Privacy policy and cookie information

This policy serves to inform you about the processing of your personal data that takes place when you visit our website and, if applicable, through subsequent processes.

Under Art. 4(1) GDPR, personal data is defined as any information relating to an identified or identifiable natural person, whether directly or indirectly (in combination with other data). Pursuant to Art. 4(2) GDPR, processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Unless otherwise specified, you are not legally or contractually obliged to provide personal data to visit our site, and such data is not required for contractual purposes. If you do not provide certain data (e.g. through browser settings or by withholding consent), some functions of the website – especially in connection with cookies or external content – may not be usable, or only usable to a certain extent.

Data controller | Data protection officer

The data controller for processing your personal data is:

Golf BidCo GmbH (hereinafter referred to as “we”, “GETEC”)
Albert-Vater-Str. 50
39108 Magdeburg
Germany
Phone: +49 (0) 391 2568 100
Fax: +49 (0) 391 2568 120
E-mail: info@getec.de

Our data protection officer is available at:

EPRO Consult GmbH
getec@epro-consult.de

Data processing via our website

Unless stated otherwise below, we delete personal data processed during your visit to our website without undue delay once the specific purpose for processing has been fulfilled or ceases to apply. Any storage beyond this period shall be exclusively on the basis of our legitimate interest in asserting, enforcing, and defending our legal rights while any contractual or statutory limitation claims are in place as well as in order to comply with any retention periods which we are legally obliged to observe by commercial or tax law requirements, for example. Should any statutory retention periods apply, the personal data shall be restricted for further processing rather than deleted and shall only be processed for the purposes of complying with such retention periods as well as asserting, exercising, or defending any legal rights.

Cookies | Third-party content

Our website stores cookies or uses similar technologies for certain functionalities.
Cookies are small text files that are stored in your browser, or on your device by your browser. Cookies contain a unique string of characters that ensures your browser is recognised when you visit the website again at a later point. In that context, certain technical information required for the provision and use of certain features may be processed separately.

Please refer to the respective sections in this Privacy Policy for any details about the respective processing of your personal data, particularly as to whether such processing is carried out with or without your consent.

You have full control over the use of cookies on your device and may limit or prevent their storage by adjusting certain settings in your browser. Cookies that have already been stored may also be deleted at any time in your browser settings. If you do so, however, you may no longer be able to use all features of our website.

Server log files

When you visit our website, data is automatically transmitted to us or our web hosting provider and stored in server log files. This allows us to log user enquiries, site access, and any technical error messages. This data processing is technically necessary to ensure a secure and stable internet presence. The following data shall be stored temporarily:

• Information about the browser used
• Information about the operating system used
• URL of the website visited
• Access date and time
• Volume of data sent
• Website from which the switch to our website originated (referrer URL)
• IP address

This data is used solely for statistical evaluation and website optimisation. It is not combined with any other personal data relating to you and is automatically deleted after seven days. That storage period shall only be exceeded in exceptional cases where it is necessary to retain data as evidence of specific signs of illegal use.

The processing of your personal data is based on our legitimate interests in ensuring the stability, security, functionality, and optimisation of our website, pursuant to Art. 6(1)(f) GDPR.

Contact

Should you contact us by email or via our contact form, we will collect and process the personal data you provide (specifically your name, e-mail address, and message content) to enable us to handle your enquiry.

If your enquiry relates to the entry into a contract (e.g. a request for a quote) or concerns an existing agreement between us, your data will be processed to carry out pre-contractual steps or to perform the existing contract pursuant to Art. 6(1)(b) GDPR.

In all other cases, your personal data shall be processed in order to safeguard our legitimate interest in processing and responding to your enquiry in accordance with Art. 6(1)(f) GDPR.

Cookie consent tool (CCM19) | Privacy settings – strictly necessary cookies

To manage the privacy-related settings and to document the consent given or withheld by users (including consent regarding the integration of external content / services), we use the consent management tool CCM19, which is provided by Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany.

Whenever our website is accessed, technically necessary information is processed to ensure the functionality of consent management. This includes in particular the consent status, an associated timestamp, technical browser and device characteristics as well as information on the selection made. This data shall be used exclusively for the management and verification of the necessary privacy settings.

These settings are saved via strictly necessary cookies (and similar storage techniques) to ensure your preferences are remembered throughout your visit and on future visits to the site. That data is not used for any analysis or marketing purposes.

