Privacy policy

Hosting

This website is operated on our behalf by a service provider and delivered through Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit the website, Cloudflare processes technically necessary connection data such as your IP address, the date and time, the address requested and your browser's identifier in order to deliver the pages and to protect the website against attacks and abuse.

The legal basis is our legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR). We have a data processing agreement with our service provider (Art. 28 GDPR); Cloudflare is engaged by it as a further processor. A transfer to the USA is based on Cloudflare's certification under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR).

Forms

When you write to us using one of the forms on this website, we process the details you enter there (“Contact”: First name, Last name, E-mail, Phone, Subject and Message; “Application”: First name, Last name, E-mail, Phone, Comment and Application documents (PDF)) in order to answer your inquiry. The legal basis is Art. 6(1)(b) GDPR where your inquiry aims at a contract or its preparation, and otherwise our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR).

Your details are not stored on the web server but sent to us by e-mail. For sending, our service provider uses Postmark, a service of AC PM LLC (ActiveCampaign), 1 North Dearborn Street, 5th Floor, Chicago, IL 60602, USA, as a further processor. Postmark keeps sent messages and delivery logs for 45 days by the provider's default setting. A transfer to the USA is based on the certification under the EU-US Data Privacy Framework (Art. 45 GDPR). We keep your inquiry as long as it is needed to handle it and as statutory retention obligations require.

To protect against automatically sent messages (spam), your browser solves a small computing task (ALTCHA) before sending. The program for it is delivered by this website itself; no further provider is involved. So that a solved task cannot be used more than once, we store a random identifier of the task for one hour; it contains no details about you. The legal basis is our legitimate interest in protection against abuse (Art. 6(1)(f) GDPR).

Applications

When you apply to us using the form “Application”, we process your details and the documents you upload in order to decide on your application. The legal basis is Art. 6(1)(b) GDPR (steps taken before entering into an employment relationship).

The documents are not stored on the web server but sent, together with your details, as an attachment to an e-mail to the person responsible for applications; the section “Forms” applies to sending them. If no employment relationship results, we delete your application no later than six months after the application process has ended, unless you have agreed to a longer retention.

Audience measurement with Umami

To understand which pages are visited how often, we use Umami, an open-source audience measurement software. Umami does not run at an analytics provider but on a server that our service provider operates for us (data processing, Art. 28 GDPR); the provider of this server is Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus.

Recorded are the page visited and its title, the page you came from (without its search parameters), the browser, operating system and device type, derived from the identifier your browser sends with every request, and the country, region and city, derived from your IP address. The measuring program reads no further details from your device, such as screen size or language setting, and stores nothing there. The IP address itself is not stored; to be able to count returning visits, a hash value that changes every month is formed from it and your browser's identifier. No profile of you is created. The recorded data is deleted after 25 months so that we can compare periods with the previous year; after that, only aggregated monthly figures without reference to individual visits remain. The legal basis is our legitimate interest in designing the website according to demand (Art. 6(1)(f) GDPR).