Processing of (personal) data by the entity in charge of the online application process
Privacy Policy
Privacy Statement
This privacy statement informs you about the type, scope, and purpose of the processing of personal data (hereinafter referred to as "data") within our online offering and the associated websites, functions, and content, as well as external online presences, such as our social media profiles. (hereinafter collectively referred to as "online offering"). Regarding the terminology used, such as "processing" or "controller," we refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).
Controller
NCTE AG
Raiffeisenallee 3
82041 Oberhaching Germany
Tel. + 49 89 665 619-0
Fax + 49 89 665 619-29
info@ncte.de
External Data Protection Officer
Graf Consultings GmbH
Karwendelstr. 7
86949 Windach
Tel: +49 8193-950163
E-Mail: datenschutz@gc-gmbh.com
Types of Data Processed
- Inventory data (e.g., names, addresses).
- Contact data (e.g., email, phone numbers).
- Usage data (e.g., visited websites, interest in content, access times).
- Meta/communication data (e.g., device information, IP addresses).
- Applicant information (e.g., names, contact details, application letters).
Categories of Data Subjects
Visitors and users of the online offering (hereinafter collectively referred to as "users").
Purpose of Processing
- Provision of the online offering, its functions, and content.
- Responding to contact inquiries and communication with users.
- Security measures.
Terminology Used
- "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
- "Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. The term is broad and encompasses practically any handling of data.
- "Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Relevant Legal Basis
In accordance with Article 13 GDPR, we inform you of the legal basis of our data processing. If the legal basis is not mentioned in the privacy statement, the following applies: The legal basis for obtaining consent is Article 6(1)(a) and Article 7 GDPR, the legal basis for processing for the performance of our services and carrying out contractual measures as well as responding to inquiries is Article 6(1)(b) GDPR, the legal basis for processing to fulfill our legal obligations is Article 6(1)(c) GDPR, and the legal basis for processing to safeguard our legitimate interests is Article 6(1)(f) GDPR. In the event that vital interests of the data subject or another natural person make the processing of personal data necessary, Article 6(1)(d) GDPR serves as the legal basis.
Collaboration with Processors and Third Parties
If we disclose data to other persons and companies (processors or third parties) in the course of our processing, transmit it to them, or otherwise grant them access to the data, this is done only on the basis of a legal permission (e.g., if a transmission of the data to third parties, such as payment service providers, is necessary for the performance of the contract according to Article 6(1)(b) GDPR), you have consented, a legal obligation provides for this, or on the basis of our legitimate interests (e.g., when using agents, web hosts, etc.). If we commission third parties with the processing of data on the basis of a so-called "processing contract," this is done on the basis of Article 28 GDPR.
Transfers to Third Countries
If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or this occurs in the context of the use of services of third parties or disclosure, or transmission of data to third parties, this is done only if it is necessary for the fulfillment of our (pre)contractual obligations, on the basis of your consent, due to a legal obligation, or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or allow the data to be processed in a third country only if the special requirements of Articles 44 ff. GDPR are met. This means that the processing of your data is carried out, for example, on the basis of special guarantees, such as the officially recognized determination by the EU Commission of a level of data protection corresponding to the EU, the Data Privacy Framework (DPF), or the observance of officially recognized special contractual obligations, so-called "standard contractual clauses."
Rights of Data Subjects
You have the right to request confirmation as to whether data concerning you is being processed and to obtain information about this data as well as further information and a copy of the data in accordance with Article 15 GDPR. You have the right to request the completion of data concerning you or the correction of incorrect data concerning you in accordance with Article 16 GDPR. You have the right to request that data concerning you be deleted immediately in accordance with Article 17 GDPR, or alternatively to request a restriction of the processing of the data in accordance with Article 18 GDPR. You have the right to request that the data concerning you that you have provided to us be received and to request its transmission to other controllers in accordance with Article 20 GDPR. You also have the right to lodge a complaint with the competent supervisory authority in accordance with Article 77 GDPR.
Right of Withdrawal
You have the right to withdraw consent given in accordance with Article 7(3) GDPR with effect for the future.
Right to Object
You can object to the future processing of data concerning you in accordance with Article 21 GDPR at any time. The objection can be made in particular against processing for purposes of direct marketing.
