Data privacy

• I. General
• II. Responsible party
• III. Your rights
• IV. Processing of personal data during informational use of our website
• V. Processing of personal data by cookies
• VI. Other functions and offers of our website
• VII. Contacting us
• VIII. Blog
• IX. Online Application
• X. Registration
• XI. Validation of electronic invoices (e-invoice validator)
• XII. Web analytics with Matomo
• XIII. Handling of enquiries and applications (Zammad)
• XIV. Newsletter

I. General

(1) In the following, we inform you about the collection of personal data when using our website.

(2) The term 'personal data' means, with reference to the definition of Article 4 No. 1 of Regulation (EU) 2016/679 (hereinafter referred to as 'General Data Protection Regulation' or 'GDPR' for short), all data that can be personally related to you. This includes, for example, name, address, e-mail address, user behavior. With regard to further terminology, in particular the terms processing', 'controller', 'processor' and 'consent', we refer to the legal data protection definitions of Art. 4 DSGVO.

(3) We process personal data only to the extent necessary to provide a functional website and the content and services offered by us. Personal data is regularly processed only if you have given us your consent within the meaning of Art. 6 (1) a) DSGVO or if the processing is permitted by statutory provisions, in particular by one of the legal bases mentioned in Art. 6 (1) b) to f) DSGVO.

(4) Your personal data will be deleted or blocked as soon as the purpose of storage ceases to apply. In addition, storage may take place if this has been provided for by national or European regulations to which we are subject. In this case, the data will be blocked or deleted when the storage period prescribed by the respective regulations has expired. The latter does not apply if further storage of the data is necessary for the conclusion or fulfilment of a contract.

(5) If we wish to use commissioned service providers for individual functions of our website or use your data for advertising purposes, we will inform you in detail about the respective processes below.

II. Responsible party

(1) The responsible party within the meaning of Art. 4 No. 7 GDRP, the other data protection laws applicable in the Member States of the European Union and other regulations and provisions of a data protection nature is:

conlutio GmbH
Managing Director: Jürgen Schwaninger

Staarenbergstraße 64
76703 Kraichtal
Deutschland

Phone: +49 7251 3076321
Email address: info@conlutio.com

Register court: Amtsgericht Mannheim
Register number: HRB 712677

(2) For further details on the responsible body, please refer to our imprint.

III. Your rights

(1) You have the following rights in relation to us in respect of personal data relating to you:

• the right of access,
• the right to rectification and erasure,
• the right to restriction of processing,
• the right to object to processing,
• the right to data portability.

(2) Additionally, you have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

IV. Processing of personal data during informational use of our website

(1) If you access our website without registering or otherwise providing us with information ('Informational Use'), we only collect the personal data that your web browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to enable you to view our website and to ensure its stability and security: Date and time of the request, Time zone difference to GMT, Content of the web page, Access status (HTTP status), Amount of data transferred, Request website, Web browser, operating system, browser language and version

(2) The aforementioned data is also stored in so-called log files on our servers. A storage of this data together with other personal data of you does not take place.

(3) The storage of the above-mentioned data in log files serves to ensure the functionality and optimization of our website as well as to ensure the security of our information technology systems.

(4) An evaluation of this data for marketing purposes does not take place. In the above purposes lies our legitimate interest in data processing. The legal basis for the collection and temporary storage of the aforementioned data and the log files is Art. 6 para. 1 p. 1 lit. f) GDRP. The aforementioned data for the provision of our website will be deleted when the respective session has ended. The collection of the above data for the provision of our website is mandatory for the operation of our website. There is no possibility to object.

V. Processing of personal data by cookies

(1) We use so-called cookies on our website. Cookies are small text files that are stored on the storage medium of your end device, for example on a hard drive, and through which certain information flows to us as the body that sets the cookie. Cookies cannot execute programs or transmit viruses to your end device. This website uses the following types of cookies, the scope and functionality of which are explained below.

(2) Cookies that are stored in association with your web browser:

• Transient cookies: these cookies are automatically deleted when you close your web browser. These include, in particular, session cookies. These store a so-called session ID, by means of which various requests of your web browser can be assigned to the common session. This makes it possible to recognise your terminal device when you return to our website. Session cookies are deleted as soon as you log out or close the web browser.

• Persistent cookies: these cookies are automatically deleted after a specified period of time, which may vary depending on the cookie. You can delete these cookies at any time in the settings of your web browser.

