5. NEWSLETTER

If you wish to receive the newsletter offered on the website, the operator needs an email address and information from you that allows the verification that you are the owner of the specified email address and agree to receive the newsletter. Further data will not be collected or only on a voluntary basis. The operator uses these data solely for sending the requested information and will not pass them on to third parties.

For subscriptions to our newsletter, we use the so-called double opt-in procedure. This means that when you register for the newsletter, we will send you an email asking you to confirm your registration. This confirmation serves to ensure that only persons who have access to the email address provided will subscribe to our newsletter. We log the registrations for the newsletter to be able to prove the registration process in compliance with the legal requirements. This includes the storing of the time of registration and the time of confirmation and of the IP address.

The data entered in the newsletter registration form are processed exclusively on the basis of your consent in accordance with Art. 6 (1) Sentence 1 (a), Art. 7 GDPR in conjunction with Section 7 (2) No. 3 UWG [German Act Against Unfair Competition] or on the basis of the legal permission in accordance with Section 7 (3) UWG. You can revoke the consent you gave for storing the data, the email address and their use for sending the newsletter at any time with effect for the future – via the “unsubscribe” link in the newsletter. The revocation will not affect the legality of the already effected data processing operations.
The operator will retain the data you provide for receiving the newsletter until you are unsubscribed from the newsletter and they will be deleted after the cancellation of the newsletter. This shall be without prejudice to data stored for other purposes by the operator (e.g. email addresses for the members’ area).

6.  Virtual tour

When you click on the link for the virtual 360° tour of some of our properties, you will be redirected to the website of the provider Nexpics. A new browser window will open. We will not process any further personal data and will not receive such data from the provider. The provider’s data privacy statement applies: https://www.nexpics.com/datenschutz.html

7.  VIDEO SURVEILLANCE ON THE EUREF CAMPUS

The roads and paths on the EUREF Campus are monitored by video for property protection. The property protection service has contractually agreed to abide by the applicable data protection regulations. The purpose of video surveillance is to protect you and your investments on the EUREF Campus and to prevent vandalism, burglary and theft.

All cameras are mounted so that they do not cover the windows of your leased areas or offices. The cameras on the property boundary cover only the immediate vicinity of the perimeter fences and walls and not public urban space or neighbouring buildings.

The legal basis for the video surveillance is our legitimate interest in accordance with Art. 6 (1) (f) GDPR.

The recordings are erased automatically after 48 hours. Image material is only passed on when an offence has been recorded. Recipients are solely the investigating law enforcement authorities.

8.          ONLINE SHOP

If you initiate an order in the operator’s online shop, your details from the inquiry form including the contact data you provide in it are stored by the operator for processing the inquiry, shipping the order and for the event of follow-up questions. These data will not be passed on without your consent.

The data entered in the online shop are processed on the basis of Art. 6 (1) (a) and (b) GDPR. You can revoke your consent at any time with effect for the future. This only requires an informal notification by email to datenschutz@euref.de. The legality of the data processing operations carried out up to the revocation remains unaffected by the revocation.

The data you entered in the online shop are retained by the operator, until you request their deletion, revoke your consent for storage or the purpose for storing the data no longer applies (e.g. after your order has been dealt with). This shall be without prejudice to mandatory statutory provisions – especially retention periods.

9.          SOCIAL MEDIA PRESENCE

We are active in social networks and on platforms, so that we can communicate with you and provide information about our services in social media as well.

We point out that this may entail processing of your data outside of the European Union and that usually the data will be processed for market research and advertising purposes. The behaviour and resulting interests of the users can be used to create user profiles. These user profiles may in turn be used, e.g., to place advertisements inside and outside of the platforms which presumably meet the user’s interests. To this end, cookies may be stored on the user’s computers which serve to store the usage behaviour and the interests of the users. Other data may also be stored in these user profiles, in particular if a user is a member of the platform and is logged in there.

On our website, we only link to our company profiles at the relevant social networks. Please note, however, that when you click on a link to a social network, data will be transmitted to that network’s servers. If you are logged in to that social network with your user name and password at the time, the information that you have visited our company profile on the social network from our website will be transmitted to it and the provider can save that information in your user account.

As a rule, we do not have any significant influence on the data processing of these social networks. However, we receive statistics from the providers about the use of and visits to our company profiles in the social networks (e.g. number of views, interactions such as likes and comments, summary demographic and other information or statistics). For more information about the data used by the providers please see the providers’ data protection statements linked below.