Information on data processing:

• Service providers:
  Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn (CCM19)
• Purpose:
  to provide and manage privacy settings as well as maintain evidence of consent given or withheld
• Legal basis:
  Access to end device: Section 25(2)(2) German Telecommunications Digital Services Data Protection Act (TDDDG)
  Processing of personal data: Art. 6(1)(f) GDPR (legitimate interest in the technically necessary management of consent)
• Processed data:
  consent status, timestamp, technical browser and device information, selection parameters, and technical communication data (e.g. IP address) when accessing content from the service provider's servers
• Recipients / Categories of recipients:
  Papoo Software & Media GmbH (retrieval/integration of the consent management tool from provider systems; technical operation)
• Retention period:
  the data will be stored as long as the respective selection remains valid. Deletion will either be automatic or can be initiated by the user via the privacy settings.
• Transfer to third countries:
  there shall be no transfer of personal data to third countries.

For information about all cookies used on our website, please refer to our privacy settings (the cookie icon in the bottom left area of the website).

Session cookies – strictly necessary cookies

Strictly necessary session cookies are used to maintain user sessions and ensure the technical operation of our website. These cookies are strictly necessary to ensure website functionality throughout your visit.

Information on data processing:

• Purpose:
  Essential session management and website functionality
• Legal basis:
  Access to end device: Section 25(2)(2) German Telecommunications-Digital Services Data Protection Act [TDDDG] (technically required)
  Processing of personal data: Article 6(1)(f) GDPR (legitimate interest in ensuring the secure and stable operation of the website)
• Processed data:
  Technical cookie and session information; technical connection data (e.g. IP address)
• Retention period:
  Session (until the end of the browser session)

Microsoft Azure Front Door – strictly necessary cookies

We use Microsoft Azure Front Door for the strictly necessary delivery and security of our website (e.g. load balancing, performance, and stability). For this purpose, strictly necessary cookies are used to ensure reliable content delivery and maintain session affinity.

Information on data processing:

• Service providers:
  Microsoft (Microsoft Azure - Azure Front Door)
• Purpose:
  Strictly necessary delivery and operational stability of the website (e.g. load balancing/session affinity)
• Legal basis:
  Access to end device: Section 25(2)(2) German Telecommunications-Digital Services Data Protection Act [TDDDG] (technically required)
  Processing of personal data: Article 6(1)(f) GDPR (legitimate interest in ensuring the secure and stable operation of the website)
• Processed data:
  Technical cookie and session information; technical connection data (e.g. IP address)
• Retention period:
  Session (until the end of the browser session)
• Recipients / Categories of recipients:
  Microsoft, as the provider of the infrastructure used (Azure Front Door)
• Transfer to third countries:
  Based on our configuration, processing generally takes place via infrastructure within the EU/EEA; however, processing outside the EU/EEA cannot be entirely ruled out.

Google Tag Manager (Analytics & Statistics / Advertising & Ads)

We use Google Tag Manager for the technical integration and management of website tags. The Google Tag Manager itself does not create user profiles or, to the best of our knowledge, perform any independent analysis; it is used solely to deploy the tags we have implemented. The deployment of tags via Google Tag Manager is disabled by default and only occurs once you have given your explicit consent. These tags are enabled via the privacy settings based on your selection, specifically by activating the ‘Analytics / Statistics’ and/or ‘Advertising / Ads’ toggles.

Information on data processing:

• Service providers:
  Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• Purpose:
  Technical implementation and management of website tags
• Legal basis:
  Access to end device: Section 25(1) TDDDG (consent)
  Processing of personal data: Art. 6(1)(a) GDPR (consent)
• Withdrawal:
  You can withdraw or adjust your consent at any time with future effect via the privacy settings by deactivating the ‘Analytics / Statistics’ and/or ‘Advertising / Ads’ toggles.
• Transfer to third countries:
  Personal data may also be processed outside the EU/EEA.

Google Analytics 4 (GA4) – Server-side tracking via proxy (Analytics / Statistics)

We use Google Analytics 4 (GA4) for the statistical analysis of our website usage. For this purpose, we employ a server-side tracking implementation (proxy/server-side tracking). In this process, the data collected by GA4 is first transmitted to an intermediary server within the EU, which is provided by Semotion GmbH and utilises a proxy solution from the service provider Stape Inc. During this intermediate stage, personal components—specifically IP addresses and other identifiers—are removed, anonymised, or pseudonymised prior to being forwarded to Google. Only then are the remaining (processed) data sent to Google. The purpose of this implementation is to ensure more privacy-friendly data processing and to prevent the direct transmission of personal data to Google.

