Data protection & legal information

EUROPA-CENTER AG (hereinafter referred to as "EUROPA-CENTER AG" or "we") takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and in particular the General Data Protection Regulation ("GDPR") and the Federal Data Protection Act ("BDSG") as well as this privacy policy.

When you visit this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

1. Controller for the processing

EUROPA-CENTER AG
Hammerbrookstrasse 74

20097 Hamburg

Phone: +49 40 27144-0

E-mail: info@europa-center.com

As the controller within the meaning of data protection law, we determine the purposes and means of the processing of personal data described here, either alone or jointly with others.

2. Contact details of the data protection officer

If you have any questions and/or concerns about data protection, please contact our data protection officer using the following contact details:

IBS data protection services and consulting GmbH
Zirkusweg 1
20359 Hamburg
Hamburg, Germany
E-Mail: dsb@ibs-data-protection.de

3. Purposes and legal bases

3.1 Technical provision of EUROPA-CENTER AG websites and EUROPA-CENTER AG services

The processing is carried out for the purpose of providing our websites on the basis of an overriding legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. Our legitimate interests are the provision of technically necessary and expressly requested digital services, ensuring the security and trouble-free operation of our IT systems and the assertion, exercise and defense of legal claims.

When you visit our websites, we collect pseudonymized connection data that is required to display the desired web pages (e.g. IP address, referrer URL, target page, time stamp) and store this data in connection logs (server log files) on the web server.

In addition, in certain cases we store pseudonymized information in your browser (cookies or local storage) insofar as this is necessary to display our websites or to enable necessary functions on our websites (technically necessary services or cookies), such as cookies that are necessary to carry out the electronic communication process, to provide certain functions you have requested (e.g. for the shopping cart function). The storage of information in your end device or access to information stored there is absolutely necessary in these cases in order to provide you with the expressly requested digital service.

If you use a contact form provided by us, we collect the data you enter, but at least the information marked as mandatory. The transmission to the web server is encrypted via https (SSL) and then sent to us by e-mail. In addition to the data entered (message content), connection data (e.g. IP address, mail client, time stamp) and metadata (e.g. size of the transmitted data) as well as any attachments containing personal data are processed for all communication by email. E-mails are always checked for unwanted content (e.g. viruses, spam) in our IT systems using technical equipment.

This website is hosted externally by ANBIETER, ADRESSE. The personal data collected on this website is stored on the hoster's servers. An order processing contract has been concluded with the external service provider to ensure data protection-compliant processing.

You must provide this data without any legal or contractual obligation to do so. A visit to our website is not possible or only possible with restrictions without the provision of this information.

3.2 Cookie banner

The processing is carried out for the purpose of obtaining, managing and proving your consent to the use of non-essential cookies and web services on the basis of an overriding legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. Our legitimate interests are the verifiability of compliance with legal requirements pursuant to Art. 5 para. 2 GDPR and the assertion, exercise and defense of legal claims.

When you visit our websites, you can give or subsequently change your consent to the web services via an additional interface (Consent Manager). We process pseudonymous information (e.g. IP address, time stamp) via the cookie banner and store your consent in your browser (cookie / local storage) to ensure that only those services are used to which you have consented.

The storage of information in your end device or access to information stored there is absolutely necessary in these cases in order to provide you with the expressly requested digital service.

3.3 Web services

The processing is carried out for the purpose of statistical evaluation of the interaction of website visitors, for the integration of content from other websites as well as for advertising purposes and marketing activities on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR. In accordance with Art. 7 para. 3 GDPR, you have the right to revoke any consent you have given for the processing of your personal data at any time with effect for the future. The lawfulness of processing based on your consent in accordance with Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR remains unaffected until you withdraw your consent. If you give us your consent to individual or all web services via the cookie banner, we collect pseudonymous information (e.g. IP address, time stamp) and store it in your browser (cookie / local storage). The third-party providers we use then receive access to this data in order to provide the desired web services.

