Privacy policy

Controller

The controller responsible for the processing of personal data on this website is:

Data protection officer

You can reach our data protection officer at the email address dsb@friedrich-joerg.com.

Principles

You can use this website without providing any personal data. We only collect data where you actively submit it to us — for example via the contact form or the application form — and to the technically unavoidable extent that the operation of a website entails.

We only set cookies for marketing purposes and only load external content after you have given your express consent. You decide on this separately for each service and can change your selection at any time via the privacy settings in the page footer.

Hosting

The operation and technical support of this website are carried out on our behalf by sorum GmbH, Bahnhofstraße 27, 34346 Hann. Münden. A data processing agreement pursuant to Art. 28 GDPR is in place with sorum GmbH. For hosting and email delivery, sorum GmbH uses the services Vercel and Resend, named below, as sub-processors.

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA.

Server-side processing — in particular the receipt of contact and project enquiries and of applications — takes place in a data centre of the provider in Frankfurt am Main. The provider delivers static content such as pages, images and fonts via its worldwide server network; your request is usually answered by a server near you. We describe which connection data is generated in this process under “Server log files”.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of this website. A data processing agreement pursuant to Art. 28 GDPR is in place between the provider and sorum GmbH.

As the provider is based in the USA, access to data from the USA cannot be ruled out. The provider is certified under the EU-US Data Privacy Framework; the transfer is therefore based on the adequacy decision of the European Commission pursuant to Art. 45 GDPR and, additionally, on the standard contractual clauses agreed with the provider.

Further information can be found in Vercel’s privacy policy at https://vercel.com/legal/privacy-policy.

Server log files

When you access this website, information transmitted by your browser is recorded automatically: the address accessed, the date and time of access, the amount of data transferred, the status message, the browser type and version used, the operating system, the previously visited page and the IP address.

We do not combine this data with other data sources and process it on the basis of Art. 6(1)(f) GDPR in order to deliver the website and to detect and defend against technical faults and abusive access. The logs of our hosting provider are deleted after one day.

Contact and project enquiries

If you contact us via the contact form, by email or by telephone, we process the information you provide in order to answer your enquiry. Via the form, this comprises: name, company, email address, optionally telephone number, the description of your request, your preferred method of contact and, where applicable, your callback request, as well as, optionally, files you upload such as drawings, data sheets or specifications. In the case of an appointment request, the occasion, your preferred date and the number of participants are added.

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry is aimed at the initiation or performance of a contract, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in answering enquiries. Consent is not required for this; you therefore do not need to confirm anything separately.

To protect against automatically submitted form requests, we store the IP address of the submitting system for no longer than 15 minutes. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in preventing spam and misuse.

Your enquiry and the associated files are sent by email to the responsible mailbox. If you have provided an email address, we will also send an automatic acknowledgement of receipt to this address. It contains none of the details you entered in the form. To send these emails, we use the Resend service of Plus Five Five, Inc., San Francisco, USA. The emails are sent via a data centre of the provider in Ireland. The provider stores the messages sent, including attachments, and the associated logs for 30 days, and backups thereof for 7 days; this data is located in the USA. The provider is a sub-processor of sorum GmbH (see “Hosting”); a data processing agreement pursuant to Art. 28 GDPR is in place between the two. The provider is certified under the EU-US Data Privacy Framework; the transfer is therefore based on the adequacy decision of the European Commission pursuant to Art. 45 GDPR and, additionally, on the standard contractual clauses agreed with the provider. Further information can be found in Resend’s privacy policy at https://resend.com/legal/privacy-policy.

Files you attach are first stored on submission in a storage facility of our hosting provider Vercel in Frankfurt am Main and deleted immediately after the email has been sent; if the form is not submitted, they are deleted after approximately one hour at the latest.

We delete the data as soon as it is no longer required for processing and no statutory retention obligations prevent this. Business letters are subject to the retention periods under commercial and tax law of six and ten years respectively.

You can also reach us via WhatsApp or by a callback via Microsoft Teams. What applies in these cases is described in the section “Other contact channels”.

Applications

If you apply via our application form, we process the data you provide exclusively for the purpose of conducting the application procedure. This comprises: first name and surname, email address or telephone number, the desired position, information on your current situation and possible start date, your message to us and the application documents you upload.

