Privacy policy/cookies

The protection of your privacy when using our websites is important to us. We therefore act in accordance with the applicable legislation on the protection of personal data and data security.

1. controller

The controller pursuant to Art. 4 (7) EU General Data Protection Regulation (GDPR) is MOSAIQ GmbH, represented by the managing directors Sebastian Bosch and Glenn Kusardi, Urbanstraße 1, 70182 Stuttgart, Germany, (hereinafter "company" or "we"), telephone 0711 / 839 48 48 - 30, fax 0711 / 839 48 48 - 99, e-mail: welcome@mosaiq.com. You can contact our data protection officer at datenschutz@mosaiq.com or our postal address with the addition "For the attention of the data protection officer".

2. Information on the collection of personal data

In the following, we inform you about the collection of personal data when using our website and other data processing. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses or user behavior.

If we use contracted service providers for individual functions of our offer or would like to use your data for advertising purposes, we will inform you in detail below about the respective processes. We will also state the specified criteria for the storage period. Your personal data will only be passed on to third parties if this is necessary in accordance with Art. 6 Para. 1 S. 1 lit. b GDPR for the processing of individual user relationships with you, if we can demonstrate a so-called legitimate interest in accordance with Art. 6 Para. 1 S. 1 lit. f GDPR or if you have given your consent to this in accordance with Art. 6 Para. 1 S. 1 lit. a GDPR. Otherwise, your personal data will not be transferred to third parties.

Unless otherwise specified in our privacy policy for the respective processing of personal data, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and the deletion does not conflict with any statutory retention obligations. If the data of the data subject are not deleted because they are required for other and legally permissible purposes, their processing will be restricted. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data of the data subject that must be retained for commercial or tax law reasons (six years in accordance with Section 257 (1) HGB and ten years in accordance with Section 147 (1) AO).

3. Collection of personal data when visiting our website

3.1. Informational use of the website

In the case of purely informational use of the website, i.e. if you do not transmit information to us in any other way, we and our host provider only collect the personal data that your browser transmits to our server / the server of our host. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security (legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR):

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred
• Website from which the request originates
• Operating system and its interface
• Language and version of the browser software.

The data is stored for a period of fourteen days and then deleted.

In order to provide our website, we also use the services of so-called web hosts, on whose servers our online offer is accessed. This enables us to guarantee optimized technical and secure provision of our online offering. We use Amazon Web Services, i.e. web hosting and associated services from the provider Amazon Web Services, Inc, 410 Terry Avenue North, Seattle WA 98109, USA. Further information on the purpose and scope of data collection and its processing by the provider can be found in the provider's privacy policy. Amazon Web Services also processes your personal data in the USA and has submitted to the EU-US Privacy Shield. The legal basis for the use of Amazon Web Services is Art. 6 para. 1 sentence 1 lit. f GDPR.

3.2 Cookies and tracking

In addition to the aforementioned data, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard disk assigned to the browser you are using and through which certain information flows to the location that sets the cookie. Cookies cannot execute programs or transfer viruses to your computer. They are used to make the website more user-friendly and effective overall. By means of a cookie, the information and offers on our website can be optimized for the benefit of the user. Cookies enable us to recognize the users of our website. The purpose of this recognition is to make it easier for users to use our website. The legal basis for the use of cookies is Art. 6 para. 1 sentence 1 lit. f GDPR, unless we have asked you separately for your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

This website uses the following types of cookies, the scope and function of which are explained below:

• Transient cookies
• Persistent cookies.

Transient cookies are automatically deleted when you close the browser. These include session cookies in particular. These store a so-called session ID, with which various requests from your browser can be assigned to the shared session. This allows your computer to be recognized when you return to our website. The session cookies are deleted when you log out or close the browser.

Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete the cookies in the security settings of your browser at any time.

General information on revocation / rejection of cookie use ("opt-out")

You can configure your browser settings according to your wishes and, for example, refuse to accept third-party cookies or all cookies. The procedure for managing and deleting cookies can be found in the help function of your browser. We would like to point out that you may not be able to use all functions of this website.