In these cases, the storage of information in your terminal device or access to information stored there is based on your consent in accordance with Section 25 (1) TDDDG. You are neither legally nor contractually obliged to provide this data. It is generally possible to visit our website without providing this information. The following web services are used by us depending on the category in the cookie banner:

· Google Analytics 4 This website uses Google Analytics 4, a service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), a subsidiary of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, with which the use of websites can be analyzed. In this context, pseudonymized user profiles are created and cookies are used. The information generated by the cookie about your use of this website may include a short-term collection of the IP address without permanent storage, location data, browser type/version, operating system used, referrer URL (previously visited page) and time of the server request. The pseudonymized data is transmitted by Google to a server in the USA and stored there. The information is used to evaluate the use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage for the purposes of market research and the needs-based design of this website. These processing operations are only carried out if express consent is given in accordance with Art. 6 para. 1 lit. a GDPR. The maximum lifespan of Google Analytics cookies is 2 years. Data whose retention period has been reached is automatically deleted once a month. The data collected as part of the use of Google Analytics 4 is stored for 2 months and then deleted. The parent company Google LLC is certified as a US company under the EU-US Data Privacy Framework. This constitutes an adequacy decision pursuant to Art. 45 GDPR, meaning that personal data may also be transferred without further guarantees or additional measures. We have concluded an order processing contract with Google for our use of Google Analytics 4, which obliges Google to protect the data of our website users and not to pass it on to third parties. Further information on data protection when using GA4 can be found at: https://support.google.com/analytics/answer/12017362?hl=de .

3.4 EUROPA-CENTER AG in social media

The processing is carried out for the purpose of providing our fan pages in social networks (company pages) and for marketing purposes on the basis of an overriding legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. Our legitimate interests are the support of the social media platforms as well as the presentation of our business activities and the implementation of marketing activities. If you visit our company page on one of the following social media platforms, we determine the purposes and means together with the platform operators. In terms of data protection, we are joint controllers pursuant to Art. 26 GDPR. We have set a link to the pages of social networks. There is no further data exchange with these sites on our website. If the social media element is active, a direct connection is established between your device and the provider. The provider then receives information about your visit to this website. If consent has been obtained, the above-mentioned service is used on the basis of Art. 6 para. 1 lit. a GDPR and § 25 TDDDG. Consent can be revoked at any time. You are neither legally nor contractually obliged to provide us with this information. The use of social networks is independent of the provision of your data, but it is not possible to contact us or visit our profile without the provider of the social network providing us with this data.

· Instagram Our fan page on Instagram is provided by Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, D04 X2K5 Ireland (Meta). When you visit our fan pages, we process information about you that you provide through your visit (e.g. user name, comments, messages) as well as so-called page insights (statistical evaluation of your visit) together with Meta. The processing carried out by Meta after forwarding is not part of the joint responsibility. When you visit our Instagram page, we process the following data:

· Your user name,

· Comments that you post on our site,

· Messages that you write to us via Facebook,

· Page Insights (page visits, number of posts, country/city from which our visitor comes, gender-specific statistics). You can find more information about Page Insights here: https://www.facebook.com/legal/terms/information_about_page_insights_data

For the processing of personal data with Page Insights on Instagram, the purposes and means of processing are determined jointly with Meta, so that we are joint controllers in accordance with our agreement (page controller addendum https://www.facebook.com/legal/terms/page_controller_addendum) ("Joint Controller Agreement"). Further information on data protection at Meta can be found here: https://privacycenter.instagram.com/policy/?section_id=13-HowToContactMeta. You can contact the data protection officer using this form: https://www.facebook.com/help/contact/540977946302970 Your data may also be transferred to Meta's parent company in the United States. The transfer of personal data to Meta is based on the adequacy decision (Data Privacy Framework).

· Xing If you access our profile on the social network "XING" as a registered user, follow us or interact with us (e.g. message, comment), or we access your profile, New Work SE, Am Strandkai 1, 20457 Hamburg ("XING") processes your information as an independent controller (operation of the social network) and shares with us all information required for the operation of the social network in accordance with the XING Terms of Use. In this case, we collect user data (e.g. name, location), qualification data (e.g. professional activity, position, education) and communication data (e.g. message content) directly from you or through the use of the XING social network. Further information on the processing of personal data by XING can be found at the following external link: https://privacy.xing.com/de/datenschutzerklaerung/druckversion.