The legal basis is Art. 6(1)(b) GDPR — the processing is necessary for the decision on establishing an employment relationship. If your documents contain special categories of personal data within the meaning of Art. 9 GDPR, such as information about a severe disability, we process these on the basis of Art. 9(2)(b) GDPR in conjunction with Section 26(3) of the German Federal Data Protection Act (BDSG).

Your application and the uploaded documents are sent by email to our careers mailbox. If you have provided an email address, you will receive an automatic acknowledgement of receipt at this address; it contains none of the details you entered in the form. To send these emails, we use the Resend service; the details can be found in the section “Contact and project enquiries”. Uploaded files are first stored on submission in a storage facility of our hosting provider Vercel in Frankfurt am Main and deleted immediately after sending; if the form is not submitted, they are deleted after approximately one hour at the latest. In addition, we store your details and documents in our applicant management system in Microsoft SharePoint so that we can handle the procedure in an orderly manner. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, which acts as our processor; an agreement pursuant to Art. 28 GDPR is in place with it. As Microsoft may also process data in the USA, any transfer is based on the EU-US Data Privacy Framework (Art. 45 GDPR) and, additionally, on standard contractual clauses. Access to the careers mailbox and the applicant management system is restricted to the persons entrusted with the application procedure.

If you apply via a form in one of our advertisements on Facebook or Instagram (lead form), Meta Platforms Ireland Limited transmits to us the details you enter there: name, email address, telephone number and your answers to the questions in the form. We retrieve these details via an interface and treat them like an application via this website: they are sent by email to our careers mailbox and stored in our applicant management system in Microsoft SharePoint; the legal basis and deletion periods are the same. To avoid duplicate entries, we only store the identifier of the form entry, no further details. The processing on the platform itself is governed by Meta's privacy policy (https://www.facebook.com/privacy/policy).

If no employment relationship is established, we delete your application documents six months after the conclusion of the procedure. This period takes account of the burden of proof under the German General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz). If you would like us to retain your documents beyond this period for future vacancies, please let us know — this will only be done with your express consent pursuant to Art. 6(1)(a) GDPR, which you can withdraw at any time.

OpenStreetMap map service

On our contact page, we offer a directions map from the OpenStreetMap service, operated by the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. You can also access our location directly on openstreetmap.org using the “Open in OpenStreetMap” button.

Both only take place after you have given your consent, either in the privacy settings (“OpenStreetMap” switch) or directly on the map or the button. No connection to the provider’s servers is established beforehand. When the map is loaded, your IP address and technical information about your browser are transmitted to the provider; the embedded map does not set any cookies. If you visit openstreetmap.org, the OpenStreetMap Foundation sets its own cookies there, including an analytics cookie with a lifetime of around one month. The OpenStreetMap Foundation is the controller responsible for the processing on openstreetmap.org.

The legal basis is Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(a) GDPR. An adequacy decision of the European Commission exists for the United Kingdom. You can withdraw your consent at any time via the privacy settings in the page footer.

Further information can be found in the OpenStreetMap Foundation’s privacy policy at https://osmfoundation.org/wiki/Privacy_Policy.

Route planning with Google Maps

On our contact page, you will find a “Plan route with Google Maps” button. Google Maps is not embedded in our website. The button only opens the Google Maps website after you have given your consent, either in the privacy settings (“Google Maps (route planning)” switch) or in the notice that appears on the first click. No data is transmitted to Google beforehand.

With your consent, Google Maps opens in a new window. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In the process, your browser transmits your IP address, technical information about your browser and the address of our plant as the destination to Google. Google sets its own cookies as soon as the website is accessed, some with lifetimes of up to 13 months. Google is the controller responsible for any further processing; Google also processes data in the USA. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the privacy settings in the page footer. Further information can be found at https://policies.google.com/privacy.

Our presences on social networks

We maintain company presences on LinkedIn, Facebook, Instagram and YouTube. On this website, we refer to them only by means of simple links; data is only transferred when you click on such a link. This information also applies if you have arrived here via a link on one of these platforms.

When you visit our presence on a platform, the respective operator processes your data, such as your IP address, information about your device and – via cookies – your usage behaviour, even if you are not logged in there. If you are logged in, the operator can assign the visit to your account. The operator processes content that you enter there, such as comments or messages; we see it insofar as the platform provides for this and use it only to communicate with you.