Cookies and Right to Object to Direct Marketing
"Cookies" are small files that are stored on users' computers. Various information can be stored within the cookies. A cookie primarily serves to store information about a user (or the device on which the cookie is stored) during or after their visit within an online offering. Temporary cookies, or "session cookies" or "transient cookies," are cookies that are deleted after a user leaves an online offering and closes their browser. For example, the content of a shopping cart in an online store or a login status can be stored in such a cookie. "Permanent" or "persistent" cookies are cookies that remain stored even after closing the browser. For example, the login status can be stored if users visit this after several days. Similarly, users' interests can be stored in such a cookie, which are used for reach measurement or marketing purposes. "Third-party cookies" are cookies that are offered by providers other than the controller who operates the online offering (otherwise, if it is only their cookies, they are referred to as "first-party cookies").
We may use temporary and permanent cookies and explain this in our privacy policy.
If users do not want cookies to be stored on their computer, they are asked to disable the corresponding option in their browser's system settings. Stored cookies can be deleted in the browser's system settings. The exclusion of cookies can lead to functional restrictions of this online offering.
A general objection to the use of cookies used for online marketing purposes can be declared for a variety of services, especially in the case of tracking, via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. Furthermore, the storage of cookies can be achieved by disabling them in the browser settings. Please note that not all functions of this online offering may be usable in that case.
Deletion of Data
The data processed by us will be deleted or restricted in its processing in accordance with Articles 17 and 18 GDPR. Unless expressly stated in this privacy policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and the deletion does not conflict with any statutory retention obligations. If the data is not deleted because it is required for other and legally permissible purposes, its processing will be restricted. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.
Hosting
The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, security services, and technical maintenance services that we use for the purpose of operating this online offering.
In this context, we, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties, and visitors to this online offering based on our legitimate interests in an efficient and secure provision of this online offering in accordance with Article 6(1)(f) GDPR in conjunction with Article 28 GDPR (conclusion of a processing contract).
Collection of Access Data and Log Files
We, or our hosting provider, collect data on the basis of our legitimate interests within the meaning of Article 6(1)(f) GDPR on every access to the server on which this service is located (so-called server log files). Access data includes the name of the retrieved website, file, date and time of retrieval, amount of data transferred, notification of successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address, and the requesting provider.
Log file information is stored for security reasons (e.g., to investigate misuse or fraud) for a maximum of 7 days and then deleted. Data whose further retention is required for evidence purposes is excluded from deletion until the respective incident is finally clarified.
Provision of Contractual Services
We process inventory data (e.g., names and addresses as well as contact data of users), contract data (e.g., services used, names of contact persons, payment information) for the purpose of fulfilling our contractual obligations and services in accordance with Article 6(1)(b) GDPR. The entries marked as mandatory in online forms are required for the conclusion of the contract.
As part of the use of our online services, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests, as well as the users' interest in protection against misuse and other unauthorized use. This data is generally not passed on to third parties unless it is necessary for the pursuit of our claims or there is a legal obligation to do so in accordance with Article 6(1)(c) GDPR.
We process usage data (e.g., the visited websites of our online offering, interest in our products) and content data (e.g., entries in the contact form or user profile) for advertising purposes in a user profile in order to show the user, for example, product information based on their previously used services.
The deletion of the data takes place after the expiry of statutory warranty and comparable obligations; the necessity of the retention of the data is reviewed every three years; in the case of statutory archiving obligations, the deletion takes place after their expiry. Information in any customer account remains until it is deleted.
Contacting Us
When contacting us (e.g., by email, phone, or via social media), the user's details are processed for the purpose of handling the contact request and its processing in accordance with Article 6(1)(b) GDPR. The user's details may be stored in a Customer Relationship Management System ("CRM System") or comparable inquiry organization.
We delete the inquiries if they are no longer necessary. We review the necessity every two years; furthermore, the statutory archiving obligations apply.
Links to Other Websites
This privacy statement applies exclusively to our own website. The websites in this offering may contain links (references) to third-party websites. Our privacy statement does not extend to these websites. When you leave our website, it is recommended that you carefully read the privacy policy of each website that collects personal data.
We maintain online presences within social networks and platforms to communicate with customers, interested parties, and users active there and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply.Unless otherwise stated in our privacy policy, we process the data of users if they communicate with us within social networks and platforms, e.g., write posts on our online presences or send us messages.