Google Analytics 4 is disabled by default and will only be activated once you have given your explicit consent. Activation is managed via the privacy settings by enabling the ‘Analytics / Statistics’ toggle.

Information on data processing:

• Service providers:
  Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics 4)
• Purpose:
  Statistical analysis of website usage, reach measurement, and the continuous improvement of our web presence
• Legal basis:
  Access to end device: Section 25(1) TDDDG (consent)
  Processing of personal data: Art. 6(1)(a) GDPR (consent)
• Processed data:
  Usage and event data (e.g. page views, clicks), technical information (e.g. browser and device attributes), as well as pseudonymised or aggregated information; as part of the server-side implementation, the IP address is removed or anonymised prior to transmission to Google.
• Recipients / Categories of recipients:
  • Semotion GmbH (Provision and technical operation of the proxy/server-side tracking implementation)
  • Stape Inc. (Proxy solution as a technical sub-service provider within the server-side implementation)
  • Google Ireland Limited (Google Analytics 4)
• Withdrawal:
  You can withdraw or adjust your consent at any time with future effect via the privacy settings by switching off the ‘Analytics / Statistics’ toggle.
• Transfer to third countries:
  Personal data may also be processed outside the EU/EEA.

Google Ads – Server-side conversion tracking via proxy (Advertising / Ads)

We use Google Ads to measure the effectiveness of our advertising campaigns (conversion tracking). For this purpose, we employ a server-side tracking implementation (proxy/server-side tracking). In this process, the data processed for conversion purposes is first transmitted to an intermediary server within the EU, which is provided by Semotion GmbH and utilises a proxy solution from the service provider Stape Inc. At this intermediate stage, personal components are removed, anonymised, or pseudonymised prior to being transmitted to Google. Only then are the remaining (processed) data sent to Google.

Conversion measurement is disabled by default and will only be activated once you have given your explicit consent. Activation is managed via the privacy settings by enabling the ‘Advertising / Ads’ toggle.

Information on data processing:

• Service providers:
  Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Ads)
• Purpose:
  Conversion tracking and evaluating the effectiveness of marketing activities
• Legal basis:
  Access to end device: Section 25(1) TDDDG (consent)
  Processing of personal data: Art. 6(1)(a) GDPR (consent)
• Processed data:
  Usage and event data associated with visits to our website and the triggering of defined conversions; technical information (e.g. browser and device attributes); as part of the server-side implementation, personal components are removed, anonymised, or pseudonymised prior to being forwarded to Google.
• Recipients / Categories of recipients:
  • Semotion GmbH (Provision and technical operation of the proxy/server-side tracking implementation)
  • Stape Inc. (Proxy solution as a technical sub-service provider within the server-side implementation)
  • Google Ireland Limited (Google Ads)
• Withdrawal:
  You can withdraw or adjust your consent at any time with future effect via the privacy settings by switching off the ‘Advertising / Ads’ toggle.
• Transfer to third countries:
  Personal data may also be processed outside the EU/EEA.

YouTube video - social media (external content/service)

We incorporate videos from the YouTube service on our website in privacy-enhanced mode. YouTube videos are disabled by default and shall only load and play after your explicit consent. Activation is managed via the privacy settings by enabling the ‘Social Media’ toggle.

A connection to YouTube's servers is only established, and the video content loaded, once it has been activated. In doing so, communication and usage data are processed for technical reasons (e.g. IP address, date and time of access, device and browser attributes, as well as the specific page or video accessed). Prior to consent being given, no data shall be transmitted to YouTube in connection with the integration of YouTube videos.

Information on data processing:

• Service providers:
  Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (YouTube)
• Legal basis:
  Access to end-user device / Integration of third-party content: Section 25(1) TDDDG (consent)
  Processing of personal data: Art. 6(1)(a) GDPR (consent)
• Withdrawal:
  You can withdraw or adjust your consent at any time with future effect via the privacy settings by switching off the ‘Social Media’ toggle.
• Transfer to third countries:
  Upon activation of the YouTube videos, personal data may be transferred to YouTube or its affiliates and may also be processed outside the EU/EEA.