For the statistical analyses that the platforms provide to us about the use of our presences (so-called Insights), we are joint controllers together with the operator in accordance with the case law of the Court of Justice of the European Union (Art. 26 GDPR). We receive these analyses only in aggregated form, without reference to individual persons. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in presenting our company and communicating with prospective customers and applicants.

LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Joint controller agreement: https://legal.linkedin.com/pages-joint-controller-addendum. Privacy policy: https://www.linkedin.com/legal/privacy-policy.

Facebook and Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Joint controller agreement: https://www.facebook.com/legal/terms/page_controller_addendum. Privacy policies: https://www.facebook.com/privacy/policy and https://privacycenter.instagram.com/policy.

YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy.

The operators also process data in the USA; Meta, LinkedIn and Google are certified under the EU-US Data Privacy Framework (Art. 45 GDPR). You can assert your rights against us and against the respective operator. As only the operator has full access to the user data, the quickest way to obtain information or erasure is to contact the operator directly; we will forward any requests addressed to us.

Instagram content

On individual pages, we embed posts from our Instagram profile. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

The posts are only embedded after you have given your consent, either in the privacy settings (“Instagram” switch, independently of other services) or directly on the post. No connection to Instagram is established beforehand. Once the content has loaded, the provider receives your IP address and, if you are logged in there, can assign you to your account.

We are joint controllers with Meta for the collection of data on our website and its transmission to Meta when the posts are embedded (Art. 26 GDPR); Meta alone is responsible for any further processing. The essential content of our agreement with Meta can be found at https://www.facebook.com/legal/controller_addendum. Meta also processes data in the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the privacy settings in the page footer.

Meta describes how it processes the data in Instagram’s privacy policy at https://privacycenter.instagram.com/policy.

LinkedIn Insight Tag

With your consent, we use the “Insight Tag” of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. It records that you have visited our website after coming into contact with an advertisement on LinkedIn and — insofar as we have set up this measurement — whether you subsequently submitted a contact enquiry or an application. In addition, we receive aggregated analyses from LinkedIn on the professional composition of our visitors, for example by industry or job function, which do not allow any conclusions to be drawn about individual persons.

In the process, your IP address, information about your browser and LinkedIn cookies are used. If you are logged in to LinkedIn, LinkedIn can assign the visit to your profile. We do not transmit names, contact details or other form content.

In accordance with the case law of the Court of Justice of the European Union, we are joint controllers with LinkedIn for the collection of data on our website and its transmission to LinkedIn (Art. 26 GDPR). LinkedIn is responsible for the subsequent processing as an independent controller. LinkedIn does not provide a joint controller agreement for this service; you can therefore assert your rights both against us and against LinkedIn (Art. 26(3) GDPR). LinkedIn also processes data in the USA; LinkedIn Corporation is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

The legal basis is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw it at any time via the privacy settings in the page footer. LinkedIn describes how it processes the data at https://www.linkedin.com/legal/privacy-policy.

Meta Pixel

With your consent, we use the pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It records that you have visited our website after coming into contact with an advertisement on Facebook or Instagram and whether you subsequently submitted a contact enquiry or an application. In the case of an application, we only transmit the type of position — apprenticeship, permanent employment, internship or holiday job.

In the process, your IP address, information about your browser and Meta cookies are used. If you are logged in to Facebook or Instagram, Meta can assign the visit to your account. We do not transmit names, contact details or other form content; we have deactivated the automatic matching of attributes.

We are joint controllers with Meta for the collection of data on our website and its transmission to Meta (Art. 26 GDPR); Meta alone is responsible for any further processing. The essential content of our agreement with Meta can be found at https://www.facebook.com/legal/controller_addendum. Meta also processes data in the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

The legal basis is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw it at any time via the privacy settings in the page footer.

Meta describes how it processes the data in its privacy policy at https://www.facebook.com/privacy/policy.

wlw Website Leads (Visable)

With your consent, we use the “Website Leads” service of Visable GmbH, ABC-Straße 21, 20354 Hamburg. Visable operates the B2B platform wlw (formerly “Wer liefert was”), on which we are represented with a company profile. When you access our website, a tracking pixel from Visable is loaded.

