1. Data privacy at a glance

General information

The following information provides an overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. Detailed information on data privacy can be found in our Privacy Policy below this text.

Data collection on this website

Who is responsible for collecting data on this website?

The operator of the website is responsible for the processing of data on this website. The contact details for this person can be found under “Information on the responsible body” in this privacy policy.

How do you collect your data?

Your data are collected in part by you providing us with such. This can include data you enter into the contact form.

Other data is collected by our IT systems automatically, or after you give your consent, when visiting the website. This is primarily technical data (e.g. web browser, operating system, time of page request). This data is collected automatically as soon as you access this website.

What do you use your data for?

Some of the data is collected in order to ensure reliable operation of the website. Other data may be used to analyse how you use the website.

What rights do you have regarding your data?

You have the right to receive, free of charge and at any time, information about the origin, recipient and purpose of the personal data we hold about you. You also have the right to have this data corrected or deleted. If you have given consent for your data to be processed, then you may withdraw your consent at any time, effective from that point forward. You also have the right, under certain circumstances, to request all further processing of your personal data be blocked. Further, you have the right to lodge a complaint with the relevant supervisory authority.

You may contact us at any time if you have any questions in this regard or about data privacy in general.

Analytics tools and tools from third-party providers

When you visit this website, you surfing behaviour can be statistically analysed. This is done using “analytics programs”.

Detailed information about this analytics programs can be found in the following privacy policy.

2. Hosting

External hosting

This website is hosted by an external hosting service provider (host). Personal data collected through this website is stored on the host’s servers. This primarily includes IP addresses, contact enquiries, meta and communication data, contract data, contact data, names, website accesses and other data generated via a website.

This data is used by the host for the purpose of contract fulfilment with our potential and existing customers (Article 6 Para 1b GDPR) and in the interests of ensuring the secure, fast and efficient provision of our online offer by a professional service provider (Article 6 Para 1f GDPR).

Our hosting provider processes your data only to the extent necessary to fulfil their service obligations and must follow all instructions from us in regards to this data.

We use the following hosting provider:

netcup GmbH
Daimlerstrasse 25
D-76185 Karlsruhe

Personal data processing contract

We have a contract for the processing of personal data with the above named service provider. This a contract as required by data protection law which guarantees that the personal data of our website visitors will be processed following our directions and in accordance with the provisions of the GDPR.

3. General information and required information

Data protection

The operators of this site take the protection of your personal data very seriously. We handle all your personal data confidentially and in accordance with the applicable data protection regulations as well as this privacy policy.

If you use this website, various personal data will be collected. Personal data is any data that can be used to personally identify you. This privacy policy explains which data we collect and what we use it for. It also explains the purpose for this use.

Please be aware that data transmitted over the internet (e.g. email communication) can be exposed to security vulnerabilities. Complete protection of data against access by third parties is not possible.

Information on the responsible body

The responsible body for data processing on this website is:

Peppermint Holding GmbH
Neues Kranzler Eck
Kurfürstendamm 21
10719 Berlin

Phone: +49 30 590064-400
Email: +49 30 590064-401

The responsible body is the natural or legal person that, alone or together with others, decides on the purpose and means for processing personal data (e.g. names, email address, etc.)

Retention period

Unless otherwise indicated within this privacy policy, your personal data will be retained until such time as the purpose for holding the data for processing no longer applies. If you wish to make a valid request for your data to be deleted, or you withdraw your consent for processing, then your data will be deleted insofar as no other legal grounds for the retention of your personal data exist (e.g. retention periods under tax or commercial law); in the case of the latter, your data will be deleted where these reasons no longer apply.

Data protection office

We have appointed a data protection officer for our company.

Steffen Stiehler
Beratung, Service & Weiterbildung GmbH
Rudolf-Walther-Strasse 4
01108 Dresden

Tel.: 0351 4250280
Email: datenschutz@peppermint.biz

Information on data transfer to the USA and other third countries

We make use of tools provided by companies based in the USA and other third countries considered insecure in terms of data protection legislation. When these tools are active, you personal data may be transmitted to these third countries and processed there. Please be aware that we cannot guarantee that these countries have data protection legislation that is comparable with that of the EU. For example, companies in the US are required to disclose personal data to the security services without the data subject having any legal recourse to prevent this. The possibility exists therefore, that the US authorities (e.g. secret services) might process, analyse and permanently store your personal data for monitoring purposes. We have no influence over these processing activities.