Further information on data processing by YouTube and Google can be found in Google’s Privacy Notice:

https://policies.google.com/privacy
https://www.youtube.com/intl/eng/howyoutubeworks/privacy/

Online job applications / Job postings

We provide an external recruitment portal for submitting your online application. The recruitment portal is hosted on the Workday platform at https://getec.wd103.myworkdayjobs.com/en-US/External_Careers. The applicant portal is provided by Workday. For these digital applications, your applicant and application data shall be collected and processed electronically by us for the purpose of handling the application process.

Legal basis (depending on the applicable law):

• Germany: Section 26(1)(1) of the Federal Data Protection Act (BDSG) in conjunction with Art. 88(1) GDPR
• EU/EEA: Article 6(1)(b) of the GDPR (implementation of pre-contractual measures)
• Switzerland: Art. 328b of the Code of Obligations (CO) in conjunction with Art. 6 of the Federal Data Protection Act (FADP)

If an employment contract is entered into following the recruitment process, we will store the data provided during your application in your personnel file for the purpose of managing the employment relationship and to comply with statutory retention and documentation obligations.

Legal basis (depending on the applicable law):

• Germany: Section 26.1(1) of the Federal Data Protection Act (BDSG) in conjunction with Art. 88(1) GDPR; Art. 6(1)(c) GDPR
• EU/EEA: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR
• Switzerland: Art. 328b of the Code of Obligations (CO) in conjunction with Art. 6 of the Federal Data Protection Act (FADP)

If an application is rejected, we will generally delete the data submitted to us no later than six months after notification of the rejection, unless a longer retention period is necessary in individual cases—for example, for the assertion, exercise, or defence of legal claims, or until the conclusion of legal proceedings.

Legal basis (depending on the applicable law):

• Germany: Article 6(1)(f) GDPR and Section 24(1)(2) German Federal Data Protection Act [BDSG] (legitimate interest in the establishment, exercise or defence of legal claims)
  •    EU/EEA: Article 6(1)(f) GDPR (legitimate interest in the establishment, exercise or defence of legal claims)
• Switzerland: Art. 328b of the Code of Obligations (CO) in conjunction with Section 6 of the Data Protection Act and Section 31 of the Data Protection Act (overriding private interest, in particular the defence or enforcement of legal rights)

If you give your express consent for your data to be stored for a longer period—for example, for inclusion in a database of applicants or interested parties—your data will continue to be processed on the basis of that consent.

Legal basis (depending on the applicable law):

• Germany / EU/EEA: Art. 6(1)(a) GDPR. You may withdraw your consent at any time under Art. 7(3) GDPR by notifying us; such withdrawal shall take effect for the future.
• Switzerland: Section 31 of the Data Protection Act (Consent); withdrawal with effect for the future.

Data processing when visiting our LinkedIn profile

Controllers

The following privacy policy provides an overview of the collection and processing of your data on our social media presence on the following social media platforms:

• LinkedIn: https://www.linkedin.com/company/getec-solutions/, hereinafter each the “LinkedIn Profile”

We would like to point out that you use our social media pages and their functions, as well as social media platforms in general, at your own risk. This applies in particular to your use of the interactive features (e.g. liking, commenting, sharing, rating). For the corresponding terms of use, please visit: 

• LinkedIn: https://www.linkedin.com/legal/user-agreement

You can view the data policy here: https://www.linkedin.com/legal/privacy-policy

In addition to us, the social media platform operator (hereinafter referred to as the “Provider”) is also responsible as a controller for data processing on our LinkedIn profile, hereinafter also referred to as “LinkedIn”.

LinkedIn Ireland Unlimited Company
Attn: Legal Dept. (Privacy Policy and User Agreement)
Wilton Plaza
Wilton Place, Dublin 2
Ireland

LinkedIn’s Data Protection Officer’s online contact form: https://www.linkedin.com/help/linkedin/ask/TSO-DPO?_l=en_US

The social media platform operators serve as your central point of contact. However, you may also assert your rights in relation to the processing under joint responsibility against us. If you contact us, we shall coordinate with the respective provider to respond to your enquiry and guarantee your rights as a data subject.

Please note:
Please be advised that LinkedIn may store data relating to logged-in users and other visitors to the social media platform—such as personal information (e.g. registration data, status updates, photos, and other profile and usage data), IP addresses, and cookies—outside the European Union (EU) or the European Economic Area (EEA) and use it for its own business purposes.

We have no control over the collection and use of data by the provider. Furthermore, we are unable to determine which data LinkedIn stores, where, and for how long, as well as to what extent LinkedIn fulfils any existing deletion obligations, what evaluations and correlations are made using the data, and with whom the data is shared. Whenever you are logged in with your respective social media account and visit our social media page, the provider can match that visit to your profile.