You can also object to the use of cookies from various providers on the websites https://optout.aboutads.info and https://www.youronlinechoices.com/. In addition, we will inform you separately about the objection options of individual providers used here.

3.3 Google Tag Manager

This website also uses the "Google Tag Manager". This service from Google Inc. (see above) enables us to manage so-called website tags via an interface. The "Google Tag Manager" itself only implements website tags without using cookies, collecting other personal data or accessing such data. The service only triggers other website tags, which may themselves collect data. If a deactivation has been made by a user at domain or cookie level, this remains in place for all tracking tags that are implemented with "Google Tag Manager".

3.4 Social media

We currently use the following social media links: Facebook, Twitter and Instagram. We use the so-called two-click solution. This means that when you visit our website, no personal data is initially passed on to these platforms. You can recognize the social media platforms by their correspondingly named link or logo. We give you the opportunity to communicate directly with these platforms via the button. Only if you click on the marked field and thereby activate it will these platforms receive the information that you have accessed the corresponding website of our online offering. In addition, the data mentioned in section 3.1. of this declaration will apparently be transmitted. According to these platforms, in Germany the IP address is anonymized immediately after collection. By activating the link, your personal data is therefore transmitted to these platforms and also stored outside the EU, including in the USA. As the platforms collect data in particular via cookies, we recommend that you delete all cookies via your browser's security settings before clicking on the link.

We have no influence on the data collected and data processing operations, nor are we aware of the full extent of data collection, the purposes of processing or the storage periods. We also have no information on the deletion of the data collected by Facebook and Instagram.

These platforms store the data collected about you as user profiles and use them for the purposes of advertising, market research and/or the needs-based design of their website. Such an evaluation is carried out in particular (even for users who are not logged in) to display needs-based advertising and to inform other users of the social network about your activities on our website. You have a right to object to the creation of these user profiles, whereby you must contact the respective platform to exercise this right. We offer you the opportunity to interact with the social network and other users via the links so that we can improve our offering and make it more interesting for you as a user. The legal basis for the use of the links is Art. 6 para. 1 sentence 1 lit. f GDPR.

The data is passed on regardless of whether you have an account with the respective platform and are logged in there. If you are logged in there, your data collected by us will be assigned directly to your existing account there. If you click the activated button and, for example, link the page, the respective platform will also store this information in your user account and may share it publicly with your contacts. We recommend that you log out regularly after using a social network, but especially before activating the button, as this will prevent you from being assigned to your profile on the respective platform.

We are also present on the social networks Facebook, Instagram and Twitter themselves. If you contact us on these channels, write posts or interact with our posts, we process the data you provide there in order to answer your inquiries or inform you about our services and offers. If we collect further data from you, we will inform you separately about its scope and use. The legal basis is Art. 6 para. 1 sentence 1 lit. b and f GDPR, unless we obtain separate consent from you for the data processing.

In these cases, too, we have no influence on the data collected and data processing operations by Facebook, Instagram and Twitter themselves, nor are we aware of the full extent of the data collection, the purposes of the processing or the storage periods. We also have no information on the deletion of the data collected by Facebook, Instagram and Twitter.

Further information on the purpose and scope of data collection and its processing by Facebook, Instagram and Twitter can be found in the privacy policies provided below. There you will also find further information on your rights in this regard and setting options to protect your privacy. Address and URL with privacy policy:

The Instagram service is a Facebook product provided by Facebook Ireland Limited: Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, Facebook Ireland Limited is a company registered under Irish law. Commercial register number: 462932, impressum@support.instagram.com, Fax: +1 650 543 5340. https://help.instagram.com/519522125107875. Privacy Policy of Instagram

Facebook Inc, 1601 S California Ave, Palo Alto, California 94304, USA; http://www.facebook.com/policy.php; further information on data collection: http://www.facebook.com/help/186325668085084, http://www.facebook.com/about/privacy/your-info-on-other#applications and http://www.facebook.com/about/privacy/your-info#everyoneinfo as well as through the joint agreement on personal data provided by Facebook there.
Facebook has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework, https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active.