· LinkedIn If you visit our profile on the social network "LinkedIn" as a registered user, follow us or interact with us (e.g. message, comment), LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn") processes personal data in order to provide us with aggregated information ("Page Insights"). No information is provided that enables us to track the behavior of an individual user. We and LinkedIn are joint controllers pursuant to Art. 26 GDPR for the processing of personal data for the purpose of providing Page Insights. For more information on the processing of your personal data as joint controllers, please visit the following external link directly at LinkedIn: https://legal.linkedin.com/pages-joint-controller-addendum. If, as a registered user, you also interact with our profile or posts shared by us (e.g. reading, following, commenting) or we access your profile, LinkedIn processes your information as an independent controller (operation of the social network) and shares with us all information required for the operation of the social network in accordance with LinkedIn's terms of use. In this case, we collect user data (e.g. name, location), qualification data (e.g. professional activity, position, education) and communication data (e.g. message content) directly from you or through the use of the LinkedIn social network. Further information on the processing of personal data by LinkedIn can be found at the following external link: https://de.linkedin.com/legal/privacy-policy. Your data may also be transferred to the parent company of LinkedIn - Microsoft Corporation, in the United States. The transfer of personal data to Microsoft is based on the adequacy decision (Data Privacy Framework).

3.5 Your application to us

Processing for the purpose of carrying out application procedures is carried out to decide on the establishment of an employment relationship and, after the employment relationship has been established, to carry it out in accordance with Section 26 (1) BDSG. In addition, in the event of a rejected application, processing may be carried out to safeguard overriding legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR . Our legitimate interest is the assertion, exercise or defense of legal claims. If, in the case of an unsolicited application or a rejection of the application, you expressly agree to keep and consider it for a later date, the processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. In accordance with Art. 7 para. 3 GDPR, you have the right to withdraw your consent to the processing of your personal data at any time. The lawfulness of processing based on your consent in accordance with Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR remains unaffected until you withdraw your consent. When you apply to us, we collect all the personal data that you provide to us as part of your application. You can submit an unsolicited application or one based on a job advertisement published by us. We then process your personal data in the application process in order to invite you to a personal interview if necessary and to decide on the establishment of an employment relationship. If you use one of our contact forms for your application, we will collect the data you enter. If we are unable to make you a job offer, you reject a job offer or withdraw your application, we reserve the right to retain the data you have submitted on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR) for up to 6 months from the end of the application process (rejection or withdrawal of the application). The data will then be deleted and the physical application documents destroyed. The retention serves in particular as evidence in the event of a legal dispute. If it is apparent that the data will be required after the 6-month period has expired (e.g. due to an impending or pending legal dispute), the data will only be deleted when the purpose for further storage no longer applies. Longer storage may also take place if you have given your consent (Art. 6 para. 1 lit. a GDPR) or if statutory retention obligations prevent deletion. In the event that you have consented to the processing of your personal data by our affiliated companies, we will share your data with XXXX GmbH.

3.6 Enquiries by e-mail, contact form and telephone

If you send us inquiries by e-mail, telephone or contact form, your details will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions. We will not pass on this data without your consent. This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your request is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested; consent can be revoked at any time. The data collected from you will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory statutory provisions - in particular retention periods - remain unaffected. To contact us, you are neither contractually nor legally obliged to provide the data. However, it is not possible to process the request without providing certain personal data (mandatory fields), so that contact cannot be made without providing this information.

3.7 Use of our services and business communication

Processing for the purpose of providing our services and business communication is carried out for the fulfillment of the contract pursuant to Art. 6 para. 1 lit. b GDPR, for the fulfillment of legal obligations pursuant to Art. 6 para. 1 lit. c GDPR and for the protection of overriding legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR. Our legitimate interests are the fulfillment of the contract, insofar as we have concluded the contract with a third party for whom you are working, as well as the assertion, exercise and defense of legal claims. In addition, in certain cases, about which we will inform you separately, processing may also be based on your consent in accordance with Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR. If you conclude a contract directly with us as a natural person, we collect all personal data required for the establishment, performance or termination of the contract. This also applies if you negotiate or conclude a contractual agreement on behalf of another natural or legal person. If we do not collect the data directly from you, we receive information about your person (name, position), contact data (e.g. e-mail, telephone) and contract data (e.g. performance obligations) from third parties whom you have named as the contact person or person responsible for the establishment, execution or termination of the contractual relationship. We process personal data to the extent necessary for the performance of the contract, the management of the customer relationship, the processing of inquiries and the verification and invoicing of services provided. In addition, we process this data to enable appropriate risk management and controlling as a legal entity and to comply with other legal regulations (e.g. commercial and tax law). As a legal entity, we are obliged to comply with various legal provisions, in particular commercial and tax law. In addition, our activities may also require us to take measures to combat money laundering, ensure IT security for critical infrastructure or participate in audits as significant outsourcing within the meaning of financial supervision. You are not legally or contractually obliged to provide the personal data. However, without the information requested by us, the use of our services is not possible or only possible to a limited extent.

