Legal

Privacy Policy

Introduction

Whether you are a customer, prospective customer or visitor to our website, we protect your privacy and consider it a matter of great importance when processing your data. We therefore comply with the provisions of the General Data Protection Regulation (GDPR).

This Privacy Policy explains what data we process. It applies to ITM Beratungsgesellschaft mbH, hereinafter referred to as ITM.

It also provides information about the processing of your data in accordance with the applicable legal requirements (Articles 13 et seq. GDPR). It gives you a quick and straightforward overview of the personal data we collect from you and what we do with them. We also inform you about your rights under applicable data protection law and who you can contact if you have any questions.

Controller

ITM Beratungsgesellschaft mbH
Meitnerstraße 8
70563 Stuttgart
Germany
Telephone: +49 711 45129-0
Email: info[at]itm.net

Contact details of the Data Protection Officer

You can contact our Data Protection Officer at:
Telephone: +49 711 45129-15
Email: compliance+dsb[at]itm.net

Purposes and legal bases of data processing

We process your personal data exclusively in accordance with the applicable data protection laws, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). This Privacy Policy explains which personal data we collect, how we use them and which rights you have.

Collection and storage of personal data and the nature and purpose of their use

When visiting the website

When you access our website, the browser used on your device automatically sends information to our website server. This information is temporarily stored in a log file. The following information is recorded and stored until it is automatically deleted:

• IP address of the requesting device
• Date and time of access
• Name and URL of the file accessed
• Website from which the access originated (referrer URL)
• Browser used and, where applicable, your device's operating system

We process the data specified above for the following purposes:

• Ensuring that a smooth connection to the website is established
• Ensuring the convenient use of our website
• Evaluating system security and stability

We cannot attribute these data to specific individuals. These data are not combined with other data sources. The legal basis for the processing is Article 6(1)(f) GDPR.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content that you send to us as the website operator, our website uses SSL or TLS encryption. This means that third parties cannot read data that you transmit via this website. You can identify an encrypted connection by the “https://” address in your browser and the padlock symbol in the browser bar.

Hosting and delivery of the website

Our website is hosted by Amazon Web Services (AWS). The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. The pages are delivered via the Amazon CloudFront content delivery network; the access data specified above are processed by AWS in this context.

Because CloudFront uses a global network of points of presence, processing outside the EU, particularly in the United States, cannot be ruled out. AWS is certified under the EU-U.S. Data Privacy Framework (Article 45 GDPR); the EU Standard Contractual Clauses also apply (Article 46(2)(c) GDPR). The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in providing the website securely, quickly and reliably. Further information: AWS Privacy Notice.

Use of cookies and tracking technologies

Our website uses cookies, which are small text files that your web browser stores on your device to make your visit to our website more convenient and to enable the use of certain functions. You can prevent cookies from being stored on your device by changing the appropriate settings in your browser. However, this may restrict the functionality of our website.

You can adjust or withdraw your consent to the use of non-essential cookies at any time via our cookie consent tool on the website. To do so, click the corresponding icon at the bottom left of the website or open the settings in the cookie banner. Alternatively, you can delete or block stored cookies in your browser settings.

The processing is based on your consent (Article 6(1)(a) GDPR) or our legitimate interests (Article 6(1)(f) GDPR).

We use cookies and comparable technologies sparingly. Without your consent, we use only cookies and comparable technologies that are strictly necessary (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG):

• CookieConsent (cookie, duration 12 months): stores your selection in the cookie banner so that we do not have to ask you again each time you visit.
• itm-lang (local storage, no expiry): remembers the language you selected using the language switcher. The entry is created only if you actively change the language and does not leave your browser.

All other technologies are loaded only with your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG).

Cookiebot (consent management)

We use the Cookiebot consent management platform to obtain and document your consent. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. When you access our website, the provider's script is loaded and the following data are processed:

• Your consent choice or its withdrawal, including the date, time and consent version
• A randomly generated consent ID
• The address of the page accessed, the previously visited page, language settings and approximate geographical information
• Your IP address and information about your browser, operating system and device

Cookiebot stores your selection in the CookieConsent cookie in your browser and maintains a consent log so that we can demonstrate that consent was given. End-user data are deleted on an ongoing basis 12 months after they are recorded.

The processing serves to comply with our legal obligation to obtain and demonstrate consent (Article 6(1)(c) in conjunction with Article 7(1) GDPR) and our legitimate interest in legally compliant consent management (Article 6(1)(f) GDPR). The strictly necessary CookieConsent cookie is stored on the basis of Section 25(2) no. 2 TDDDG. Further information: https://www.cookiebot.com/en/privacy-policy/.

Analytics tools and advertising

Google Tag Manager

This website uses Google Tag Manager. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is used to centrally manage and trigger website tags. It does not itself set cookies or create its own user profiles. However, when Tag Manager is loaded, a connection to Google is established and, in particular, your IP address and technical connection data are transmitted. According to Google, the standard HTTP log data generated in this process are deleted within 14 days; Google may also process aggregated diagnostic data relating to the triggering of tags.

