.

9. data protection officer

We have appointed a data protection officer. You can reach him as follows:

B³ | Information Technology
Dipl. Inf. (FH) Andreas Bethke
Papenbergallee 34
25548 Kellinghusen
E-mail: datenschutz@akra.de
http://www.b3-unternehmensgruppe.de/

10. your rights as a data subject

You have the right to obtain information about the personal data concerning you. You can contact us for information at any time.

In the case of a request for information that is not made in writing, we ask for your understanding that we may require proof from you that you are the person you claim to be.

Furthermore, you have a right to rectification or deletion or to restriction of processing, insofar as you are entitled to this by law.

Finally, you have a right to object to processing within the scope of the law. The same applies to a right to data portability.

Deletion of data

We generally delete personal data when there is no need for further storage. A requirement may exist in particular if the data is still needed to fulfill contractual services, to check and grant or defend against warranty and, if applicable, guarantee claims. In the case of statutory retention obligations, deletion will only be considered after expiry of the respective retention obligation.

Right of complaint to a supervisory authority

You have the right to complain about the processing of personal data by us to a supervisory authority for data protection.

11. amendment of this data protection notice

We revise this data protection notice when changes are made to this website or on other occasions that make this necessary. You will always find the current version on this website.

Status: 08.11.2021