Google Tag Manager
Google Tag Manager is a solution from Google that allows us to manage website tags via an interface (e.g., Google Analytics with anonymization function). The Tag Manager itself does not process any personal data of users. Regarding the processing of users' personal data, please refer to the following information about Google services. Usage guidelines: Google Tag Manager Use Policy.
Google Analytics
Based on our legitimate interests (i.e., interest in the analysis, optimization, and economic operation of our online offering within the meaning of Article 6(1)(f) GDPR), we use Google Analytics, a web analytics service provided by Google LLC ("Google"). Google uses cookies. The information generated by the cookie about the use of the online offering by users is usually transmitted to a Google server in the USA and stored there.Google will use this information on our behalf to evaluate the use of our online offering by users, to compile reports on activities within this online offering, and to provide us with other services related to the use of this online offering and the internet. Pseudonymous user profiles of users can be created from the processed data.We use Google Analytics only with IP anonymization enabled. This means that the IP address of users is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.The IP address transmitted by the user's browser will not be merged with other data from Google. Users can prevent the storage of cookies by setting their browser software accordingly; users can also prevent the collection of data generated by the cookie and related to their use of the online offering by Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: Google Analytics Opt-out.For more information on data usage by Google, settings, and objection options, please visit Google's websites: Data Usage by Google ("Data usage by Google when you use websites or apps of our partners"), Google Ads Policies ("Data usage for advertising purposes"), Google Ads Settings ("Manage information that Google uses to show you ads").
Within our online offering, functions and content of the Xing service, offered by XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany, can be integrated. This may include content such as images, videos, or texts and buttons with which users can express their liking of the content, subscribe to the authors of the content, or our posts. If users are members of the Xing platform, Xing can assign the call-up of the above-mentioned content and functions to the profiles of the users there. Xing's privacy policy: Xing Data Protection.
Within our online offering, functions and content of the LinkedIn service, offered by LinkedIn AG, Dammtorstraße 29-32, 20354 Hamburg, Germany, can be integrated. This may include content such as images, videos, or texts and buttons with which users can express their liking of the content, subscribe to the authors of the content, or our posts. If users are members of the LinkedIn platform, LinkedIn can assign the call-up of the above-mentioned content and functions to the profiles of the users there. LinkedIn's privacy policy: LinkedIn Privacy Policy.
Data Protection in Applications and the Application Process
The controller collects and processes the personal data provided by applicants, such as cover letters, resumes, certificates, for the purpose of processing the application procedure. The processing can also take place electronically. This is particularly the case if an applicant submits corresponding application documents electronically, for example by email or via a web form on the website, to the controller. The web forms are automatically transferred to the cloud HR system. There is a redirection to a page operated by Personio SE & Co. KG. The hosting takes place within the EU, and the data is not passed on to third parties. If you apply for an open position, we process your personal data as described in the privacy policy on the career page (Personio Privacy Policy).If the controller concludes an employment contract with an applicant, the transmitted data will be stored for the purpose of processing the employment relationship in compliance with legal requirements. If the controller does not conclude an employment contract with the applicant, the application documents will be automatically deleted six months after the rejection decision is announced, provided that no other legitimate interests of the controller oppose the deletion. Other legitimate interest in this sense is, for example, a burden of proof in a procedure under the General Equal Treatment Act (AGG).
Management of Cookie Consents with Cookiebot
Our website uses the consent technology of Cookiebot to obtain your consent to the storage of certain cookies on your device or to the use of certain technologies and to document this in a data protection-compliant manner. The provider of this technology is Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (hereinafter "Cookiebot").
When you visit our website, a connection to Cookiebot's servers is established to obtain your consents and other declarations regarding cookie use. Cookiebot then stores a cookie in your browser to be able to assign the consents given or their revocation. Your IP address (the last three digits are set to '0'), date and time of consent, browser information, URL from which the consent was sent are processed. An anonymous, random, and encrypted key as well as the consent status of the end user are stored as proof of consent. The key and consent status are stored in the browser for 12 months using the "CookieConsent" cookie. This keeps your cookie preference for subsequent page requests. With the help of the key, your consent can be verified and tracked.
As of: 23.04.2025