If we receive your personal data in the context of our social media presences (e.g. in the form of a message), you have the rights mentioned above in this data privacy statement. You can use the contact details above to send us your inquiries regarding data processing in the context of our company profiles.

If you wish to assert any further rights against the provider of the social network, the easiest way to do this is to contact the provider directly. The provider knows both the details of the technical operation of the platform and the associated data processing as well as the specific purposes of the data processing. The contact details are provided in the data privacy statements linked below. We will also be happy to assist you in asserting your rights, to the extent we can do this.

Personal data of users are as a rule processed on the basis of your consent (Art. 6 (1) Sentence 1 (a) GDPR). Moreover, the legal basis is Art. 6 (1) (b) GDPR if we receive and process your data through our social media presence on the occasion of a contract-related request. The legal basis for the linking and operation of our company profiles in social networks, including the receipt of statistics on the use of our company profiles, is Art. 6 (1) (f) GDPR, based on our legitimate interest in our corporate communication in the respective social networks.

For information about the relevant processing activities and the opt-out options please see the data privacy statements of the providers linked below:

• Facebook (Meta Platforms Limited Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland); we operate our Facebook page based on an agreement with Facebook regarding the joint processing of personal data – data privacy statement: https://www.facebook.com/about/privacy/, opt-out: https://www.facebook.com/settings?tab=ads und http://www.youronlinechoices.com.
• Instagram (Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland), online service for sharing photos and videos, data privacy statementhttps://help.instagram.com/519522125107875/?helpref=hc_fnav
• LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland), social network for maintaining existing and making new business contacts – data privacy statement https://www.linkedin.com/legal/privacy-policy, opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Twitter (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland), microblogging service – data privacy statement: https://twitter.com/de/privacy, opt-out: https://twitter.com/personalization

10.           DATA PROTECTION INFORMATION FOR JOB APPLICANTS

The operator hereby provides you as job applicant and thus as the party affected by the data processing with information about the processing of your personal data by the companies in the EUREF company group and the rights you have under data protection law. Furthermore, the operator’s general data protection policy also applies.

During the course of the application process, we process the following personal data:

– your master data (such as first name, surname, name affixes, date of birth) – work permit / residence permit

– contact data (such as private address, (mobile) telephone number, email address),

– “skills” data (e.g. special knowledge and skills)

– if relevant for the advertised position: health suitability

Your personal data will be collected from you during the course of the recruitment process, especially from the application documents, the job interview, where appropriate, from the agreement of a trial period and the personnel questionnaire.

The operator will also receive data from third parties (e.g. the Employment Agency during the course of a job placement).

The operator processes your personal data in compliance with the provisions of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (FDPA).

Primarily, the data processing serves the establishment of the employment relationship. The primary legal basis for this is Art. 6 (2) (a) GDPR.

Your data will be processed solely to fill the specific vacancy for which you have applied.

If your application is to be considered for other vacancies in the company, the operator will require your express consent thereto.

If you want to be included in an applicant pool should your application not be successful, the operator will require your express consent thereto.

If your application is not successful, your application documents will be deleted six months after the end of the application process at the latest, unless you have given us separate consent for longer retention (applicant pool).

If you are recruited, we will transfer your data from the application process and the application documents to your personnel file. Once the employment relationship ends, those personal data which we have to retain by law will continue to be stored. This arises as a rule from legal requirements for proof and retention, which are regulated, inter alia, in the Commercial Code and the Tax Code. The retention periods therein are up to ten years. In addition, personal data may be stored for the period during which claims can be asserted against us (statutory limitation period of three or up to thirty years).

Within the operator’s company, only those persons and departments involved in the decision to hire you will receive your personal data (HR department, specific department in question, company management).

11.           DATA TRANSMISSION TO THIRD COUNTRIES

Data will not be transferred to third countries (states outside of the European Union – EU).

12.           DATA TRANSMISSION TO THIRD COUNTRIES

Automated processing operations to bring about a decision are not used by the operator.

13.           WHISTLEBLOWER SYSTEM

Compliance with laws and internal regulations is a top priority for our company. Accordingly, we have supplemented our compliance system with a whistleblower system. Employees and business partners, but also third parties, may at any time report suspected cases of behaviour contrary to the rules.

Appropriate information can be provided in the context of our reporting procedure. The following personal data may be processed to gather hints and to clarify suspected cases of breaches of the rules: Details of the suspected person (e.g. surname, first name, function and employment details), details of the suspected breaches of conduct and details of the informant (e.g. surname, contact details). We ask the informant to refrain from providing sensitive information about the suspected persons, unless this is necessary to describe the matter.