Withdrawal of your consent to data processing

Many data processing activities are possible only with your express consent. You may withdraw your consent at any time. The legal basis for continued processing of your data until consent is withdrawn remains unaffected.

Right to object to data collection in special cases as well as to direct marketing (Article 21 GDPR)

YOU HAVE THE RIGHT TO OBJECT, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOURSELF WHERE SUCH PROCESSING IS BASED ON POINT (E) OR (F) OF ARTICLE 6(1), INCLUDING PROFILING BASED ON THOSE PROVISIONS. THE LEGAL BASIS FOR PROCESSING CAN BE FOUND IN THIS PRIVACY POLICY. WHEN YOU SUBMIT YOUR OBJECTION, WE SHALL NO LONGER PROCESS THE PERSONAL DATA UNLESS THE CONTROLLER DEMONSTRATES COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE THE INTERESTS, RIGHTS AND FREEDOMS OF THE DATA SUBJECT OR FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION ACCORDING TO ARTICLE 21 PARA 1 GDPR

WHERE PERSONAL DATA ARE PROCESSED FOR DIRECT MARKETING PURPOSES, THE DATA SUBJECT SHALL HAVE THE RIGHT TO OBJECT AT ANY TIME TO PROCESSING OF PERSONAL DATA CONCERNING HIM OR HER FOR SUCH MARKETING, WHICH INCLUDES PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECTS TO PROCESSING, YOUR PERSONAL DATA SHALL NO LONGER BE PROCESSED FOR THE PURPOSES OF DIRECT MARKETING (OBJECTION ACCORDING TO ARTICLE 21 PARA 2 GDPR).

Right to lodge a complaint with the relevant supervisory authority

In cases where the regulations of the GDPR have been breached, the data subject has a right to lodge a complaint in the member state in which they normally reside, where their workplace is located, or in the location of the alleged breach. The right to lodge a complaint remains unaffected by any other administrative or legal remedies.

Right to data portability

You have the right to receive your personal data, which we process based upon your consent or for the fulfilment of a contract, in a commonly used and machine-readable format. Where you request that your data be directly transferred to another data controller, we will only do so if this is technically feasible.

SSL/TLS encryption

For the purposes of security and to protect the transfer of confidential data such as orders or enquiries that you send to us as the site operator, this site uses SSL/TLS encryption. An encryption connected can be recognised by the use of “https://” instead of “http://” and the padlock symbol in the address bar of your browser.

When SSL/TLS encryption is enabled, any data transmitted to us cannot be read by third parties.

Information, deletion and rectification

The applicable legal regulations provide you with the right to receive a copy, free of charge, of the personal data we hold about you, where it was acquired, the recipients, and the purpose for which the data is processed. You further have the right to request rectification or deletion of this data. If you wish to exercise these rights or have any further questions about data privacy, please get in touch with us.

Right to restrict processing

You have the right to request for the processing of your personal data to be restricted. Please get in touch with us if you wish to exercise this right. The right to restrict processing applies in the following cases:

• If you do not believe the personal data we hold about you to be correct, we generally require a period of time to check this. During the period in which the data is being checked, you may request for the processing of your data to be restricted.
• If your personal data is being/has been wrongfully processed, you may request for processing to be restricted instead of deleted.
• If we no longer require your personal data but you require it still for exercising, defending or making legal claims, then you may request that your data is restricted from processing instead of deleted.
• If you have submitted as objection in accordance with Article 21 Para 1 GDPR, consideration must be given to both your interests and ours. Insofar as it remains undecided whose interests take precedence, you may request that the processing of your data be restricted.

If processing of your data has been restricted, aside from being stored, this data may be processed only with your consent or in order to make, exercise or defend against legal claims, or in order to protect the rights of another natural or legal person, or where such processing is strongly within the public interest of the European Union or a member state.

Objection to marketing emails

The use of the contact data published in accordance with the German Telemedia Act for sending marketing and information materials that have not been expressly requested is not permitted. The operator of these website reserve the right to take legal steps in the event that unsolicited marketing materials are received, e.g. spam emails.

