PRIVACY POLICY CIRCULAR REPUBLIC

The use of our Internet pages is possible without any indication of personal data; however, if a data subject wants to use special enterprise services via our website, processing of personal data could become necessary. If the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain consent from the data subject. For this reason, every data subject is free to transfer personal data to us via alternative means, e.g. by telephone.

1. Definitions

This privacy policy is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). We use the following terms:

a. Personal data
Personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b. Data subject
Data subject is any identified or identifiable natural person, whose personal data is processed by the controller responsible for the processing.

c. Processing
Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d. Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of limiting their processing in the future.

e. Profiling
Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular, to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

f. Pseudonymisation
Pseudonymization is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

g. Controller
Controller is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

h. Processor
The processor is a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.

i. Recipient
The recipient is a natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

j. Third party
The third party is a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

k. Consent
Consent of the data subject is any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

2. Controller

Controller for the purposes of the General Data Protection Regulation (GDPR) is:

UnternehmerTUM GmbH
Lichtenbergerstr.6
85748 Garching bei München
Germany
+49 89 541 986 9800
Email: info@unternehmertum.de
www.unternehmertum.de

3. Data Protection Officer

Our Data Protection Officer is:

Alexander Stolberg-Stolberg
SVF Rechtsanwälte
Oberanger 30
80331 München
Deutschland
Phone: +49 89 210 25 120
Email: stolberg@unternehmertum.de
Website: www.svf-law.de

Any data subject may, at any time, contact our Data Protection Officer directly with all questions and suggestions concerning data protection.

4. Cookies

Our Internet pages use cookies. Cookies are text files that are stored in a computer system via an Internet browser.

Many Internet sites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a character string through which Internet pages and servers can be assigned to the specific Internet browser in which the cookie was stored. This allows visited Internet sites and servers to differentiate the individual browser of the data subject from other Internet browsers that contain other cookies. A specific Internet browser can be recognized and identified using the unique cookie ID.

Through the use of cookies, UnternehmerTUM GmbH can provide the users of this website with more user-friendly services that would not be possible without the cookie setting.

By means of a cookie, the information and offers on our website can be optimized with the user in mind. Cookies allow us, as previously mentioned, to recognize our website users. The purpose of this recognition is to make it easier for users to utilize our website. The website user that uses cookies e.g. does not have to enter access data each time the website is accessed, because this is taken over by the website, and the cookie is thus stored on the user's computer system. Another example is the cookie of a shopping cart in an online shop. The online store remembers the articles that a customer has placed in the virtual shopping cart via a cookie.

The data subject may, at any time, prevent the setting of cookies through our website by means of a corresponding setting of the Internet browser used, and may thus permanently deny the setting of cookies. Furthermore, already set cookies may be deleted at any time via an Internet browser or other software programs. This is possible in all popular Internet browsers. If the data subject deactivates the setting of cookies in the Internet browser used, not all functions of our website may be entirely usable.

5. Collection of general data

This website collects a series of general data and information when a data subject or automated system calls up the website. This general data and information are stored in the server log files. Collected may be

• the browser types and versions used,
• the operating system used by the accessing system,
• the website from which an accessing system reaches our website (so-called referrers),
• the sub-websites,
• the date and time of access to the Internet site,
• an Internet protocol address (IP address),
• the Internet service provider of the accessing system, and
• any other similar data and information that may be used in the event of attacks on our information technology systems.

When using these general data and information, UnternehmerTUM GmbH does not draw any conclusions about the data subject. Rather, this information is needed to

• deliver the content of our website correctly,
• optimize the content of our website as well as its advertisement,
• ensure the long-term viability of our information technology systems and website technology, and
• provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack.
  

Therefore, UnternehmerTUM GmbH analyzes anonymously collected data and information statistically, with the aim of increasing the data protection and data security of our enterprise and ensuring an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.

6. Subscription to our newsletters

see our Privacy Policy Newsletter

7. Contact via the website

Due to legal regulations, our website contains information that enables rapid electronic contact with our company and direct communication with us, which also includes a general address of the so-called electronic mail (e-mail address). If a data subject contacts the data controller by e-mail or via a contact form, the personal data transmitted by the data subject is automatically stored. Such personal data transmitted voluntarily by a data subject to the data controller are stored for the purposes of processing or contacting the data subject. This personal data will not be passed on to third parties.

8. Data protection for applications and in the application process

The controller collects and processes the personal data of applicants for the purpose of handling the application process. This involves processing personal data that the applicant has provided to UnternehmerTUM (CV, certificates, questionnaires, interviews, previous activities) or job-related information that the controller has obtained from publicly accessible sources (e.g. professional social media networks, website with application, etc.). This also includes information that is publicly accessible and contains job-related data, such as a profile on professional social media networks.

