Privacy Policy Statement of SOFiSTiK AG

2. What data are processed and from which sources do these data originate?

We process the data that we have received from you in the course of initiating or executing a contract, on the basis of your consent, or in the course of your application to us or your employment with us.

2.1 Personal data includes:

• Your master/contact data, which for customers includes, for example, first and last name, address, contact details (email address, telephone number), bank details.
• For applicants and employees, this includes, for example, first and last name, address, contact details (email address, telephone number), date of birth, data from CVs and references, bank details, religious affiliation, and photographs.
• For business partners, this includes, for example, the names of their legal representatives, company name, commercial register number, VAT ID number, company number, address, contact details of contact persons (email address, telephone number), and bank details.
• For visitors to our company, this includes their name and signature.

• For competition participants, this includes their first and last name and email address.

   

2.2 In addition, we also process the following other personal data:

• Information about the type and content of contract data, order data, sales and receipt data, customer and supplier history, as well as consulting documents, advertising and sales data, information from your electronic communication with us (e.g., IP address, log-in data),
• Other data that we have received from you in the course of our business relationship (e.g., in customer meetings), data that we generate ourselves from master/contact data and other data, e.g., by means of customer needs and customer potential analyses,
• The documentation of your declaration of consent to receive, for example, newsletters or photographs taken at events.

4. For what purposes and on what legal basis is the data processed?

We process your data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act 2018, as amended:
 

4.1 To fulfill (pre-)contractual obligations (Art. 6 (1) (b) GDPR):
Your data is processed for the purpose of contract execution online or in one of our branches, for the purpose of contract execution with your employees in our company. The data is processed in particular during the initiation of business and during the execution of contracts with you.
 

4.2 To fulfill legal obligations (Art. 6 (1) (c) GDPR):
The processing of your data is necessary for the purpose of fulfilling various legal obligations, e.g., under the German Commercial Code or the German Fiscal Code.
 

4.3 To safeguard legitimate interests (Art. 6 (1) (f) GDPR):
Based on a balancing of interests, data processing may take place beyond the actual fulfillment of the contract in order to protect the legitimate interests of us or third parties. Data processing to protect legitimate interests takes place, for example, in the following cases:

• Advertising or marketing (see No. 4),
• Measures for business management and further development of services and products,
• Maintaining a group-wide customer database to improve customer service,
• Within the scope of legal prosecution,
• Sending non-promotional information and press releases.
   

4.4 Within the scope of your consent (Art. 6 (1) (a) GDPR):
If you have given us your consent to process your data, e.g. to send you our newsletter, publish photos, competitions, etc.
 

4.5 Processing of personal data for advertising purposes

• You can object to the use of your personal data for advertising purposes at any time, either in whole or for individual measures, without incurring any costs other than the transmission costs according to the basic rates.
• Under the legal requirements of Section 7 (3) UWG (German Unfair Competition Act), we are entitled to use the email address you provided when concluding the contract for direct advertising for our own similar goods or services. You will receive these product recommendations from us regardless of whether you have subscribed to a newsletter.
• If you do not wish to receive such recommendations from us by email, you can object to the use of your address for this purpose at any time without incurring any costs other than the transmission costs according to the basic rates. A notification in text form is sufficient for this purpose. Of course, every email always contains an unsubscribe link.

6. Who receives my data?

• If we use a service provider for order processing, we remain responsible for the protection of your data. All processors are contractually obliged to treat your data confidentially and to process it only within the scope of the service provision. The processors commissioned by us receive your data if they need it to perform their respective services. These include, for example, IT service providers that we need for the operation and security of our IT system, as well as advertising and address publishers for our own advertising campaigns.
• Your data is processed in our customer database. The customer database supports the improvement of the data quality of existing customer data.
• This data is made available to the group companies if necessary for contract processing. Customer data is stored separately for each company, with our parent company acting as a service provider for the individual participating companies.
• In the event of a legal obligation and in the context of legal proceedings, authorities, courts, and external auditors may be recipients of your data.
• In addition, insurance companies, banks, credit agencies, and service providers may be recipients of your data for the purpose of initiating and fulfilling contracts.

8. Is personal data transferred to a third country?

As a matter of principle, we do not transfer any data to a third country. In individual cases, a transfer will only take place on the basis of an adequacy decision by the European Commission, standard contractual clauses, appropriate safeguards, or your express consent.

10. Contact form/email contact

• If you send us inquiries via the contact form or email, your details from the inquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We will not pass on this data without your consent.
• This data is processed on the basis of Art. 6 (1) (b) GDPR, provided that your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective processing of inquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR), if this has been requested. The data you enter in the contact form will remain with us until you request us to delete it, revoke your consent to its storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory legal provisions — in particular retention periods — remain unaffected.