Twitter, Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA; https://twitter.com/privacy. Twitter has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework, https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active.

3.5 Integration of YouTube videos

We have integrated YouTube videos into our online offering, which are stored on http://www.YouTube.com and can be played directly from our website. These are all integrated in "extended data protection mode", i.e. no data about you as a user is transferred to YouTube if you do not play the videos. Only when you play the videos will the data mentioned in paragraph 2 be transmitted. We have no influence on this data transfer. When you visit the website, YouTube receives the information that you have accessed the corresponding subpage of our website. In addition, the data mentioned under section 3.1. of this declaration is transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your YouTube profile, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right.

Further information on the purpose and scope of data collection and its processing by YouTube can be found in the privacy policy. There you will also find further information on your rights and setting options to protect your privacy: https://www.google.de/intl/de/policies/privacy. YouTube also processes your personal data in the USA and has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of YouTube is Art. 6 para. 1 sentence 1 lit. f GDPR.

4. Newsletter registration and consent

You can register for our newsletter directly on our website. We only send our newsletter with promotional information by email on a quarterly basis with the consent of the recipient or legal permission. The content of the newsletter will be specified to you when you register. Our newsletters also contain information from the areas of agency, marketing, design & creative, social media and other projects from our company. By subscribing to our newsletter, you consent to receiving it and to the procedures described; the legal basis is therefore Art. 6 para. 1 sentence 1 lit. a GDPR. The legal basis for sending the newsletter as a result of the sale of goods or services is Section 7 (3) UWG.

The registration for our newsletter takes place in a so-called double opt-in procedure, i.e. your registration is only complete if you have previously confirmed your registration via a confirmation e-mail sent to you for this purpose by clicking on the link contained therein. If you do not confirm this, your registration will be automatically deactivated in our database and deleted at the latest after the statutory retention periods. Subscriptions to the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation as well as the IP address. The only mandatory information for sending the newsletter is your e-mail address. The purpose of collecting your e-mail address is to send you the newsletter. This data is deleted as soon as it is no longer required for the purpose for which it was collected. Your email address will therefore be stored for as long as your subscription to the newsletter is active.

We send our newsletter with the help of the service provider "CleverReach" to ensure an optimized dispatch and presentation of our newsletter. This is an email marketing service provided by the operator CleverReach GmbH & Co. KG, //CRASH Building, Schafjückenweg 2, 26180 Rastede, Germany. Information on the purpose and scope of data collection and its processing by CleverReach can be found in the privacy policy of the service provider. The legal basis for the use of CleverReach is Art. 6 para. 1 sentence 1 lit. f GDPR.

Option to object and removal

You can unsubscribe from the newsletter at any time. For this purpose, there is a corresponding unsubscribe link in every newsletter. This is also possible by e-mail or in writing to the contact details given above.

5. Contacting us

When you contact us by e-mail, the data you provide (your name, your e-mail address, possibly your address, your telephone number) will be stored by us in order to answer your inquiries. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR. We delete the data arising in this context after storage is no longer necessary or restrict processing if there are statutory retention obligations.

6. Data processing in the context of customer relationships

We also process various data of our existing and future customers as well as service providers, suppliers and third parties involved (in particular contact details, bank details and order-related data) in accordance with Art. 6 para. 1 lit. b. GDPR in order to provide you with our contractual services. GDPR in order to provide you with our contractual or pre-contractual services, unless we make separate reference to further uses. The required scope, type and duration of processing depend on the underlying purpose of the respective contractual relationship. Data will only be passed on to third parties if this is necessary to fulfill our contractual obligations and to process the contract or if we are legally obliged to do so, e.g. by authorities.