(3) The processing of personal data by the aforementioned cookies serves to make the offer of our website as a whole more user-friendly and effective for you. Some functions of our website cannot be offered without the use of these cookies. In particular, some functions of our website require that your web browser can still be identified after a page change. If you have an account, we use the cookies to identify you for subsequent visits. This prevents you from having to log in again each time you visit our website. The data processed by cookies that are required to provide the functions of our website are not used to create user profiles. Where cookies are used for analysis purposes, they are used to improve the quality and user-friendliness of our website, its content and functions. They enable us to track how the website, which functions and how often they are used. This enables us to continuously optimize our offer.

(4) In the above purposes lies our legitimate interest in data processing. The legal basis is Art. 6 (1) lit. f) GDRP.

(5) The above cookies are stored on your terminal device and transmitted from it to our server. You can therefore configure the processing of data and information by cookies yourself. You can make appropriate configurations in the settings of your web browser, through which you can, for example, reject third-party cookies or cookies altogether. In this context, we would like to point out that you may then not be able to use all functions of our website properly. In addition, we recommend a regular manual deletion of cookies as well as your browser history.

VI. Other functions and offers of our website

(1) In addition to the aforementioned informational use of our website, we offer various services that you can use if you are interested. This usually requires the provision of further personal data. We need this data to provide the respective service. The aforementioned data processing principles apply.

(2) In some cases, we use external service providers to process this data, which have been carefully selected and commissioned by us. These service providers are bound by our instructions and are regularly monitored by us. Insofar as personal data is passed on to third parties in the course of services which we offer jointly with partners, you can find more detailed information in the following descriptions of the individual services. If these third parties are based in a country outside the European Economic Area, you can find more detailed information about the consequences of this circumstance in the following descriptions of the individual services.

VII. Contacting us

(1) If you contact us by e-mail, the personal data you send to us with your e-mail will be stored.

(2) In addition, we maintain a contact form on our website with which you can contact us. In doing so, the data you enter in the input mask is transmitted to us and stored: First name, Last name, Email address, Phone .

(3) The data will only be used to answer your questions. Unless explicitly stated in this privacy policy, the data will not be shared with third parties. In addition, we record your IP address and the time of sending.

(4) The processing of the above personal data is solely for the purpose of dealing with your enquiries.

(5) The processing of further personal data, which is generated by the use of the contact form provided on our website, serves to prevent misuse as well as to ensure the security of our information technology systems.

(6) This is also our legitimate interest in processing your personal data. Insofar as you have given us consent for this, the legal basis for the processing of this data is Art. 6 para. 1 lit. a) GDRP. Otherwise, the legal basis for the processing of this data is Art. 6 (1) (f) GDRP, in particular in the event that the data is transmitted to us by you by sending us an e-mail. Insofar as you wish to work towards the conclusion of a contract by sending us an e-mail, Art. 6 (1) (b) GDRP constitutes an additional legal basis.

(7) The data will be deleted, subject to statutory retention periods, as soon as we have conclusively processed your request. When contacting us by e-mail, you can object to the storage of your personal data at any time. We would like to point out that in this case your request cannot be processed any further. You can declare the revocation or the objection by sending an e-mail to our e-mail address given in the imprint.

VIII. Blog

(1) On our website we offer a blog. In this blog we publish contributions to different topics.

(2) If you have given us consent to store the data, you can revoke this consent at any time. You may object to this storage of the aforementioned data at any time.

IX. Online Application

(1) We offer you the opportunity to apply online on our website. In order for you to participate in the application process, you will be required to provide personal data. This data may include, but is not limited to, personal master data such as first name, last name, address, date of birth, contact details such as telephone number or e-mail address, as well as data relating to your educational and/or professional background such as school and work references, data on apprenticeships, internships or previous employers. This data may originate from an application form to be completed by you online on the application platform or from documents provided by you such as a cover letter, a curriculum vitae, an application photo, certificates or other evidence of professional qualifications. Data that is mandatory for participation in the application process is marked accordingly as mandatory data. Insofar as no third-party provider is named in this data protection declaration whose service we use to provide the online application function, no data is passed on to third parties.

(2) We process the above data for the purpose of carrying out the application procedure. Insofar as you have given us your consent, the legal basis for the processing of the data is Art. 6 para. 1 p. 1 lit. a) GDRP. Insofar as the processing of the above data is carried out for the initiation of contractual relationships, the legal basis is Art. 6 para. 1 p. 1 lit. b) GDRP.

