Data Privacy

Data Privacy

As of January 2024

Introduction

With the following information, we want to give you an overview of the processing of your personal data on our website www.cremanski.com (hereinafter “website”). We also want to inform you about your rights under data protection law. We always process your personal data in accordance with the General Data Protection Regulation (hereinafter “GDPR”) and all applicable country-specific data protection provisions.

1. Controller

The controller within the meaning of the GDPR is:

Cremanski & Company GmbH, Schwedter Str. 22, 10119 Berlin, Germany

Phone: +49 30 31192557

Email: sales@cremanski.com

2. Data protection officer

You can reach our data protection officer as follows:

secjur GmbH, Falkensteiner Ufer 40, 22587 Hamburg

Phone: +49 40/80 90 81 146

Email: dsb@secjur.com

You can contact our data protection officer directly at any time with any questions or suggestions about data protection and to exercise your rights.

3. Use of third-party services

For certain functions and services on our website, we use services from third-party providers. The specific services are listed in the relevant sections.

In some cases we use service providers based in a third country, i.e. outside the EU. We only transfer data to a third country where an adequate level of data protection or appropriate safeguards within the meaning of Art. 44–49 GDPR exist. You have the right to request a copy of the appropriate safeguards we have put in place. To do so, please email us at the address given in this privacy notice.

4. Provision of the website

4.1 General information

When you visit our website, data that your browser transmits to our server is processed automatically. This general data and information is stored in the server's log files (“server log files”).

The following may be recorded:

- Browser type and browser version

- Operating system used

- Referrer URL (previously visited website)

- Host name of the accessing computer

- Date and time of the server request

- IP address

We use Webflow, Inc. as our server operator. According to its own information, Webflow transfers data to the USA.

4.2 Purpose of processing

When using this general data and information, we do not draw any conclusions about you personally. Our purposes include in particular:

- ensuring a smooth connection to the website,

- investigating misuse or fraud,

- network problem analysis, and

- evaluating system security and stability.

4.3 Legal basis

The legal basis for data processing is our legitimate interest within the meaning of Art. 6(1)(f) GDPR. We have an overriding legitimate interest in being able to offer our services in a technically flawless manner.

4.4 Storage period

Unless a more specific storage period is stated in this privacy notice, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once these reasons no longer apply.

4.5 Recipients of personal data

Provider: Amazon Web Services

Address: 410 Terry Avenue North, Seattle WA 98109, United States

Third country: USA

Appropriate safeguard: Standard contractual clauses

Further information: https://aws.amazon.com/de/about-aws/global-infrastructure/localzones/locations/

5. Cookies and similar technologies

5.1 General information

We use cookies and comparable technologies (hereinafter “cookies”) on our website. These are text files that your browser creates automatically and that are stored on your device when you visit our site. The cookie stores information relating to the specific device used.

5.2 Technically necessary cookies

We use technically necessary cookies. These are cookies that are technically required to provide all functions of our website.

5.2.1 Purpose of processing

We use technically necessary cookies for the following purposes:

- to offer services,

- to enable the use of our website functions,

- and to offer different languages.

5.2.2 Legal basis

The legal basis for data processing is our legitimate interest within the meaning of Art. 6(1)(f) GDPR. We have an overriding legitimate interest in being able to offer our services in a technically flawless manner.

5.2.3 Storage period

We delete your personal data as soon as it is no longer required to achieve the purpose for which it was collected. Technically necessary cookies are only stored for the respective session. When you leave our website and close your browser, the cookies are deleted.

Recipients of personal data

We use the following service providers:

Provider: Google

Address: Gordon House, Barrow Street, Dublin 4, Ireland

Third country: USA

Appropriate safeguard: Standard contractual clauses

Further information: Google Privacy Policy & Terms

Provider: Webflow

Address: 398 11th Street, 2nd Floor, San Francisco, CA 94103

Third country: USA

Appropriate safeguard: Standard contractual clauses

Further information: https://webflow.com/legal/dpa

5.3 Analytics and marketing cookies

We also use analytics and marketing cookies. These are cookies that are not technically required. We use them to understand your behaviour on our website and to improve our offering.

5.3.1 Purpose of processing

We use these cookies for the following purposes:

- reach measurement and tracking,

- analysis of visitor behaviour,

- optimisation of our offering,

- and targeted advertising.

5.3.2 Legal basis

The legal basis for data processing is your consent pursuant to Art. 6(1)(a) GDPR. The cookies are only set after you have given your consent via our cookie banner.

5.3.3 Storage period

We delete your personal data as soon as it is no longer required to achieve the purpose for which it was collected. The storage period of the personal data depends on the providers used.