4. Data collection on this website

Cookies

Our internet pages make use of “cookies”. Cookies are small text files that are stored on your computer and cause no harm. They are either temporary for the duration of your visit (session cookies) or permanently stored on your device. Session cookies are automatically deleted at the end of your visit. Permanent cookies remain on your device until such time as you delete them yourself or they are automatically deleted by your web browser.

In some cases, cookies from third parties may be stored on your device when visiting our site (third party cookies). These cookies enable us or you to make use of particular third party services (e.g. cookies for payment processing services).

Cookies serve a range of different functions. Many cookies are technically necessary for various features of the website to function (e.g. shopping basket features or for videos to be displayed). Other cookies serve to evaluate user behaviour or to display advertising.

Cookies necessary for electronic communication processes (essential cookies) or for the provision of certain desirable functions (functional cookies, e.g. shopping basket features) or for optimising the website (e.g. cookies for analysing visitor metrics) are, where no other legal basis is indicated, stored based upon Article 6 Para 1f GDPR. The website operator has a legitimate interest in the storage of cookies in order to ensure the technical ability to deliver their services free from faults and to optimise their services. Where the consent to store cookies has been requested, the affected cookies will be stored exclusively on the bases of this consent (Article 6 Para 1a GDPR); you may withdraw your consent at any time.

You can configure you browser to inform you every time cookies are set and only cookies on a case-by-case basis, allow cookies to be set in certain specific cases, or altogether block cookies as well as activate the automatic deletion of all cookies when closing the browser. Disabling cookies can restrict the functionality of this website.

Where cookies from third parties or analytics cookies are used, you will be separately informed in this privacy policy and, where applicable, will be asked for your consent.

Consent using Cookiebot

Our website uses the consent technology from Cookiebot in order to collect your consent for the storage of certain cookies on your device or for the use of certain technologies and to record this consent in compliance with data privacy legislation. The provider of this technology is Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (hereinafter referred to as “Cookiebot”).

When you access our website, a connection to the Cookiebot servers is established in order to request your consent and provide other information about cookie use. Cookiebot then stores a cookie in your browser indicating the consents and refusals given. The recorded data is stored until such time as you request its deletion, you delete Cookiebot cookie, or the purpose for the storage of the data no longer applies. Legally required retention periods remain unaffected.

The use of Cookiebot is based upon the legal requirement to collect consent for the use of cookies. The legal basis for this Article 6 Para 1c GDPR.

Server log files

The site provider automatically collects and stores information in server log files. This information is automatically sent to us by your browser. This data includes:

• Browser type and version
• operating system
• referrer URL
• computer hostname
• time of server request
• IP address

This data will not be combined with any other data sources.

This data is collected based upon Article 6 Para 1f GDPR. The website operator has a legitimate interest in providing their website free from technical faults and optimising its delivery - for these reasons it is necessary to keep server log files.

Contact form

If you make use of our contact form to send an enquiry, the data you enter into the form, including the contact data you provide, will be stored for the purposes of processing your enquiry and asking any follow-up questions. This data will not be passed on to others without your consent.

The legal basis for processing this data is Article 6 Para 1b GDPR insofar as your enquiry relates to the fulfilment of a contract or for carrying out actions in advance of a contract. In all other cases, the legal basis for processing is our legitimate interest in effective processing your enquiry (Article 6 Para 1f GDPR), or your consent (Article 6 Para 1a GDPR) where this has been asked for.

The data you enter into the contact form remain with us until such time as you request its deletion, you withdraw your consent for its storage, or the purpose for which the data is being stored no longer applies (e.g. once your enquiry has been fully processed). Legal requirements, particularly in relation to retention periods, remain unaffected.

Enquiries via email, telephone and fax

If you contact us by email, telephone or fax, you enquiry, including all personal data associated with it (name, enquiry) will be stored and processed by us for the purpose of dealing with your enquiry. This data will not be passed on to others without your consent.

The legal basis for processing this data is Article 6 Para 1b GDPR insofar as your enquiry relates to the fulfilment of a contract or for carrying out actions in advance of a contract. In all other cases, the legal basis for processing is our legitimate interest in effective processing your enquiry (Article 6 Para 1f GDPR), or your consent (Article 6 Para 1a GDPR) where this has been asked for.