Google Tag Manager and the analytics tags it manages are loaded only after you have consented to the “Statistics” category in the cookie banner. No connection to Google is established without this consent. The legal basis is your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG). You may withdraw your consent at any time using the cookie icon at the bottom left of the page. The data processed by the services integrated via Tag Manager are explained in the respective sections of this Privacy Policy.

Google Analytics 4

This website uses features of the Google Analytics 4 web analytics service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, time spent on the website, operating systems used and the user's origin.

According to Google, IP addresses of users from the European Union or other states party to the Agreement on the European Economic Area are not logged or stored. The IP address is used on servers in the EU solely to derive approximate location data and is then discarded.

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity and provide the website operator with other services relating to website and internet use.

Google Analytics 4 is loaded only after you have consented to the “Statistics” category in the cookie banner. The cookies _ga and _ga_* are then set with a duration of up to two years. The retention period for user-level and event-level data in our Google Analytics account is set to 14 months. The processing is based exclusively on your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG); you may withdraw your consent at any time using the cookie icon at the bottom left of the page.

Google may transfer the data to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework; the EU Standard Contractual Clauses also apply. Further information: https://policies.google.com/privacy.

Plugins and tools

YouTube

Our website uses YouTube plugins to integrate and display video content. The operator of the service is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. We use YouTube in enhanced privacy mode. Videos are loaded only after you have consented to the corresponding category in the cookie banner or expressly activated the respective video. No connection to YouTube is established beforehand.

As soon as you start a YouTube video on this website, a connection to YouTube's servers is established. This tells YouTube which of our pages you have visited. If you are logged in to your YouTube account, YouTube may associate your browsing behaviour directly with your personal profile. You can prevent this by logging out beforehand.

After a video is started, YouTube may also store various cookies on your device or use comparable recognition technologies, such as device fingerprinting. In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to collect video statistics, improve user-friendliness and prevent attempted fraud.

The legal basis is your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG). You may withdraw your consent at any time using the cookie icon at the bottom left of the page. Google may transfer the data to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework; the EU Standard Contractual Clauses also apply. Details about how Google handles user data can be found in Google's Privacy Policy: https://policies.google.com/privacy.

Google reCAPTCHA

Our primary objective is to make our website secure and user-friendly for both you and us. To prevent automated access, for example by bots, and protect us against spam attacks, we use Google reCAPTCHA Enterprise. The provider of this service is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA enables us to distinguish whether input is made by a human or is being misused through automated machine processing. Various data are collected and transmitted to Google in this process, including the IP address, mouse movements, time spent on the website, browser and device characteristics and, where applicable, existing Google cookies. These data are used exclusively to protect our website.

reCAPTCHA is loaded only after you have given your consent, either via the “Preferences” category in the cookie banner or for the respective request using the designated checkbox in the contact form. reCAPTCHA may set the _GRECAPTCHA cookie in this process. Processing in the United States cannot be ruled out; Google LLC is certified under the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses also apply.

We use Google reCAPTCHA to maintain the integrity of our website, protect us against automated attacks and ensure user-friendliness for genuine visitors. The legal basis for the processing is your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG). The form cannot be submitted without reCAPTCHA; in this case, you can contact us by email at info[at]itm.net or by telephone. Further information: https://cloud.google.com/recaptcha/docs/faq.

Contact by email or contact form

If you send us enquiries by contact form or email, the information you provide, including the contact details you enter, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not disclose these data without your consent.

The following personal data may be processed in this context:

• Name
• Email address
• Company (if provided)
• Telephone number (if provided)
• Content of the message

These data are processed on the basis of Article 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary in order to take steps prior to entering into a contract. In all other cases, the processing is based on our legitimate interest in effectively handling enquiries addressed to us (Article 6(1)(f) GDPR).

Applications

If you apply to us, we process your personal data in order to conduct the application process. Your application documents are treated confidentially and used solely for the purpose of handling your application. The data processed include:

• Master data, such as name, address and contact details
• Application documents, such as CV, references and qualifications
• Any other information you voluntarily provide as part of your application

Your data are used internally only and are not disclosed to third parties.

The legal basis for processing your application data is Section 26 BDSG in conjunction with Article 6(1)(b) GDPR. If you are not employed, your application documents will be deleted no later than six months after the application process has been completed, unless you have consented to a longer retention period.

Visitors and external companies

For visitors and employees of external companies who enter our premises, we collect personal data such as:

• Name
• Contact details
• Company affiliation
• Time of visit

These data are used for security, to protect our employees and to comply with statutory requirements. The legal basis for this processing is Article 6(1)(c) GDPR (legal obligation) and our legitimate interest pursuant to Article 6(1)(f) GDPR.

