Data Privacy Statement
The sections below contain information on the collection of personal data during use of our website. Personal data is defined as all specific information which can be traced back to you personally, e.g. name, address, e-mail addresses, user behaviour.
Responsible company / Data Protection Officer
|Company responsible for data processing||Data Protection Officer of the company responsible|
Horten, Kai, Board of Management and
Schwarz, Christian, Board of Management
Heussen Rechtsanwaltsgesellschaft mbH
Contact data privacy
General data collection when our website is accessed
When you access our website merely for informational purposes, that is, if you do not register with us or otherwise submit information to us, we collect only the personal data transmitted to our server by your browser. If you wish to view our website, we collect the following data, which we require for technical reasons in order to display our website to you and to guarantee stability and security (the legal basis is legitimate interest in accordance with Art. 6 Paragraph. 1 S. 1 lit. f GDPR):
|Data||Purpose of processing||Storage duration|
|Adress and full path of the requested website with optional request parameters in the URL||Display of the website||The data are deleted, at the end of the respective request|
|Operating system used||Evaluation by device to ensure optimised display of the website||The data are deleted at the end of the respective session.|
|Information on browser type and version used||Evaluation of browsers in order to optimise our web pages for their use||The data are deleted at the end of the respective session.|
|IP address||Display of the website on the respective device||The data are deleted at the end of the respective session.|
|Date and time of access||Ensuring proper operation of the website||The data are deleted at the end of the respective session.|
|Where applicable, manufacturer and type designation of smartphones, tablet computers or other end devices||Evaluation of device manufacturers and end device types for statistical purposes||The data are deleted at the end of the respective session.|
|Log files with response code of the request und all data in this table||Ensuring proper operation of the website||The data will be made anonymous after 7 days. The data will be deleted when the web servers are reset every few years.|
The collection of data for provision of the website and the storage of data in log files is essential for operation of the website. Consequently, users have no right of objection to this use of their data.
Cookies - general information
Cookies – distinction between cookie types
a) Technically essential cookies
|Name of the cookie||Purpose of processing||Legal basis for processing||Storage duration|
|cookieconsent_status||Tracking||legitimate interest||one year|
|PIWIK_SESSID||Tracking||legitimate interest||one year|
|_pk_id.1.(Ziffer/Buchstabenfolge)||Tracking||legitimate interest||one year|
|_pk_ses.1.(Ziffer/Buchstabenfolge)||Tracking||legitimate interest||one year|
|JSESSIONID||Session handling||legitimate interest||session|
Technically essential cookies are not always necessary in order to display the website. However, some functions of the website, e.g. contact form, registering for a course etc. cannot be used correctly without these cookies. Users consequently have no right of objection, though these cookies can be deactivated in the settings of the respective browser.
The legal basis for the processing of personal data is Art. 6 (1), sentence 1, lit. f GDPR. Matomo is an open-source project. Find more Information at:
Please note: If you delete your cookies, this means that the opt-out cookie will also be deleted and may need to be re-activated by you.
Contact form and booking of training courses
You can contact us at any time via our e-mail address or the contact form or the booking form for training courses. The personal data submitted by you in this manner will, of course, be used exclusively for the purpose for which you provided it.
|Data||Purpose of processing||Legal basis for processing||Storage duration|
|IP address on registration||Transmission of the content of the form to the web server||Consent / initiation/performance of the contractual relationship / processing of the request||Until connection is established|
|Message||Processing the request||Consent / initiation/performance of the contractual relationship / processing of the request||Until purpose is achieved / end of obligation of verification|
|Title||direct address||Consent / initiation/performance of the contractual relationship / processing of the request||Until purpose is achieved / end of obligation of verification|
|Surname||direct address||Consent / initiation/performance of the contractual relationship / processing of the request||Until purpose is achieved / end of obligation of verification|
|Last name||direct address||Consent / initiation/performance of the contractual relationship / processing of the request||Until purpose is achieved / end of obligation of verification|
|E-Mail address||Responding to the inquiry||Consent / initiation/performance of the contractual relationship / processing of the request||Until purpose is achieved / end of obligation of verification|
|Phone number||Responding to the inquiry||Consent / initiation/performance of the contractual relationship / processing of the request||Until purpose is achieved / end of obligation of verification|
|Address||Improvement in processing of enquiry||Consent / initiation/performance of the contractual relationship / processing of the request||Until purpose is achieved / end of obligation of verification|
|Business address||Improvement in processing of enquiry||Consent / initiation/performance of the contractual relationship / processing of the request||Until purpose is achieved / end of obligation of verification|
|URL||Improvement in processing of enquiry||Consent / initiation/performance of the contractual relationship / processing of the request||Until purpose is achieved / end of obligation of verification|
If you subscribe to our newsletter, you will receive an irregular newsletter containing news and updates on some of our services and products, as well as invitations to trade shows and events. If you no longer wish to receive the newsletter, you can revoke your consent at any time - provided the processing is based on your consent - or unsubscribe from the newsletter via the unsubscribe link in the e-mail.