The data you send us as part of your contact enquiry remain with us until such time as you request its deletion, you withdraw your consent for its storage, or the purpose for which the data is being stored no longer applies (e.g. once your enquiry has been fully processed). Legal requirements, particularly in relation to retention periods, remain unaffected.

5. Analytics tools and advertising

Google Analytics

This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Analytics allows the website operator to analyse the behaviour of website visitors. The website operator receives various usage data such as page requests, length of stay, operating system used and origin of the user. Google may link this data with a profile associated with the user or device.

Google Analytics further allows us to record your mouse and scrolling movements and clicks, among other things. Furthermore, Google Analytics uses various modelling techniques to enhance to the collected datasets and uses machine learning technologies to analyse data.

Google Analytics uses technologies for recognising users in order to analyse user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the user’s use of the website is usually transferred to a Google server in the USA and stored there.

The legal basis for the use of this analytics tool is Article 6 Para 1f GDPR. The website operator has a legitimate interest in the analysis of user behaviour in order to optimise both their online offering and advertising. Where the corresponding consent has been requested (e.g. consent to the storage of cookies), the exclusive legal basis for processing if Article 6 Para 1a GDPR; you may withdraw your consent at any time.

Data transfer to the USA is based upon the standard contract clauses of the EU Commission. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/.

IP anonymisation

We have enabled IP anonymisation on this website. This means that your IP address is shortened by Google within member states of the European Union or in other contracting states of the agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. Google will use this information to evaluate your use of the website in order to put together reports about website activities on behalf of the website operator and in order to provide the website operator with services associated with the use of the website and the internet. The IP address sent by your browser as part of Google Analytics will not be linked with other data held by Google

Browser plugin

You can prevent the collection and processing of your data by Google by downloading and installing the plugin available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

More information about how Google Analytics makes use of user data can be found in the Google’s privacy policy https://support.google.com/analytics/answer/6004245?hl=de.

Processing of personal data

We have made a contract with Google regarding the processing of personal data and fully implement the strict regulations of the German data protection authorities when using Google Analytics.

Retention period

User and event level data stored by Google which are associated with cookies, user detection (e.g. User ID) or advertising IDs (e.g. DoubleClick cookies, Android advertising ID) will be anonymised or deleted after a period of 14 months. Detail can be found at the following link: https://support.google.com/analytics/answer/7667196?hl=de

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising program provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Ads allows us to display advertising in Google search machine results or on third-party websites when a user enters specific search terms (keyword targeting). Targeted advertising can be displayed using user data (e.g. location data and interests) held by Google (audience targeting). As website operator, we can quantitively evaluate this data, e.g. by analysing which search terms result in our ads being displayed and how many ads were subsequently clicked.

The legal basis for the use of Google Ads is Article 6 Para 1f GDPR. The website operator has a legitimate interest in having the most effective marketing possible for their service or products.

Data transfer to the USA is based upon the standard contract clauses of the EU Commission. Details can be found here: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/.

Google Remarketing

This website uses functions of Google Analytics Remarketing. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Remarketing analyses your user behaviour on our website (e.g. clicking on specific products) in order to allocate you to a specific advertising target group and to then display relevant advertising message to your when visiting other online services (remarketing or retargeting).

Furthermore, target groups created using Google Remarketing can be linked with Google’s cross-device functions. This allows relevant personalised advertising messages based on your previous usage and surfing behaviour to be displayed on one of your devices (e.g. mobile phone) as well as on other devices you use (e.g. tablet or PC).

If you have a Google account, you can opt-out of personalised advertising via the following link: https://www.google.com/settings/ads/onweb/.

The legal basis for the use of Google Ads is Article 6 Para 1f GDPR. The website operator has a legitimate interest in having the most effective marketing possible for their service or products. Where the corresponding consent has been requested, the exclusive legal basis for processing if Article 6 Para 1a GDPR; you may withdraw your consent at any time.

Further information and Google’s privacy policy can be found at: https://policies.google.com/technologies/ads?hl=de.

Google Conversion Tracking

This website uses Google Conversion Tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Conversion Tracking allows the website operator to determine if a user has taken a particular action. This allows us to, for example, see which buttons on our website a frequently clicked and which products are frequently viewed or purchased. This information helps us produce conversion statistics. We receive information on the total number of users that clicked on our adverts and what actions they then took. We do not receive any information that allows us to personally identify an individual. Google itself uses cookies and other similar technologies to recognise users.