12. Newsletter

We use the double opt-in procedure to send out our newsletter, which means that we will only send you a newsletter by email once you have expressly confirmed that you wish us to activate the newsletter service. We will then send you a notification email and ask you to confirm that you wish to receive our newsletter by clicking on a link contained in this email. 

When you register for our newsletter, we store your IP address and the date of registration. This storage serves solely as proof in the event that a third party misuses your email address to register you for the newsletter without your knowledge or authorization. The legal basis is therefore your consent within the meaning of Art. 6 (1) (a) GDPR. If you unsubscribe from the newsletter and have no business relationship with us, your data will be deleted immediately. If you no longer wish to receive newsletters from us at a later date, you can object to this at any time without incurring any costs other than the transmission costs according to the basic tariff, e.g. via the unsubscribe link that you will find in every email.

14. Third-party services
 

14.1 Vimeo
Our website incorporates videos from the provider Vimeo LLC, 555 West 18th Street, New York, New York 10011, USA. When you play a video, a connection to Vimeo's servers is established. Your IP address and other information (e.g., browser type) are transmitted in the process. Vimeo may set cookies and transfer data to the USA.
Legal basis: Art. 6 (1) (a) GDPR (consent via cookie banner)
Data transfer to third countries: USA – An equivalent level of data protection cannot be guaranteed.
More information: https://vimeo.com/privacy

14.2 YouTube
Our website embeds videos via YouTube, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit a page with an embedded video, a connection to YouTube is established.
Legal basis: Art. 6 (1) lit. a GDPR
Data transfer to third countries: USA
More information: https://policies.google.com/privacy

14.3 Google Maps
This website uses Google Maps to display interactive maps. The provider is Google Ireland Limited. Your IP address may be transmitted to Google when you visit the corresponding pages.
Legal basis: Art. 6 (1) (a) GDPR
Google Fonts: When using Google Maps, Google Fonts are also loaded from Google servers.
More information: https://policies.google.com/privacy

14.4 Google Fonts (only integrated via Google Maps)
We do not actively integrate Google Fonts. However, Google Fonts are automatically loaded from Google servers when using Google Maps.
Legal basis: Art. 6 (1) (a) GDPR
More information about Google Fonts: https://developers.google.com/fonts/faq/privacy

14.5 Cookiebot
We use “Cookiebot” from Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, to manage consent (cookies, third-party content, etc.).
Processed data: IP address, timestamp, consent status
Legal basis: Art. 6 (1) (c) GDPR (legal obligation), Art. 6 (1) (a) GDPR (for consents)
More information: https://www.cookiebot.com/de/privacy-policy/

14.6 Google Analytics (via tracking proxy: t.sofistik.com)
Our website uses Google Analytics, provided by Google Ireland Ltd., via a privacy-friendly proxy (t.sofistik.com), which means that no direct connection to Google is established when you visit the site. IP addresses are processed anonymously.
Legal basis: Art. 6 (1) (a) GDPR
Data transfer: No direct transfer to Google due to use of proxy
More information: https://support.google.com/analytics/answer/6004245

14.7 FriendlyCaptcha
To protect against spam, we use “FriendlyCaptcha,” a privacy-friendly captcha procedure from Friendly Captcha GmbH, Germany. No tracking cookies are set. The IP address is only processed in anonymized form.
Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in IT security)
More information: https://friendlycaptcha.com/legal/privacy-end-users/

14.8 SharePoint Online (sofistik.sharepoint.com – webinar videos)
In certain areas, we embed content that is hosted via Microsoft SharePoint Online (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA). This may establish a data connection to Microsoft.
Legal basis: Art. 6 (1) (a) GDPR
Data transfer: USA – transfer based on standard contractual clauses
Further information: https://privacy.microsoft.com/de-de/privacystatement

14.9 Microsoft Dynamics forms
We use Microsoft Dynamics 365 Customer Engagement to collect and transmit contact requests. Your data is processed on Microsoft servers.
Legal basis: Art. 6 (1) (b) and (f) GDPR
More information: https://privacy.microsoft.com/de-de/privacystatement

14.10 WiCE (SOFiSTiK Online)
For the purpose of storing customer data, WiCe technologies are used to collect and store personal data, which is transferred to our CRM system after transmission. This includes the following types of personal data:

• First name,
• Last name,
• Phone number,
• Email address,
• Company,
• Academic title,
• Position within the company,
• Relevant department within the company.

Data processing is based on Art. 6 (1) (a) GDPR, consent. This can be revoked at any time with effect for the future. The data is only passed on internally for the specified purpose. A contract for order processing in accordance with Art. 26 GDPR has been concluded with the service provider. Wice's applicable data protection regulations can be found at https://wice.de/datenschutz/. Further information can be found under “Contact.”