In the process, your IP address, information about your browser, the time of access and our domain are transmitted to Visable. Visable analyses this information to identify whether the access originates from a company network and provides us with aggregated analyses of which companies are interested in our offering. We do not transmit which subpages you visit, names, contact details or form content. The pixel does not set any cookies. A data processing agreement pursuant to Art. 28 GDPR is in place with Visable.

The legal basis is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw it at any time via the privacy settings in the page footer. Further information can be found in Visable’s privacy policy at https://www.visable.com/de_de/datenschutz.

Storage on your device

This website stores your privacy selection in your browser’s session storage so that we do not ask you again on every page during your visit. This entry is deleted at the end of the session. It is only read by the page in your browser and is not transmitted either to us or to third parties. Storage for the duration of the visit is necessary so that we can respect your decision and is therefore exempt from consent pursuant to Section 25(2) No. 2 TDDDG.

With your “Convenience” consent, the page remembers your privacy selection and the fact that you have already seen the introductory start animation in your browser’s local storage for twelve months. After that, the page deletes the entries and asks you again. Without this consent, both apply only to the current visit, and we will ask you again on your next visit. The legal basis is Section 25(1) TDDDG. You can withdraw your consent at any time via the privacy settings in the page footer; the persistent entries are then removed immediately.

During a visit, the page also stores individual technical details, such as the last position displayed on the home page, in your browser’s session storage. These details are likewise not transmitted and are deleted at the end of the session. You can delete all entries at any time via your browser settings.

Other contact channels

On our contact page, in addition to email and telephone, we also offer a callback via Microsoft Teams and contact via WhatsApp. Both channels are voluntary; you can also reach us at any time by email, by telephone or via the contact form.

WhatsApp is a service of WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you write to us via WhatsApp, we process your telephone number, the name stored there and the content of your messages in order to respond to your request. The content is end-to-end encrypted; however, WhatsApp receives connection and usage data, such as when and with whom you communicate, and also processes data in the USA. Further information can be found at https://www.whatsapp.com/legal/privacy-policy-eea.

For a callback via Microsoft Teams, we use the service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. In the process, your name, your email address where applicable, and the audio and video of the conversation are processed. Further information can be found at https://privacy.microsoft.com/de-de/privacystatement.

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry is aimed at a contract, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in offering you the contact channel you have chosen.

Please note that we have no influence over which further data these providers collect. For confidential documents, we recommend the contact form or post. Alternatively, you can send documents in encrypted form, for example as a password-protected file whose password you communicate to us by another channel.

Recipients of your data

Within our company, only those departments that need access to your data in order to process your request receive it. In addition, sorum GmbH, as our processor, receives access insofar as this is necessary for the operation and support of this website, as do its sub-processors Vercel (hosting) and Resend (email delivery). We also store applications in Microsoft SharePoint (see “Applications”). Agreements pursuant to Art. 28 GDPR are in place with all of them.

Your data is not sold. Data is only passed on to advertising platforms with your consent and only to the extent that we describe in the sections on the individual services.

Your rights

You have the right to request information about the data stored about you (Art. 15 GDPR) and to demand its rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR) as well as the restriction of processing (Art. 18 GDPR). You also have the right to data portability (Art. 20 GDPR).

If we process data on the basis of a legitimate interest, you can object to the processing pursuant to Art. 21 GDPR. If you have given consent, you can withdraw it at any time with effect for the future; the lawfulness of the processing carried out until then remains unaffected.

To exercise your rights, an informal message to the contact details given above under “Controller” is sufficient.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority) Promenade 18 91522 Ansbach, Germany Website: www.lda.bayern.de Email: poststelle@lda.bayern.de Telephone: +49 981 180093-0

Further privacy notices

In addition to this privacy policy, separate notices (in German) inform you about the processing of personal data outside this website:

Privacy notice for data subjects: www.friedrich-joerg.com/downloads/datenschutzhinweis-betroffene.pdf Privacy notice for applicants: www.friedrich-joerg.com/downloads/datenschutzhinweis-bewerber.pdf Privacy notice on photo and video recordings: www.friedrich-joerg.com/downloads/datenschutzhinweis-aufnahmen.pdf

Changes to this privacy policy

We will adapt this privacy policy as soon as the processing changes — for example because we offer new functions. The version published here at the time applies to each subsequent visit.