The legal basis for the use of Google Conversion Tracking is Article 6 Para 1f GDPR. The website operator has a legitimate interest in the analysis of user behaviour in order to optimise both their online offering and advertising. Where the corresponding consent has been requested (e.g. consent to the storage of cookies), the exclusive legal basis for processing if Article 6 Para 1a GDPR; you may withdraw your consent at any time.

More information about Google Conversion Tracking can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Facebook Pixel

This website uses the visitor action pixel from Facebook to measure conversion. Provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, collected data is transmitted to the USA and other third countries.

This allows the activities of the site visitor to be followed after the visitor clicks on a Facebook ad on the provider’s website. The allows the effectiveness of Facebook ads to be evaluated for statistical and market research purposes and subsequently optimised for future advertising campaigns.

The data collected is for us as operator of this website anonymous. We cannot make any determinations regarding the identity of users. Data is, however, stored and processed by Facebook such that it can be linked to a user profile and that Facebook can use the data for its own advertising purposes in accordance with the Facebook privacy policy. This allows Facebook to display ads on its own pages and on pages external to Facebook. As website operator, we have no influence over the use of the data.

The legal basis for the use of Google Ads is Article 6 Para 1f GDPR. The website operator has a legitimate interest in effective marketing that includes social media. Where the corresponding consent has been requested (e.g. consent to the storage of cookies), the exclusive legal basis for processing if Article 6 Para 1a GDPR; you may withdraw your consent at any time.

Data transfer to the USA is based upon the standard contract clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

Where personal data is collected on our website and passed on to Facebook using the tools described here, both we and Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly the data processor (Article 26 GDPR). This joint responsibility is limited exclusively to the collection of data and its transfer to Facebook. Processing carried out by Facebook once the data has been transferred is not part of this joint responsibility. Our joint obligations are set down in an agreement for joint processing. The wording of this agreement can be found at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing data privacy information when using the Facebook tool and for ensuring secure implementation of the tool on our website in accordance with data privacy legislation. Facebook is responsible for the data security of Facebook products. The rights of data subjects (e.g. right to information) with regard to the data processed by Facebook are to be exercised with Facebook directly. If you exercise your rights as a data subject with us, then we are obligated to pass your claim on to Facebook.

Please see the privacy policy of Facebook for further information about how your privacy is protected: https://de-de.facebook.com/about/privacy.

You can also disable the “Custom Audiences” remarketing function in the advertising settings area at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. You must be logged into Facebook to do this.

If you do not have a Facebook account, you can disable usage-based advertising from Facebook on the website of the European Interactive Digital Advertising Alliance: http://www.youronlinechoices.com/de/praferenzmanagement/.

LinkedIn Insight Tag

This website uses the Insight Tag from LinkedIn. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

Processing of data via LinkedIn Insight Tag

Using the LinkedIn Insight Tag, we receive information about visitors to our website. If a site visitor is registered with LinkedIn, we are able to analyse site visitor data including key career information (e.g. level, company size, country, location, sector and job title) and thus further improve our site for the respective target groups. LinkedIn Insight Tags also helps us measure whether visitors to our website make a purchase or perform other actions (conversion tracking). Conversion tracking works across devices (e.g. from PC to tablet). LinkedIn Insight Tag also offers a retargeting function that allows us to show targeted advertising to our website visitors when they visit other websites without, according to LinkedIn, being able to personally identify the individual being shown the targeted ads.

LinkedIn itself also collect log files (URL, referrer URL, IP address, device and browser properties and time of access). IP addresses are truncated or (if used to target LinkedIn members across multiple devices) hashed (pseudonymised). Direct identifiers for LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymised data are deleted within 180 days.

Data collected by LinkedIn cannot be allocated by us as the website operator to any particular individual. LinkedIn stores the collected personal information about website visitors on its servers in the USA and uses this data within the scope of it advertising activities. Details can be found in the LinkedIn privacy policy at https://www.linkedin.com/legal/privacy-policy#choices-oblig.

Legal basis

The legal basis for the use of LinkedIn Insight is Article 6 Para 1f GDPR. The website operator has a legitimate interest in effective marketing that includes social media. Where the corresponding consent has been requested (e.g. consent to the storage of cookies), the exclusive legal basis for processing if Article 6 Para 1a GDPR; you may withdraw your consent at any time.