Unless otherwise agreed with our customers, we delete the data collected in this context after storage is no longer necessary, usually after the expiry of contractual or legal claims by us or our customers, or restrict processing if there are statutory retention obligations.

To prevent unauthorized access to your personal data by third parties, we encrypt our website using TLS technology.

7. Data processing as part of your application

By sending us your application documents, you provide us with a range of personal data that is particularly protected by law.

We process personal data about you for the purpose of your application for an employment relationship, insofar as this is necessary for the decision on the establishment of an employment relationship with us. The legal basis for this is § 26 para. 1 in conjunction with. para. 8 sentence 2 BDSG (new). As part of the review of your application, we may call you, write to you or contact you by e-mail if there are any questions and you have provided your contact details for this purpose. Furthermore, we may process personal data about you if this is necessary to defend against legal claims asserted against us in the application process. The legal basis is then Art. 6 para. 1 lit. f GDPR. If there is an employment relationship between you and us, we may process the personal data already received from you for the purposes of the employment relationship in accordance with Section 26 (1) BDSG (new) if this is necessary for the performance or termination of the employment relationship or for the exercise or fulfillment of the rights and obligations of the representation of employees' interests arising from a law.

You are neither legally nor contractually obliged to provide personal data. However, the provision of personal data is necessary for the conclusion of a contract of employment with us.

We process data in connection with your application. This may be general personal data (such as name, address and contact details), information about your professional qualifications and schooling or information about further professional training or other information that you provide to us in connection with your application. We may also process job-related information that you have made publicly available, such as a profile on professional social media networks. The employees commissioned with this are obliged to maintain confidentiality and data secrecy in accordance with Art. 5 para. 1 GDPR. We do not pass on your data to third parties.

The data you send us will initially only be processed and stored during the processing of the evaluation and deleted after completion of the evaluation if it is no longer required. The latter is the case, for example, if we come to the conclusion based on your applicant profile that your application could be of interest at a later date; in this case, we initially store your data for 6 months so that we can contact you again at a later date. If an employment relationship is not established between you and us, we may also continue to store data if this is necessary to defend against possible legal claims.

Right to information and deletion of application data

On request, we will provide you with information about what data we have stored about you. If you no longer wish us to store your data, you can inform us of this before the expiry of the aforementioned storage and deletion periods; we will then delete your data immediately. To do so, you can contact us using the contact details above.

8. Your rights

With regard to the personal data concerning you, you have the right to:

• withdraw any consent you have given us at any time in accordance with Art. 7 para. 3 GDPR. As a result, we may no longer continue the data processing based on this consent in the future;
• to request information about your personal data processed by us in accordance with Art. 15 GDPR. In particular, you can request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information about the details of this.
• in accordance with Art. 16 GDPR, to demand the rectification of inaccurate personal data or the completion of incomplete personal data stored by us without undue delay;
• in accordance with Art. 17 GDPR, to demand the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims;
• in accordance with Art. 18 GDPR, to demand the restriction of the processing of your personal data if the accuracy of the data is contested by you, the processing is unlawful but you oppose the erasure of the data and we no longer need the data, but you require it for the establishment, exercise or defense of legal claims or you have objected to processing pursuant to Art. 21 GDPR and
• in accordance with Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller.

In addition to the objection options already described, you can contact us using the contact options listed above if you wish to exercise your rights as a data subject, in particular your right to object.

You also have the right to complain to a data protection supervisory authority (Baden-Württemberg) about the processing of your personal data by us.

Information about your right to object in accordance with Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) GDPR (data processing in the public interest) and Article 6(1)(f) GDPR (data processing on the basis of a balancing of interests); this also applies to profiling based on this provision of Article 4 no. 4 GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

If your objection is directed against the processing of data for the purpose of direct marketing, we will cease processing immediately. In this case, it is not necessary to specify a particular situation. This also applies to profiling insofar as it is associated with such direct advertising.

If you wish to exercise your right to object, simply send an email to datenschutz@mosaiq.com.