Storage period and deletion of data

Personal data are stored for as long as necessary for the respective processing purposes or for as long as statutory retention obligations apply. The data are deleted once they are no longer required or the statutory retention periods have expired.

Data processing for business partners, external companies and business contacts

What data do we process?

As part of our business relationships with customers, suppliers, service providers and other business partners, we collect the following personal data:

• Last name, first name and title
• Company affiliation and position
• Business address
• Contact details (email, telephone and fax)
• Contract and billing data
• Payment information (bank details and invoice details)
• Communications within the business relationship, such as emails, enquiries, meetings and contracts

Purpose of data processing

These data are processed for the following purposes:

• Establishing, conducting and managing business relationships
• Processing enquiries and contract negotiations
• Processing orders and payments
• Complying with statutory requirements, such as tax retention obligations
• Communicating with business partners and external companies
• Improving our business processes

Legal bases for processing

The personal data of business partners are processed on the following legal bases:

• Article 6(1)(b) GDPR (steps prior to entering into a contract and performance of a contract)
• Article 6(1)(c) GDPR (legal obligations, such as tax retention obligations)
• Article 6(1)(f) GDPR (legitimate interest in maintaining business relationships, quality assurance and security)

Storage period and deletion of business partner data

Contract-related data and personal data are stored for as long as necessary for the respective business relationship or for as long as statutory retention obligations apply. The data are deleted once they are no longer required or the statutory retention periods have expired.

Disclosure of business partner data

We disclose personal data to third parties only where this is necessary to fulfil contractual or legal obligations or to safeguard legitimate interests. These third parties include, for example:

• Tax advisers, auditors and banks for processing payments
• Authorities and public bodies where statutory reporting obligations apply
• Insurance companies in connection with liability matters

Data security for business partners

We use technical and organisational measures to protect personal data against unauthorised access, loss or misuse. These include access controls, encryption technologies and regular security reviews. The measures include:

• Access restrictions and role-based permissions
• Encryption of sensitive data
• Secure transmission technologies for electronic communications
• Regular security audits and data protection training

Your rights as a data subject

If we process your personal data, you have the following rights under the GDPR:

Right of access pursuant to Article 15 GDPR

You have the right to obtain information about the personal data we process. This includes in particular:

• Purposes of the processing
• Categories of data processed
• Recipients or categories of recipient to whom your data have been or will be disclosed
• Envisaged storage period or the criteria used to determine that period
• Your rights to rectification, erasure, restriction of processing or objection
• The existence of automated decision-making, including profiling, and, where applicable, meaningful information about its details
• Information about any transfer of personal data to third countries and the appropriate safeguards

Right to rectification pursuant to Article 16 GDPR

If the personal data processed are inaccurate or incomplete, you have the right to have your data rectified or completed without undue delay.

Right to erasure (“right to be forgotten”) pursuant to Article 17 GDPR

You may request the erasure of your personal data where:

• the data are no longer necessary for the original purposes;
• you have withdrawn your consent and there is no other legal basis for the processing;
• you object to the processing and there are no overriding legitimate grounds for the processing;
• the data have been unlawfully processed; or
• erasure is necessary for compliance with a legal obligation.

Right to restriction of processing pursuant to Article 18 GDPR

You have the right to request restriction of the processing of your personal data where one of the following applies:

• You contest the accuracy of the data and we require time to verify their accuracy.
• The processing is unlawful, but you oppose the erasure of the data.
• We no longer need your data, but you require them for the establishment, exercise or defence of legal claims.
• You have objected to the processing and it has not yet been determined whether our legitimate interests override yours.

Right to object pursuant to Article 21 GDPR

You have the right to object at any time to the processing of your personal data based on Article 6(1)(e) or (f) GDPR. This applies in particular to direct marketing. In this case, your data will no longer be processed for these purposes.

Right to withdraw consent pursuant to Article 7(3) GDPR

You have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You can withdraw your consent at any time by emailing compliance+dsb[at]itm.net.

Right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR

Pursuant to Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority. You can generally contact the supervisory authority for your habitual residence, place of work or our registered office. The supervisory authority responsible for ITM Beratungsgesellschaft mbH is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
(Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg)
Postfach 10 29 32
70025 Stuttgart
Germany
Telephone: 0711/615541-0
Fax: 0711/615541-15
Email: Poststelle@lfdi.bwl.de

Contact options & compliance enquiries

We have established central points of contact for enquiries relating to data protection, information security and security incidents. Please use the appropriate email address to ensure that your enquiry can be handled more quickly.

Main contact

• Email: compliance[at]itm.net
• ITM hotline: +49 711 45129-0
• Website & further information: www.itm.net

Additional contacts:

Current status and amendments to this Privacy Policy

This Privacy Policy is currently valid. It may become necessary to amend this Privacy Policy as our website develops or due to changes in statutory requirements. The current Privacy Policy can be viewed on our website at any time.