Data transfer to the USA is based upon the standard contract clauses of the EU Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

Opt-out to the use of LinkedIn Insight Tag

You can opt-out of usage behaviour analysis and targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Furthermore, members of LinkedIn can control the use of the personal data for advertising purposes from within their account settings. In order to prevent data collected from our website being connected to your LinkedIn account by LinkedIn, you must log out of LinkedIn before visiting our website.

Personal data processing

We have an agreement with the above named provider relating to the processing of personal data. This a contract as required by data protection law which guarantees that the personal data of our website visitors will be processed following our directions and in accordance with the provisions of the GDPR.

6. Newsletter

Newsletter data

If you would like to receive the newsletter offered on the website, we require an email address from you as well as information that enables us to determine that you are indeed the owner of the specified email address and consent to receiving the newsletter. No other data will be collected, or is provided only on a voluntary basis. This data will be used exclusively for sending the requested information and will not be passed on to third parties.

Processing of data entered into the newsletter subscription form is processed exclusively based on your consent (Article 6 Para 1a GDPR). The consent you provide for saving the data, the email address as well as their use for sending the newsletter can be withdrawn at any time, e.g. using the “unsubscribe” link in the newsletter. The legality of any data processing activities that have taken place up to such time as consent is withdrawn remains unaffected.

The data you provide us for the purposes of receiving the newsletter will be stored by us up until such time as you withdraw your consent. Once you have unsubscribed from the newsletter, or if no longer required for the newsletter mailing list, your data will be deleted. We reserve the right to delete or block email addresses in our newsletter distribution list at our discretion within the scope of our legitimate interest according to Article 6 Para 1f GDPR.

Once removed from the newsletter mailing list, your email address will be stored in a blacklist by us or the newsletter service provider to ensure that no further mailings are received. The data in the blacklist is used exclusively for this purpose and is not linked to any other data. This serves both your own interests and ours in ensuring adherence to legal regulations when sending newsletters (legitimate interest in terms of Article 6 Para 1f GDPR). There is no time limit on how long the blacklist is kept. You can opt-out of this storage where your interests outweigh our legitimate interest.

7. Plugins and tools

Google Maps

This site uses the Google Maps mapping service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

In order to use the features of Google Maps, it is necessary to store your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this site has no influence over this transfer of data. When Google Maps is enabled, Google can make use of the Google Web Fonts service for the purposes of displaying fonts. When you access Google Maps, your browser loads the required Web Fonts into your browser cache in order to correctly display text and fonts.

The use of Google Maps is done in the interest of providing an appealing online offering and to make the locations given on the website easier to find. This represents a legitimate interest in terms of Article 6 Para 1f GDPR. Where the corresponding consent has been requested, the exclusive legal basis for processing if Article 6 Para 1a GDPR; you may withdraw your consent at any time.

Data transfer to the USA is based upon the standard contract clauses of the EU Commission. Details can be found here: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

More information on how Google makes use of user data can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

8. Audio and video conferences

Data processing

We use various tools for communicating with our customers, including online conferencing tools. The tools we use are listed below. When you communicate with in a video or audio via the internet, you personal data is collected and processed by us and the respective provider of the conferencing tool.

The conferencing tools collect all data you provide for using the tools (email address and/or telephone number). Furthermore, the conferences tools process the duration of the conference, start and end times of conference participation, number of participants and other “context information” in association with the communication process (metadata).

The provider of the tools additionally processed all technical data necessary for the provision of the online communication. In particular this includes IP addresses, MAC addresses, device ID, device type, operation system type and version, client version, camera type, microphone or speaker as well as type of connection.

Where content is exchanged, uploaded or otherwise make available within the tool, this will also be stored on the tool provider’s servers. Such content includes cloud recordings, chat/instant messages, voicemails, uploads photos and videos, files, whiteboards and other information that is shared during use of the service.

Please be aware that we do not have complete control over the data processing activities of the tools used. Our options are based primarily on the company policies of the respective providers. Further information on data processing carried out by the conferencing tools can be found in the privacy policy for respective tools listed under this text.