5.3.4 Recipients of personal data

We use the following service providers:

Provider: LinkedIn

Address: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

Appropriate safeguard: Standard contractual clauses

Further information: LinkedIn Insight Tag privacy policy

Provider: Google

Address: Gordon House, Barrow Street, Dublin 4, Ireland

Third country: USA

Appropriate safeguard: Standard contractual clauses

Further information: Google Analytics privacy information

Provider: Google

Address: Gordon House, Barrow Street, Dublin 4, Ireland

Third country: USA

Appropriate safeguard: Standard contractual clauses

Further information: reCAPTCHA, Google Privacy Policy & Terms

6. Online appointment calendar

6.1 General information

Via our website, you can book an appointment with our team using the “Book a meeting” button. You will then be redirected to the Calendly website.

In this context, we process the following personal data:

- Name

- Email

- Date and time of the request

- IP address

- Other personal data you provide to us when getting in touch.

6.2 Purpose of processing

We process your data to answer your request and to organise any resulting appointments.

6.3 Recipients of personal data

Provider: Calendly

Address: 88 N Avondale Rd Ste 603, Avondale Estates, GA

Third country: USA

Appropriate safeguard: Standard contractual clauses

Further information: Calendly Privacy Policy

6.4 Legal basis

If your request relates to pre-contractual measures or to an existing contract with us, the legal basis is the performance of a contract and the implementation of pre-contractual measures pursuant to Art. 6(1)(b) GDPR.

If your request is made independently of contractual or pre-contractual measures, our overriding legitimate interests pursuant to Art. 6(1)(f) GDPR form the legal basis. The overriding legitimate interest corresponds to the purposes stated above.

6.5 Storage period

If no contract is concluded, we delete your data as soon as the communication has ended. If a contract is concluded between you and us, we store the data until the end of the contractual relationship or until the end of the statutory retention periods.

7. Contact options

7.1 General information

Via our website, you can contact us by email or via our form.

When you contact us and we answer your request, we process the following personal data:

- Name

- Email

- Date and time of the request

- IP address

- Organisation

- Other personal data you provide to us when getting in touch.

7.2 Purpose of processing

We process your data to answer your request and to handle any resulting matters.

7.3 Legal basis

If your request relates to pre-contractual measures or to an existing contract with us, the legal basis is the performance of a contract and the implementation of pre-contractual measures pursuant to Art. 6(1)(b) GDPR.

If your request is made independently of contractual or pre-contractual measures, our overriding legitimate interests pursuant to Art. 6(1)(f) GDPR form the legal basis. The overriding legitimate interest corresponds to the purposes stated above.

7.4 Storage period

We delete your personal data as soon as it is no longer required to achieve the purpose for which it was collected. For contact requests, this is generally the case when the circumstances show that the matter in question has been fully resolved.

7.5 Recipients of personal data

We use the following service providers:

Provider: Google

Address: Gordon House, Barrow Street, Dublin 4, Ireland

Third country: USA

Appropriate safeguard: Standard contractual clauses

Further information: Google Privacy Policy & Terms

Provider: Salesforce

Address: Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105

Third country: USA

Appropriate safeguard: Standard contractual clauses

Further information: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/EU-Data-Transfer-Mechanisms-FAQ.pdf

8. Newsletter

8.1 General information

We offer you the opportunity to receive information about our services. With our newsletter, we regularly inform customers and business partners about our offers.

When sending the newsletter, we process the following personal data:

- Email address

- First and last name

- Metadata (e.g. device information, IP address, date and time of registration)

8.1.1 Newsletter registration

If you register for the newsletter via our website, we send a confirmation email using the double opt-in procedure to the email address you first entered. This confirmation email serves to verify whether you, as the owner of the email address, have authorised receipt of the newsletter. Your newsletter registration is logged.

8.1.2 Newsletter for existing customers

If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers by email for goods or services similar to those already purchased, unless you have objected. Under Section 7(3) of the German Act Against Unfair Competition (UWG), we do not need to obtain separate consent from you for this. You can object to this at any time, and we will point this out to you in every email.

8.1.3 Newsletter tracking

Our newsletters contain so-called tracking pixels. These are miniature graphics embedded in emails. They allow us, for example, to see whether and when you opened an email and which links in the email you clicked. This enables us to statistically evaluate the success or failure of online marketing campaigns. The personal data collected through tracking pixels is stored and analysed by us in order to optimise the newsletter and tailor the content of future newsletters even better to your interests.

8.2 Purpose of processing

We process your personal data for the following purposes:

- Sending the newsletter: carrying out marketing activities.

- Double opt-in procedure: fulfilling our statutory obligations to provide evidence.

- Newsletter tracking: displaying personalised advertising, market research, measuring success.

8.3 Legal basis

The legal basis for processing your personal data in the context of:

- the newsletter subscription is your consent pursuant to Art. 6(1)(a) GDPR,

- the double opt-in procedure is our legal obligation pursuant to Art. 6(1)(c) GDPR,

- sending the newsletter to existing customers is our overriding legitimate interest pursuant to Art. 6(1)(f) GDPR,

- and newsletter tracking is your consent pursuant to Art. 6(1)(a) GDPR.