(3) The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the event that an employment relationship, training relationship, internship or other service relationship is established following the application process, the data will initially continue to be stored and transferred to the personnel file. Otherwise, the application procedure ends with the receipt of a rejection. In this case the data will be deleted after nach 6 Monaten. Deletion does not take place if further processing and storage of your personal data is necessary in individual cases for the assertion, exercise or defence of legal claims. In this case, we have a legitimate interest in the further processing and storage of your personal data. The legal basis is Art. 6 para. 1 p. 1 lit. f) GDRP. Deletion will also not take place if we are obliged to continue storing your personal data due to legal regulations.

(4) You can revoke any consent you have given us at any time. You can object to the processing of your personal data at any time. In particular, you have the option to withdraw your application at any time. As part of the application process, you should only provide us with the personal data that is required for participation in the application process and its implementation. There is no legal or contractual obligation to provide data. However, we would like to point out that without this data we will not be able to carry out the application procedure and consider your application. The same applies in the event of an objection to the processing of your data. You can have the data stored about you changed at any time.

X. Registration

(1) In order to use additional functions of our website, we offer the possibility to register by providing personal data. The data is thereby entered into an input mask and transmitted to us and stored. The data will not be passed on to third parties. The mandatory data requested during registration are marked accordingly and must be provided in full. Otherwise we will reject the registration. The following data is collected during the registration process: First name, Last name, Email address.

(2) At the time of registration, the IP address and the date and time of registration are also stored. As part of the registration process, consent is obtained from the user to process this data.

(3) Registration is required for the provision of certain content and services on our website. We use the data entered for this purpose only for the purpose of using the respective offer or service or for providing the services that you have registered to use. In the event of important changes to our offers, services or benefits, for example concerning the scope of the offer or in the event of technically necessary changes, we will use the e-mail address provided during registration to inform you of this. The legal basis for the processing of the data is Art. 6 para. 1 p. 1 lit. a) GDRP. Insofar as the registration serves to conclude or execute a contract, Art. 6 para. 1 p. 1 lit. b) GDRP represents an additional legal basis.

(4) You can revoke any consent you have given at any time. The legality of the data processing already carried out remains unaffected by the revocation.

(5) The data will be deleted as soon as they are no longer necessary for achieving the purpose of their collection. This is the case when the registration on our website is cancelled or modified. You have the possibility to cancel the registration at any time. You can have the data stored about you changed at any time. Legal retention periods remain unaffected.

(6) We only transmit personal data to third parties if this is necessary in the context of contract processing. A further transmission of the data does not take place or only if you have expressly agreed to the transmission. Your data will not be passed on to third parties without your express consent, for example for advertising purposes.

(7) If you have given us your consent, the legal basis for processing the data is Art. 6 (1) p. 1 lit. a) GDRP. Otherwise, the legal basis is Art. 6 para. 1 p. 1 lit. b) GDRP.

(8) We process and/or store your personal data on a server of an external provider in the European Union. This ensures that the standards and regulations of European data protection law are adhered to.

XI. Validation of electronic invoices (e-invoice validator)

When you upload a file (XML or PDF) to our online validator, it is processed solely to perform the requested check (validation against EN 16931 and/or generation of a visual copy). The file and its content are held only in memory for the duration of processing, are not stored permanently and are not passed on to third parties; once the result has been returned, the transmitted data is discarded. Invoice files may contain personal data (e.g. names and addresses of the invoice parties); the user is responsible for uploading such data. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing the validation service). Technical access data is processed as described in section IV.

XII. Web analytics with Matomo

(1) Our website uses Matomo, an open-source web analytics service. It analyses how our website is used so that we can improve it. Matomo runs only on our own server at stats.conlutio.de, which is operated by all-inkl.com in Germany under a data processing agreement pursuant to Art. 28 GDPR. The collected data is not passed on to third parties, including the maker of Matomo, and is not transferred to countries outside the EU/EEA.

(2) No cookies: We have configured Matomo so that it neither sets nor reads cookies.

(3) Data processed: When you visit our website, the following data is collected, among others:

• truncated IP address (the last two bytes are removed, e.g. 192.168.xxx.xxx)
• pages viewed, date and time of access
• referring page (referrer URL)
• browser type and version, operating system, screen resolution, language setting
• time spent on the website

(4) The IP address is truncated immediately after collection and before it is stored. This means we cannot link the data to a specific individual. We do not combine the data with other data sources and do not collect any other personal data.