Processing may also be carried out electronically. This is particularly the case if an applicant submits relevant application documents to the controller by electronic means, for example by email.

If the controller concludes an employment contract with an applicant, the transmitted data will be stored for the purpose of processing the employment relationship in compliance with the statutory provisions. If the controller does not conclude an employment contract with the applicant, the application documents will be automatically deleted six months after notification of the rejection decision, unless deletion conflicts with any other legitimate interests of the controller.

Other legitimate interest in this sense is, for example, a burden of proof in proceedings under the General Equal Treatment Act (AGG).

9. Routine erasure and blocking of personal data

The data controller shall process and store the personal data of the data subject only for the period necessary to achieve the purpose of storage, or as far as this is granted by the European legislator or other legislators in laws or regulations to which the controller is subject to.
If the storage purpose is not applicable, or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with legal requirements.

10. Our Events/Photographies

We process the following personal data for the organization and implementation of "CIRCULAR REPUBLIC" events:

• Contact information (first and last name, title if applicable, your address given, telephone number if applicable, your email address).
• Information about your company or the organization you work for.
• Information about your position in your company or the organization you work for.
• It is possible that photos and videos will be taken of you at the event and published.
• We may also process your birthday and place of birth, e.g. for events that are subject to age restrictions or require a security check by a police authority.

We usually collect your data directly from you. In individual cases, we may receive data about you from the company or organization you work for so that we can invite you to one of our events. We process your contact details (name, postal address, email, etc.) to send you event invitations and to send you information by email in advance of our event.

Should you attend one of our events, we will process your personal data to organize and run the event and to enable you to participate smoothly. This may include including your personal details (first name, surname, and, where applicable, title) and professional position in a directory of attendees which is made available to other event attendees, presenters, or event staff (including electronically, where applicable).

As a rule, photos and/or video recordings are made at our events, some of which are published on our web pages and social media sites for internal and external reporting or in one of our newsletters, and may also be published together with your first name, surname and, if applicable, title and your professional position. Please note that in addition to the photo and video recordings in the cameras, metadata such as location, position, and time of recording are also automatically stored in the digital cameras. The legal basis for taking and storing photos and video recordings is Art. 6 para. 1 sentence 1 lit. f) DS-GVO based on our legitimate interest in reporting on the event. The legal basis for publishing the photos and video recordings are §§ 22, 23 of the German Art Copyright Act (KUG).

Please note that external reporters are also present at our events who also take photographs and video recordings. Unfortunately, we have no influence on these external reporters and on the photos and videos they take and how they are used. Therefore, we are unfortunately unable to provide any information on the purpose and scope of the processing of your data by these external reporters.

11. Pretix

Within our event offer, functions and contents of the service pretix, offered by:

rami.io GmbH
Berthold-Mogel-Straße 1
69126 Heidelberg
Germany

This includes the ticket shop, which is integrated via a JavaScript widget. When you buy a ticket, pretix uses a technically necessary cookie to enable the ordering process and to remember which shopping cart belongs to you. The cookie is set as soon as you interact with the widget. pretix does not store IP addresses, browser information, or other unnecessary metadata beyond the duration of your request. You can find more information about data protection at pretix here: pretix.eu/about/en/privacy

12. Rights of the data subject

Any person concerned shall have the following rights:

• for information pursuant to Article 15 GDPR
• to rectification under Article 16 GDPR
• to cancellation under Article 17 GDPR
• to limit the processing pursuant to Article 18 GDPR
• to appeal under Article 21 GDPR, and
• to data transferability under Article 20 GDPR.

The restrictions in §§ 34 and 35 BDSG apply to the right to information and the right to cancellation. In addition, there is a right of complaint of a competent data protection supervisory authority (Article 77 GDPR & 19 BDSG).

Please note that the revocation will only take effect in the future. Processing that took place before the revocation is not affected.

13. Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables an analysis of your use of our website.

By default, Google Analytics sets 4 cookies when you visit the website, which are stored as small text modules on your terminal device and collect certain information. The scope of this information also includes your IP address, which is, however, shortened by Google by the last digits in order to exclude a direct personal reference.
The information is transferred to Google servers and processed there. This may also involve transmission to Google LLC, which is based in the USA.

Google uses the information collected on our behalf to evaluate your use of the website, to compile reports on website activity for us and to provide other services associated with website and internet use. The IP address transmitted and shortened by your browser as part of Google Analytics will not be merged with other Google data. The data collected in the context of the use of Google Analytics 4 will be stored for a period of two months and then deleted.