3.8 Processing of your data when contacting us at trade fairs and events

If you provide us with your contact details in person at trade fairs and similar events, we will collect them in order to stay in contact with you. The legal basis for data processing in the context of requests for cooperation with us is Art. 6 para. 1 lit. b. GDPR, the implementation of pre-contractual measures based on your request. In other cases, we process your data because you have expressly consented to this (Art. 6 para. 1 lit. a GDPR). If your data can be assigned to a contractual relationship following the inquiry, we will delete it after the contract period, otherwise after your inquiry has been dealt with, or restrict processing if there are statutory retention obligations. If our data processing is based on your consent, the regulations apply according to which you can revoke your consent at any time and your data will then be deleted in accordance with the prescribed deletion periods.

3.9 Exercising your rights as a data subject

The processing is carried out for the purpose of guaranteeing the rights of data subjects on the basis of the fulfillment of legal obligations pursuant to Art. 6 para. 1 lit. c GDPR and to safeguard overriding legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the assertion, exercise and defense of legal claims. If you contact us to assert your rights as a data subject, we will collect all the personal data that you provide to us as part of the request. Alternatively, we may also receive the data from third parties if you have commissioned someone to assert your rights on your behalf (e.g. representative, lawyer, counselor) or have contacted other bodies in advance (e.g. data protection officer). We process this data to ensure your identity, to check the applicability of the respective rights, to implement your rights and to communicate with you. You are under no legal or contractual obligation to provide your data. However, without the provision of certain information that enables your person to be identified or your rights to be implemented, it is not possible or only possible to a limited extent to process your request.

4. Disclosure of personal data

At EUROPA-CENTER AG, only those persons who are responsible for processing personal data (e.g. administrators, clerks) obtain knowledge of it. Certain activities are not carried out by us, but by contracted service providers as processors in accordance with Art. 28 GDPR. These are carefully selected, contractually bound and regularly reviewed by us. In certain individual cases, we pass on personal data to third parties (e.g. legal advisors, auditors, data protection officers, authorities, courts, our affiliated companies) insofar as this is necessary for processing and legally permissible. Transfers to recipients in third countries outside the EU/EEA or to international organizations only take place insofar as this is necessary and legally permissible for the respective processing. In these cases, the transfer takes place on the basis of an EU

adequacy decision or, if this does not exist, on the basis of agreed standard contractual clauses or binding internal data protection regulations. Insofar as the aforementioned guarantees do not exist, the transfer to third countries outside the EU/EEA is based on an exception pursuant to Art. 49 para. 1 GDPR (express consent, performance of a contract, assertion, exercise or defense of legal claims).

5. Time limits for storage

To guarantee the principle of storage limitation in accordance with Art. 5 para. 1 lit. e GDPR, we store personal data in a form that only allows the identification of data subjects for as long as is necessary for the respective legitimate purposes. We have set the following retention periods

· Depending on the IT system, server log files are stored for 3 days and then automatically deleted;

· Technically necessary cookies are deleted at the end of a session (e.g. closing the browser) or after reaching the specified maximum age (max-age) or manually by the user in the browser;

· Non-essential cookies are deleted after the specified maximum age (max-age) or manually by the user in the browser.

· Application documents of rejected applicants will be deleted 6 months after rejection without consent for permanent storage. Personal data that must be stored due to commercial or tax regulations in accordance with § 147 AO, § 257 HGB will not be deleted before 6 years or 10 years have elapsed. Further storage takes place for the assertion, exercise or defense of legal claims, e.g. in the case of unresolved tax, audit or administrative proceedings. Personal data that we process for the assertion, exercise or defense of legal claims will generally be deleted after 3 years (regular limitation period pursuant to Section 195 BGB); in certain cases (e.g. claims for damages), the limitation period is 10 years or 30 years from the date on which the claim arises pursuant to Section 199 BGB, whereby the maximum storage period is 30 years from the date of the damaging event.

6. Your rights as a data subject

Right to information

In accordance with Art. 15 GDPR, you have the right to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have the right to information in accordance with Art. 15 para. 1 GDPR, including a copy of your data in accordance with Art. 15 para. 3 GDPR, provided that the rights and freedoms of other persons are not affected. This includes business secrets, intellectual property rights or copyrights. The right to information can be restricted or refused in accordance with Section 34 BDSG. In this case, we will inform you of the reasons for the refusal.