(5) Legal basis: Processing is based on our legitimate interest in analysing, optimising and running our website economically (Art. 6(1)(f) GDPR).

(6) Retention period: Raw data is deleted automatically after 730 days.

(7) Right to object: You may object to this processing at any time (Art. 21 GDPR).

XIII. Handling of enquiries and applications (Zammad)

(1) We use the ticket system Zammad to handle incoming enquiries. This includes in particular:

• emails to our general contact addresses (info@conlutio.de, info@conlutio.com)
• messages sent via the contact form on our website
• applications submitted via the application form on our careers page
• support requests by email or via our customer portal at service.conlutio.com

(2) The platform is provided and operated by Zammad GmbH, Marienstr. 18, 10117 Berlin. Data is stored exclusively in data centres in Germany. We have concluded a data processing agreement with Zammad GmbH pursuant to Art. 28 GDPR.

(3) Data processed: Depending on the type of enquiry, we process in particular:

• name, email address and, where applicable, phone number and company
• the content of your message including attachments, and the subsequent correspondence
• for applications, additionally the application documents you submit (e.g. CV, certificates)
• when you access the customer portal, technical data (IP address, browser type, date and time)

(4) Signing in to the customer portal sets a technically necessary session cookie, which is deleted when you sign out or close your browser.

(5) Legal basis: We process enquiries relating to a contract or to steps prior to entering into a contract under Art. 6(1)(b) GDPR. We process all other enquiries on the basis of our legitimate interest in handling them efficiently (Art. 6(1)(f) GDPR). We process applications in order to carry out the application process (Art. 6(1)(b) GDPR).

(6) Applications: Applications are stored in a separate area of the ticket system. Only the people involved in the application process have access to it.

(7) Retention period:

• Enquiries without a customer relationship: We delete them once they have been fully dealt with and are no longer needed for further communication, and no later than three years after closure.
• Enquiries from customers (in particular support): We store them for the duration of the customer relationship so that our support remains traceable. After the relationship ends, we delete them once the statutory limitation periods have expired (generally three years). Where individual messages are subject to statutory retention obligations, e.g. as commercial correspondence, we retain them for up to six years.
• Applications: If no employment relationship results, we delete them six months after the end of the application process, unless you have expressly consented to longer storage.

XIV. Newsletter

(1) You can subscribe to our newsletter on our website. In it we inform you about new versions and support packages of our products, in particular the xtMail Suite.

(2) We use the rapidmail service provided by Positive Group Deutschland GmbH, Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau, Germany, to send the newsletter. The data is stored on servers in Germany and is not transferred to third countries. We have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR.

(3) Subscription form: The subscription form on our service page is provided directly by rapidmail. When you open this page, a script is loaded from rapidmail's servers for this purpose. In the process, technically necessary data such as your IP address, browser type and the date and time of access are transmitted to rapidmail. The legal basis is our legitimate interest in a functional and secure newsletter subscription (Art. 6(1)(f) GDPR).

(4) Data processed: The only mandatory information for receiving the newsletter is your email address. You may voluntarily provide your first name, last name, company and phone number so that we can address you personally. In addition, we store the time and IP address of your subscription and confirmation so that we can prove your consent.

(5) Double opt-in: After subscribing, you will receive an email with a confirmation link. Your email address is only added to the mailing list once you click this link. This ensures that no one can subscribe using someone else's email address.

(6) Performance tracking: Our newsletters contain a so-called tracking pixel and links that allow rapidmail to record whether and when a newsletter was opened and which links in it were clicked. This analysis is linked to your email address and helps us improve the content of our newsletter. It forms part of your consent. It is not possible to opt out of this analysis separately; it ends when you unsubscribe from the newsletter.

(7) Legal basis: The newsletter is sent and its performance tracked on the basis of your consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG, Section 25(1) TDDDG). Your subscription is logged on the basis of our legitimate interest in being able to prove your consent (Art. 6(1)(f) GDPR).

(8) Withdrawal: You can withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link at the end of every newsletter or by email to info@conlutio.de. This does not affect the lawfulness of processing carried out before the withdrawal.

(9) Retention period: We store your data for as long as you are subscribed to the newsletter. When you unsubscribe, your email address is removed from the mailing list. To prevent you from being contacted again after unsubscribing and to be able to prove your earlier consent, we store your email address and subscription data on a block list for no longer than three years after you unsubscribe. Subscriptions that are not confirmed are deleted after 4 weeks.