Purpose and legal bases

The conference tools are used to communication with potential or existing contractual partners or in order to offer certain services to customers (Article 6 Para 1b GDPR). Furthermore, the use of these tools serves to generally make communication with us and our company easier and faster (legitimate interest in terms of Article 6 Para 1f GDPR). Where consent is requested, the affected tools will be used on the basis of this consent; you may withdraw your consent at any time with effect from that time onwards.

Retention period

The data that is directly collected by us via the video and conferencing tools is stored until such time as you request its deletion, you withdraw your consent to its storage, or the purpose for the storage of the data no longer applies. Stored cookies remain on your device until you delete them. Legally required retention periods remain unaffected.

We have no influence over the duration for which your data is stored by the operators of the conferencing tools for their own purposes. For further details, please turn to the providers of the tools directly.

Conferencing tools used

We use the following conferencing tools:

Microsoft Teams

We use Microsoft Teams. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Details on data processing can be found in the Microsoft Teams privacy policy: https://privacy.microsoft.com/de-de/privacystatement.

Processing of personal data

We have an agreement with the above named provider relating to the processing of personal data. This a contract as required by data protection law which guarantees that the personal data of our website visitors will be processed following our directions and in accordance with the provisions of the GDPR.

9. Inhouse services

Your application

Purposes and legal basis for processing

We process your personal data in line with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act to the extent necessary for making a decision regarding an offer of employment with us. The legal basis for this is Article 88 GDPR in combination with Section 26 German Federal Data Protection Act and, where applicable, Article 6 Para 1b GDPR for initiating or implementing contractual relationships.

We may further process your personal data where this is necessary in order to fulfil legal requirements (Article 6 Para 1c GDPR) or to defend against legal claims made against us. The legal basis for this is Article 6 Para 1f GDPR. The legitimate interest is, for example, the requirement to submit evidence as part of proceedings in accordance with the General Equality Act.

Where you provide us with your express consent to process personal data for specific purposes, the legality of this processing is based upon your consent pursuant to Article 6 Para 1a GDPR. You have the right at any time to withdraw this consent at any time with effect for the future. Where an employment contract is concluded between you and us, in accordance with Article 88 GDPR in combination with Section 26 Federal Data Protection Act, we can further process the personal data you have provided to us for purposes pertaining to the employment relationship. This may be for terminating an employment relationship or to exercise rights and fulfil the obligations of a collective agreement representing the interests of the employees.

Categories of personal data

We process only such data that relates to your application. This can include general data about your person (name, address, contact data, etc.), information about your professional qualifications and educations, information about professional training and any other data that you have provided to us in relation to your application.

Data sources

We process personal data we have received from you resulting from making contact with us, or from your application sent by post or email, or that you provide via online application forms.

Data recipients

Your personal data will be provided to only those areas within our company that require this data in order to fulfil contractual and legal obligation and for implementation of our legitimate interests.

We may send your personal data to companies that we are associated with, insofar as this is permitted with the scope of the purposes and legal bases indicated in this data privacy information sheet.

Your personal data will be processed on our behalf on the basis of personal data processing contracts in accordance with Article 28 GDPR. In such cases, we will ensure that personal data is processed in accordance with the provisions of the GDPR. The categories of recipient are in this case the HR department of Peppermint Holding GmbH as well as providers of applicant management systems and software.

Data will otherwise only be passed on to recipients outside of the company where this is legally permitted or required, it is necessary in order to fulfil legal obligations, or you have given us your consent to do so.

Transfer to a third country

Transfer to a third country is not expected.

Data retention period

We will store your personal data for the period of time necessary to make a decision regarding you application. Your personal data and application documents will be deleted no more than six months after the end of the application process (e.g. notification of rejection), insofar as there exist no legal obligations to store the data for longer or it is not permitted to do so. Furthermore, we store your personal data only insofar as it is legally necessary to do so, or in specific cases, for making, exercising or defending against a legal claim for the duration of the legal proceedings.

In the event that you agreed to your personal data being stored for a longer period, we will store this to the extent permitted by your declaration of consent.

If the application process results in an employment relationship, training relationship or work experience relationship, you data will be stored and then transferred into your HR file where required and permitted. Following the application process you may receive an invitation to be placed in our talent pool. This allows us to consider you again in the future should a suitable vacancy arise. If you have provided the relevant consent, we will store your application data in our talent pool to the extent permitted by your consent, or future consent.