The following data is collected when subscribing to the newsletter:
|Data||Purpose of processing||Legal basis for processing||Storage duration|
|IP address on registration||Proof of Double-Opt-In (DOI)||Consent/execution of the contractual relationship||3 years after last use e-mail|
|Date and time of registration||Proof of DOI||Consent/execution of the contractual relationship||3 years after last use e-mail|
|IP address on DOI||Proof of DOI||Consent/execution of the contractual relationship||3 years after last use e-mail|
|Date and time of DOI verification||Proof of DOI||Consent/execution of the contractual relationship||3 years after last use e-mail|
|E-mail address||Sending newsletter||Consent/execution of the contractual relationship||until revokement/until unsubscription of the newsletter|
|Title||direct address||Consent/execution of the contractual relationship||until revokement/until unsubscription of the newsletter|
|First name||direct address||Consent/execution of the contractual relationship||until revokement/until unsubscription of the newsletter|
|Surname||direct address||Consent/execution of the contractual relationship||until revokement/until unsubscription of the newsletter|
YouTube is being used in extended privacy mode
a) Type and scope of data processing
We have included YouTube videos in our online offering, which are stored at http://www.YouTube.com and can be played directly from our website. YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, Tel: +353 1 543 1000, Fax: +353 1 686 5660 ("Google").
We use YouTube in conjunction with the privacy-enhanced mode feature to display videos to you.
Due to the privacy-enhanced mode feature, the data explained in more detail below will only be transmitted to YouTube's server if you actually start a video.
YouTube collects your IP address, the date and time as well as the website you visited.
This takes place regardless of whether YouTube provides a user account that you are logged in to or whether there is no user account. It also connects to Google's advertising network.
If you are logged into YouTube at the same time, YouTube assigns the connection information to your YouTube account and uses it for purposes of advertising, market research and/or tailoring its website to suit your needs.
b) Purpose and legal basis
The legal basis is Art. 6(1) lit. f) GDPR. Our legitimate interest lies in improving the quality of our internet presence.
c) Storage period
The stored data will be deleted as soon as they are no longer needed for our purposes.
d) Right to object
YouTube permanently stores cookies on your terminal device via your Internet browser for the purpose of functionality and analysis of user behaviour.
If you do not agree with this processing, you can prevent the storage of cookies by changing the settings in your Internet browser.
If you wish to prevent this, you must either log out of YouTube before visiting our website or make the appropriate settings in your YouTube user account.
If you do not wish your profile to be assigned to YouTube, you must log out before activating the button.
If you do not want to receive user-based advertising, you can opt out of placing ads using Google's ad preferences.
Disclosure of data
Your personal data will not be disclosed to third parties for any purpose other than those listed below.
We only pass on your personal data if:
- you have expressly consented to this,
- disclosure is required for the assertion, exercise or defence of legal claims and there is no reason to presume that you have an overriding legitimate interest in non-disclosure of your data,
- we are under legal obligation to disclose the data, and
- where this is legally permissible and necessary for the processing of contractual relationships with you.
Notification of data protection rights
a) Right to withdraw your data protection consent according to Art. 7(3) s. 1 GDPR
You can withdraw your consent to the processing of your personal data at any time with effect for the future. However, this does not affect the legality of the processing until revocation.
b) Right of access according to Art. 15 GDPR
You have the right to request confirmation whether we obtain personal data concerning you.
In this case you have the right to get information about your personal data as well as further information, e.g. the purposes of processing, categories of personal data concerned, the recipients and the planed period of storage or the criteria used to determine that period.
c) Right to obtain rectification and completion according to Art. 16 GDPR
You have the right to obtain the correction of incorrect data without delay. Taking into account the purposes of the processing, you have the right to obtain the completion of incomplete data.
d) Right to erasure ("right to be forgotten") according to Art. 17 GDPR
You have a right of erasure, as far as the processing is not necessary. This is the case, if your data is no longer necessary for the original purposes, for example if you have withdrawn your consent or if the data was processed unlawfully.
e) Right restriction of processing according to Art. 18 GDPR
You have the right to obtain processing, e.g. if you believe that the personal data is incorrect.
f) Right to data portability according to Art. 20 GDPR
You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format.
g) Right to object according to Art. 21 GDPR
You have the right to object at any time to the processing of certain personal data concerning you for reasons arising from your particular situation.