The processing of personal data by LinkedIn may also take place outside the European Union (EU) or the European Economic Area (EEA), notably in the USA. To the extent that personal data is transferred to third countries, this shall be done in accordance with data protection regulations, in particular on the basis of an adequacy decision or subject to appropriate safeguards. Nevertheless, it cannot be ruled out that authorities in these third countries may have access to data processed by LinkedIn within the framework of their respective legal powers.

An agreement on joint controllership pursuant to Art. 26 GDPR has been entered into, setting out the allocation of tasks and responsibilities regarding the processing of personal data and specifying who shall fulfil each obligation under data protection law.

Information on data processing

GETEC operates the LinkedIn profile to provide information on its services and to interact with its customers and visitors to the social media platforms (hereinafter referred to as “Users”).

When the GETEC LinkedIn profile is used, personal data are subject to processing. For information about the type and scope of data processing for which GETEC is responsible under data protection law in this context, please read on.

GETEC does not store any personal data relating to your use of the respective social media pages.

The providers store any information you post on GETEC’s social media pages (such as comments) or send via messenger under the terms of your user agreement; you can delete this data yourself directly on those platforms.

Processing of personal data for which LinkedIn and GETEC are joint controllers

When you visit the GETEC social media page, LinkedIn uses specific usage data (e.g. whether you have liked or commented on certain GETEC posts) also to provide GETEC with aggregated usage statistics (referred to as “Page Insights”). Usage statistics do not allow any conclusions about the behaviour of individual users. They merely provide GETEC with an overview of the use of its social media pages (e.g. which posts were clicked on the most). GETEC itself has no access to the personal data processed for the compilation of these statistics. LinkedIn alone determines which usage actions are logged by LinkedIn on the social media platforms; this cannot be configured, changed, or influenced in any other way by GETEC.

LinkedIn provides GETEC with usage statistics on its social media page for GETEC to improve the posts published there and make them as interesting as possible for users. The data processing is done on the basis of a balancing of interests in accordance with Art. 6 (1)(f) GDPR, which always takes your interests into account. If you are logged in to LinkedIn yourself, the processing in accordance with Art. 6(1)(b) GDPR shall also be done in accordance with the terms of use that apply between you and LinkedIn.

LinkedIn and GETEC are joint controllers for the processing of personal data for the compilation of these usage statistics in accordance with Art. 26 GDPR.

The information on LinkedIn Page Insights (https://legal.linkedin.com/pages-joint-controller-addendum) describes which data are processed within the scope of joint controllership and contains the “Page Insights Addendum”, in which LinkedIn and GETEC have contractually determined which party fulfils which obligations under the GDPR.

Processing of your data when communicating with GETEC via the LinkedIn page

If you contact GETEC via the LinkedIn page, for example by commenting on a post or writing a message via LinkedIn Messenger, GETEC processes your data (e.g. your name and the communication contents) in order to process your enquiry.

To the extent necessary, GETEC also processes your data to assert legal claims and defend against legal disputes, as well as to prevent and investigate criminal offences (e.g. in the case of hate speech or inflammatory comments).

The legal basis for processing the data transmitted in the course of contacting us is Art. 6(1)(f) GDPR. If the purpose in contacting us is related to concluding a contract or pertaining to an existing contractual relationship, the additional legal basis for the processing is Art. 6(1)(b) GDPR.

Your data will be deleted once your enquiry has been fully resolved, provided that no statutory retention obligations—such as those arising from subsequent contract performance—preclude such deletion.

Your rights

Regarding the processing of your personal data as detailed above, you have the following rights as a data subject:

• Right of access to your personal data under Art. 15 GDPR
• Right to rectification of your personal data under Art. 16 GDPR
• Right to erasure of your personal data under Art. 17 GDPR
• Right to restriction of processing of personal data relating to you pursuant to Art. 18 GDPR
• Right to data portability regarding your personal data under Art. 20 GDPR
• Right to object to the processing of personal data relating to you pursuant to Art. 21 GDPR, insofar as the processing is carried out for the performance of a task in the public interest or in the exercise of official authority under Art. 6(1)(e) GDPR, or for the purposes of our legitimate interests under Art. 6(1)(f) GDPR.

If you believe that the processing of your personal data violates data protection regulations, you are entitled to lodge a complaint with the relevant supervisory authority. 

You can find a list of supervisory authorities, including their contact details, at:
https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html