The recipients of your data and your report are the internal compliance officers and, if required, other organisational units (e.g. the data protection officer) who need to be entrusted with clarifying the facts. Your personal data will as a rule not be transferred to any recipient outside of the EUREF Group. In certain cases, we may be obliged under Art. 14 (3) (a) GDPR to inform suspected persons within one month about the allegations made against them and the investigations carried out against them, which usually includes the following information: The fact that data have been stored, the categories of the data, the purpose of the processing and the identity of the controller and, if applicable, the whistleblower.

The establishment of our whistleblower system and the associated processing of personal data serves to fulfil legal obligations under Art. 6 (1) (c) GDPR in conj. w. Directive (EU) 2019/1937. Apart from this, we base the processing of personal data on a legitimate interest in the appropriate prevention and fighting of corruption in accordance with Art. 6 (1) (f) GDPR.

The personal data mentioned will be stored for as long as they are required for the clarification of the particular facts or for as long as they must be stored due to legal obligations.

As a rule, you as the informant can object to the processing of your personal data after you have submitted your report. However, we point out that we may be under a legal obligation in accordance with Art. 14 (3) (a) GDPR to disclose your personal data from the report. In that case, it may no longer be possible to stop the processing of your personal data despite your objection. Moreover, at the time of the objection, the processing of the data may have advanced so far already that deletion is no longer possible (if we, as the controller, have to clarify of the suspected case). Your objection to the processing of your personal data may also be ineffective if the nature of the hint requires the direct involvement of a public authority or a court. Once personal data have been disclosed to a public authority or a court, the data are located both in our documentation and in the case files of the public authority or court.

14.           EVENTS

If you register for one of our events, we will process your personal data for the purpose of the registration and for other purposes such as accreditation and follow-up. We may process categories of data such as contact data (name, address, email, telephone number, company) and, if applicable, also special categories of data such as health data (e.g. food allergies for catering). We also process these categories of personal data for accompanying persons if you register them.

If you have given your consent to the processing of data (this applies in particular to voluntary information), we will process your personal data on the basis of Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, insofar as special categories of data are processed in accordance with Art. 9 (1) GDPR. You can withdraw your consent at any time with future effect. If your data is required to fulfil a contract or to carry out pre-contractual measures (in particular mandatory information), we will process your data on the basis of Art. 6 (1) (b) GDPR.

Furthermore, we process your data if this is necessary to fulfil a legal obligation on the basis of Art. 6 (1) (c) GDPR (e.g. personal check in the case of high-profile events). Also, data may be processed on the basis of our legitimate interest in accordance with Art. 6 (1) (f) GDPR.

We will store the personal data we collect for the events for a period of six months after the end of the event, unless any other legal basis entitles or obliges us to store them for a longer period of time.

If you have registered for an event, it may be necessary to transfer your personal data to third parties (e.g. service providers) to fulfil the contract, in particular for the administration of participants. The data will be transmitted on the basis of a data processing agreement concluded with the third parties in accordance with Art. 28 GDPR.

15.           VIDEO RECORDING AND PHOTOS

In the context of events, we may make audio, photo and video recordings for the purpose of internal and external documentation. You may contact the photographer or cameraman at any time and state that you object to photos/videos of you being taken/made. You may also inform us after the event that you object to the processing of the recordings of your person (informal email is sufficient).

The legal basis for the data processing in the context of the production of the recordings is Art. 6 (1) (f) GDPR, based on our interest in documenting the event and our public image.

We may use the recordings made for documentation and external presentation purposes on our website and, possibly, in our social media profiles (Facebook, X, Instagram, LinkedIn) and in offline publications. When we do this, we will first edit the recordings (e.g. by selecting an image section) and then put the edited recordings online without naming you. As far as possible, we will try to use images in which you merely are an accessory.

The providers of the social media platforms may process and use for their own purposes the data that are posted on the platforms. This data processing is beyond our direct control.

16.           CAMPUS CATERING

Companies can use our campus catering services offered at our online store. To place orders, you need to register a user account. Using the login data provided, you can place your orders in the personal area.

For this registration, we may process personal data such as email address and other contact details. This will be done on the basis of (pre-)contractual measures in accordance with Art. 6 (1) (b) GDPR. On request, the user account will be deleted and the personal data linked to the account will be erased immediately. Contract data will be stored for up to three years after conclusion of a contract. Invoices will be stored for up to ten years.

Changes to this data protection information

The operator revises this data protection information when there are changes to this website or for other reasons that render this necessary. You can always find the latest version on this website. If you have any questions about data protection, please do not hesitate to contact the operator.

As of 30 August 2024