8.4 Storage period

We delete your personal data as soon as it is no longer required to achieve the purpose for which it was collected. For the newsletter, this is generally the case when you revoke your consent or object to the processing.

Every newsletter therefore contains an opt-out link. You can also unsubscribe from the newsletter at any time on our website or let us know in another way. We automatically treat unsubscribing from the newsletter as a revocation of consent or an objection.

8.5 Recipients of personal data

We use the following service providers:

Provider: Salesforce

Address: Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105

Third country: USA

Appropriate safeguard: Standard contractual clauses

Further information: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/EU-Data-Transfer-Mechanisms-FAQ.pdf

9. Job applications

9.1 General information

We offer you the opportunity to apply for job vacancies and to send us your application online or by post.

As part of the application process, we process the following personal data:

- Master data (e.g. first and last name, address),

- Contact data (e.g. email address, phone number),

- Application data (e.g. cover letter, CV, references and other certificates)

- Salary expectations

- Availability

9.2 Purpose of processing

The purpose of processing is to carry out the application process.

9.3 Legal basis

The legal basis for processing personal data is the performance of a contract and the implementation of pre-contractual measures pursuant to Art. 6(1)(b) and Art. 88(1) GDPR in conjunction with Section 26(1) of the German Federal Data Protection Act (BDSG).

Where we obtain your consent (e.g. for inclusion in our talent pool), this consent forms the legal basis for the data processing.

9.4 Storage period

If an employment relationship is established after the application process, the personal data provided may be processed further. Otherwise, we generally retain the data for 180 days after the end of the application process and then delete all personal data. Longer storage is possible if we add your personal data to our talent pool after obtaining your consent.

9.5 Recipients of personal data

We use the following service providers:

Provider: Personio

Address: Rundfunkplatz 4, 80335 Munich, Germany

Further information: Personio privacy policy

Provider: LinkedIn Recruiter Lite

Address: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

Further information: LinkedIn privacy policy

10. Social networks

10.1 General information

We maintain profiles on social networks in order to communicate with you and inform you about our services. When you visit our pages, the social networks process your personal data. As operator of the page, we have no influence on how the social networks process the data. For further information, please see the networks' privacy policies.

10.2 Purpose of processing

The purpose of processing is maintaining a presence on social media.

10.3 Legal basis

The legal basis for processing personal data is our overriding legitimate interest pursuant to Art. 6(1)(f) GDPR. The overriding legitimate interest corresponds to the purposes stated above.

10.4 Recipients of personal data

We maintain profiles on the following social media:

Social network: LinkedIn

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

Third country: USA

Appropriate safeguard: Standard contractual clauses

Further information: privacy notice, opt-out and advertising settings, joint controller agreement

Social network: Facebook

Provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Third country: USA

Appropriate safeguard: Standard contractual clauses

Further information: privacy notice, objection settings, joint controller agreement

Social network: Instagram

Provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Third country: USA

Appropriate safeguard: Standard contractual clauses

Further information: privacy notice, objection settings

Social network: XING

Provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany

Further information: privacy notice, objection settings

Social network: YouTube

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Third country: USA

Appropriate safeguard: Standard contractual clauses

Further information: privacy notice, objection settings

11. Your rights

11.1 Right to confirmation

You have the right to request confirmation from us as to whether personal data concerning you is being processed.

11.2 Access (Art. 15 GDPR)

You have the right to obtain from us, at any time and free of charge, information about the personal data stored about you and a copy of this data in accordance with the statutory provisions.

11.3 Rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data.

11.4 Erasure (Art. 17 GDPR)

You have the right to request that we erase personal data concerning you without undue delay if one of the statutory grounds applies and insofar as the processing or storage is not required.

11.5 Restriction of processing (Art. 18 GDPR)

You have the right to request that we restrict processing if one of the statutory conditions is met.

11.6 Data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, where the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability pursuant to Art. 20(1) GDPR, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided this does not adversely affect the rights and freedoms of others.

11.7 Objection (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on processing in the public interest pursuant to Art. 6(1)(e) GDPR or on our legitimate interest pursuant to Art. 6(1)(f) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

In individual cases, we process personal data for direct marketing. You can object at any time to the processing of personal data for such marketing. If you object to processing for direct marketing purposes, we will no longer process the personal data for these purposes.

11.8 Withdrawal of consent under data protection law

You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.

11.9 Complaint to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of personal data.

The supervisory authority responsible for us:

Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin

Phone: +49 30 13889-0

Fax: +49 30 2155050

Email: mailbox@datenschutz-berlin.de

12. Currency and changes to this privacy notice

This privacy notice is currently valid and dated January 2024.

As we develop our website and our offers further, or if legal or regulatory requirements change, it may become necessary to amend this privacy notice. You can view the current privacy notice on this page at any time.

Let's collaborate on your growth journey

Get in touch today to unlock your potential and achieve sustainable revenue growth.