All of the processing described above, in particular the setting of cookies on the end device used, only takes place if you have given us your express consent to do so in accordance with Art. 6 Para. 1 lit. a GDPR.

Without your consent, Google Analytics 4 will not be used during your visit to the site. You can revoke your consent at any time with effect for the future. To exercise your right of revocation, please deactivate this service via the "Cookie Consent Tool" provided on the website.
We have concluded an order processing agreement with Google, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

Further legal information on Google Analytics 4 can be found here:
https://policies.google.com/pr...
https://policies.google.com/te...

Google Analytics 4 uses the special "demographic characteristics" function and can use this to create statistics that make statements about the age, gender, and interests of site visitors. This is done by analyzing advertising and information from third-party providers. This allows target groups to be identified for marketing activities. However, the collected data cannot be assigned to a specific person and is deleted after being stored for a period of two months.

As an extension to Google Analytics 4, Google Signals can be used on this website to generate cross-device reports. If you have activated personalized ads and linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics pursuant to Art. 6 (1) lit. a GDPR, analyze your usage behavior across devices and create database models, including on cross-device conversions. We do not receive any personal data from Google, only statistics. If you would like to stop the cross-device analysis, you can deactivate the "Personalised advertising" function in the settings of your Google account. To do so, follow the instructions on this page: https://support.google.com/ads... 

You can find more information about Google Signals at the following link: https://support.google.com/ana...

As an extension to Google Analytics 4, the "UserIDs" function can be used on this website. If you have consented to the use of Google Analytics 4 pursuant to Art. 6 (1) lit. a GDPR, have set up an account on this website and log in with this account on various devices, your activities, including conversions, can be analyzed across devices.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

14. LinkedIn

With your consent, we activate a cookie from LinkedIn when you visit our website (LinkedIn Ireland, Wilton Plaza, Wilton Place, Dublin 2, Ireland).
The tag reports to LinkedIn which actions you have performed on our website and possibly identifying data.

With the data, LinkedIn can recognize that you have visited our website, what you have clicked on and if you have clicked on a link on LinkedIn that connects you to our website. This allows LinkedIn to show you interest-based content. LinkedIn may associate this data with your user account and use it for its own purposes. The processing of your data by LinkedIn is explained in the data protection information at https://www.linkedin.com/legal....

We do not receive any data about you or other users from LinkedIn, but only statistics that show us, aggregated for all users in a certain period, how they have used our offers and advertisements on other LinkedIn platforms. This helps us to analyze which of our ads were successful and which were not.

15. Legal basis

Art. 6(1) lit. a GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, when processing operations are necessary for the supply of goods or to provide any other service, the processing is based on Article 6(1) lit. b GDPR. The same applies to such processing operations which are necessary for carrying out pre-contractual measures, for example in the case of inquiries concerning our products or services. Is our company subject to a legal obligation by which processing of personal data is required, such as for the fulfillment of tax obligations, the processing is based on Art. 6(1) lit. c GDPR. Finally, processing operations could be based on Article 6(1) lit. f GDPR. This legal basis is used for processing operations which are not covered by any of the abovementioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Such processing operations are particularly permissible because they have been specifically mentioned by the European legislator. He considered that a legitimate interest could be assumed if the data subject is a client of the controller (Recital 47 Sentence 2 GDPR).

Where the processing of personal data is based on Article 6(1) lit. f GDPR our legitimate interest is to carry out our business in favor of the well-being of all our employees and the shareholders.

16. Period for which the personal data will be stored

The criteria used to determine the period of storage of personal data is the respective statutory retention period. After expiration of that period, the corresponding data is routinely deleted, as long as it is no longer necessary for the fulfillment of the contract or the initiation of a contract.

17. Provision of personal data as statutory or contractual requirement; Requirement necessary to enter into a contract; Obligation of the data subject to provide the personal data; possible consequences of failure to provide such data

We clarify that the provision of personal data is partly required by law (e.g. tax regulations) or can also result from contractual provisions (e.g. information on the contractual partner). Sometimes it may be necessary to conclude a contract that the data subject provides us with personal data, which must subsequently be processed by us. The data subject is, for example, obliged to provide us with personal data when our company signs a contract with him or her. The non-provision of the personal data would have the consequence that the contract with the data subject could not be concluded. Before personal data is provided by the data subject, the data subject must contact our Data Protection Officer. Our Data Protection Officer clarifies to the data subject whether the provision of the personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data and the consequences of non-provision of the personal data.

18. General Privacy Policy of UnternehmerTUM

Additional information on the processing of your personal data can be found in the privacy policy of UnternehmerTUM GmbH: https://www.unternehmertum.de/...

01.08.2024