Right to rectification

In accordance with Art. 16 GDPR, you have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you and, depending on the purposes of the processing, to have incomplete personal data completed. Unless this is impossible or involves a disproportionate effort, we will inform all recipients to whom we have disclosed your personal data of the correction. In accordance with Art. 19 p. 2 GDPR, you have the right to be informed about these recipients

Right to erasure

In accordance with Art. 17 GDPR, you have the right to demand that we erase personal data concerning you without undue delay. We are obliged to delete your data if one of the reasons pursuant to Art. 17 para. 1 GDPR applies. If we have made your personal data public and are obliged to delete it, we will take appropriate measures in accordance with Art. 17 para. 2 GDPR to inform other data controllers if you have requested the deletion of all links to this data or of copies and replications. Unless this is impossible or involves a disproportionate effort, we will inform all recipients to whom we have disclosed your personal data of the deletion. In accordance with Art. 19 p. 2 GDPR, you have the right to be informed about these recipients. The right to erasure does not exist pursuant to Art. 17 (3) GDPR if the processing of your personal data is necessary for the reasons stated therein. This applies in particular if the storage of your data is still required due to statutory retention obligations (Art. 17 para. 3 lit. b GDPR) or your data is required for the assertion, exercise or defense of legal claims (Art. 17 para. 3 lit. e GDPR). The right to erasure also does not exist in accordance with Section 35 (3) BDSG if the storage of your data is required due to statutory or contractual retention obligations. In addition, the right to erasure may also be restricted in accordance with Section 35 (1) BDSG. In this case, the processing of your data is restricted in accordance with Art. 18 GDPR.

Right to restriction of processing

In accordance with Art. 18 GDPR, you have the right to demand that we restrict processing if one of the conditions stated therein is met. If the processing of your data has been restricted, your data will continue to be stored in accordance with Art. 18 para. 2 GDPR, but will only be processed in another way if you consent to this or if this is done to assert, exercise or defend legal claims, to protect the rights of another natural or legal person or for reasons of an important public interest of the EU or a member state. If your data has been restricted, you will be notified before the restriction is lifted. Unless this is impossible or involves a disproportionate effort, we will inform all recipients to whom we have disclosed your personal data of the restriction. In accordance with Art. 19 p. 2 GDPR, you have the right to be informed about these recipients.

Right to data portability

Pursuant to Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another controller without hindrance from us, where the processing is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR and the rights and freedoms of other natural persons are not adversely affected.

Right to object

In accordance with Art. 21 GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation, provided that this is done on the basis of our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. The right to object pursuant to Art. 21 (1) GDPR does not apply if we demonstrate that we have legitimate grounds for the processing which override your interests, rights and freedoms or if the processing is necessary for the establishment, exercise or defense of legal claims. Irrespective of this, you have the right under Art. 21 (2) GDPR to object at any time to the processing of your data for the purpose of direct marketing, including profiling in connection with direct marketing. In this case, we will no longer process your data for the purpose of direct marketing.

Revocation of consent

If the processing of your personal data is based on consent pursuant to Art. 6 para. 1 lit. a GDPR, you have the right to withdraw your consent at any time with effect for the future pursuant to Art. 7 para. 3 GDPR.

Automated decision-making pursuant to Art. 22 GDPR

In accordance with Art. 22 para. 1 GDPR, you have the right not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects concerning you or similarly significantly affects you. We do not process personal data by means of automated decision-making in individual cases, including profiling in accordance with Art. 22 para. 1, 4 GDPR.

Right to lodge a complaint pursuant to Art. 77 GDPR

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR if you consider that the processing of your personal data infringes the GDPR. You can contact any supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, including the supervisory authority responsible for us - Thuringian State Commissioner for Data Protection and Freedom of Information (TLfDI)

7. protection of personal data

We have implemented a comprehensive information security program that includes technical and organizational measures to secure and protect your data. In particular, we use the following security measures to protect your personal data from unauthorized access, disclosure, use or modification:

· Encryption of personal data

· You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

· Storage of important information such as passwords after they have been encrypted

· Countermeasures against hacker attacks

· Creation and implementation of the internal safety management plan

· Installation and operation of an access control system

· Measures to prevent the falsification or modification of access data

However, due to constantly changing technology and other factors beyond our control, we cannot guarantee that communications between you and our servers will be free from unauthorized access by third parties or that we will not be affected by security breaches. This data protection notice applies with effect from 17.02.2025 and replaces all previous versions.