In the case of direct marketing, you as the data subject have the right to object at any time to the processing of personal data concerning you for the purpose of advertising; this also applies to profiling, insofar as it is associated with direct marketing.
h) Automated individual decision-making, including profiling according to Art. 22 GDPR
You have the right not to be subject to a decision based solely on automated processing - including profiling - except in the exceptional circumstances mentioned in Art. 22 GDPR.
A decision based solely on automated processing - including profiling - does not take place.
i) Right to lodge a complaint with a data protection supervisory authority according to Art. 77 GDPR
You can also lodge a complaint with a data protection supervisory authority at any time, for example if you believe that data processing is not in compliance with data protection regulations.
Competent supervisory authority:
Bavarian State Office for Data Protection Supervision
PO Box 606
Telephone: +49 (0) 981 53 1300
Telefax: +49 (0) 981 53 98 1300
Notification of possibility to lodge a complaint
In addition, you have the right to lodge a complaint with the responsible data protection supervisory authority regarding the processing of your personal data by us.
Notification of possibility to revoke consent
You are entitled to withdraw your consent to the processing of your personal data by us at any time. This also applies to the revocation of declarations of consent granted to us before the General Data Protection Regulation came into effect, that is, before 25 May 2018. Please note that such revocation is only effective for the future. It does not apply to processing of data which took place before consent was revoked.
Links to other websites
Our web pages may contain links to the websites of other providers. We expressly point out that this Data Privacy Statement applies exclusively to the websites of Cyoss. We have no control over nor do we monitor whether other providers comply with valid data protection regulations.
Changes to the Data Privacy Statement
We reserve the right to amend or adapt this Data Privacy Statement at any time, in compliance with the applicable data protection regulations.
Collection and processing of applicant data
In the applicant tool, you can provide information about yourself and your profile. Some information is required in order to send the application. This information includes, for example, first name, surname and e-mail address. Such data are marked as mandatory fields.
In addition, you can voluntarily provide us with further information and documents such as curriculum vitae, certificates, address, etc. Please note that such documents may contain sensitive data (racial and ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health or sex life). For this reason, we recommend that you remove this information prior to transmission.
We process your personal data, which we receive from you as far as they are necessary for the execution of the application procedure, in order to initiate or execute the employment relationship (legal basis: Art. 6 Para. 1 b) DS-GVO). This includes the following data categories:
- Applicant master data (job position, first name, surname, salutation, place of birth, e-mail address)
- Qualification data (cover letter, CV, previous activities, professional qualifications)
- (Work) references and certificates (performance data, assessment data, etc.)
- Login data (e-mail, password)
- Publicized, job-related data, such as profiles in professional social media networks.
- Voluntary information, such as an application photo, information on severely disabled status or other information that you voluntarily provide to us in your application.
- Personal data of applicants will only be processed for the purposes of the application procedure if this is necessary for the decision on the establishment of an employment relationship with us.
The necessity and scope of data collection are assessed, among other things, according to the position to be filled. If your intended position involves the performance of particularly confidential duties, increased personnel and/or financial responsibility, or is linked to certain physical and health conditions, more extensive data collection may be necessary. In order to safeguard data protection, such data processing will only take place after completion of the applicant selection process and immediately prior to your recruitment.
In the case of a postal application, the data can be entered and entered into the tool by the human resources department.
If you are hired, your data and documents can be further used within the framework of an employment relationship.
Recipients of Data
As far as no other recipients are named in this data protection declaration, your data will be processed mainly by our personnel department and the department manager occupying your position. If, after your application documents have been reviewed by the Human Resources department, it emerges that further vacancies are possible, your application may also be submitted to the heads of department who will fill these vacancies.
- Human resources department
- Departmental manager
- Staff council
- Disabled employees' representative
External service providers:
- Providers of applicant management systems
- IT service providers (e.g. maintenance service providers, hosting service providers)
- Service providers for file and data destruction
If you have any further questions about the individual recipients, please contact us at: firstname.lastname@example.org
If an application cannot be considered, your data and documents will be stored for 6 months and then deleted. Should you withdraw your application, we will of course delete your data.