1. Introduction

1.1 Scope of application

Data protection is a top priority for us. We process your personal data exclusively within the framework of the applicable data protection laws, in particular the General Data Protection Regulation (GDPR). In the following, we inform you about the mode, scope and purposes of the processing of your personal data in accordance with Art. 13 GDPR when you use our websites.

1.2 Controller

The controller within the meaning of the data protection regulations for the processing of personal data is:

BGZ Fondsverwaltung GmbH

Otto-Hahn-Straße 12–16

D-25813 Husum

Further details about our company and the persons authorised to represent it can be found in our legal notice.

1.3 Data protection officer

You can reach our company data protection officer at:

PNE AG

Company data protection officer 

Oberbaumbrücke 1

D-20457 Hamburg 

Email: datenschutz(at)pne-ag.com

2. Definitions of terms

In this privacy notice, we use certain terms that also appear in the General Data Protection Regulation (GDPR). For a better understanding, we are providing explanations of the terms used below.:

2.1 Personal data

Personal data means any information relating to an identified or identifiable natural person. A person is considered identifiable if they can be directly or indirectly identified – for example, by reference to a name, an identification number, location data, an online identifier (such as IP addresses or cookies) or specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

2.2 Processing

The term processing refers to any activity involving the handling of personal data. This includes all processes – regardless of whether they are automated or not. Examples include the collection, storage, modification, use, transmission, publication, erasure or destruction of data.

2.3 Controller

A controller is a natural or legal person, public authority, organisation or other body which, alone or jointly with others, determines the purposes and means of the processing of data. The controller must take appropriate organisational and technical measures to ensure that the processing of personal data complies with legal requirements and is regularly reviewed.

2.4 Processor

A processor is a person, organisation, authority or other body that processes personal data on behalf of the controller. The processor acts on the basis of the controller's instructions.

2.5 Recipient

The recipient is any natural or legal person, public authority or other body to whom personal data is disclosed. This applies regardless of whether it is a third party or not. However, authorities that request personal data as part of statutory investigation mandates are not considered recipients under data protection law.

2.6 Third party

A third party is any natural or legal person, public authority or body other than the data subject, the controller or the processor. Persons who are authorised to process data under the direct supervision of the controller or a processor are also not considered third parties.

2.7 Consent

Consent is a central element of self-determination under data protection law. It represents the voluntary and conscious consent of the data subject to have their personal data processed. Consent must be given unambiguously – either in the form of a written declaration or by another confirmatory act. Any consent given can be withdrawn at any time.

3. General information on data processing

3.1 Scope of the processing of personal data

Personal data is information about your identity. This includes, for example, information such as name, address, telephone number or email address. We process the personal data of our interested parties, customers and suppliers only to the extent necessary to provide a functional website or to offer our services. As a rule, such data is processed if the data subject has given their prior consent. However, personal data may also be processed on other legal bases.

3.2 Legal bases for the processing of personal data

Personal data is only processed on the basis of a valid legal basis in accordance with the EU General Data Protection Regulation (GDPR):

• If a data subject has consented to the processing of personal data, the processing is based on Art. 6 (1) (a) GDPR.

• In the case of processing operations that are necessary for the initiation or fulfilment of a contract to which the data subject is party, we rely on Art. 6 (1) (b) GDPR.

• If the processing is necessary on the basis of a legal obligation to which we are subject, Art. 6 (1) (c) GDPR forms the legal basis.

• In cases where vital interests of the data subject or another natural person require processing, this is done on the basis of Art. 6 (1) (d) GDPR.

• If the processing is based on our legitimate interest, whereby the interests, fundamental rights and freedoms of the data subject do not prevail, Art. 6 (1) (f) GDPR serves as the basis for data processing.

We will inform you at the relevant points in this privacy policy of the legal basis on which your personal data is processed.

3.3 Storage and erasure of personal data

Personal data will be erased or blocked as soon as the purpose for which it was collected no longer applies. Any further storage will only take place if it is required by legal provisions of the European Union or national law to which we are subject. If legally stipulated storage periods expire, the data will also be erased or blocked, unless its further storage is necessary for the fulfilment of a contract or for the implementation of pre-contractual measures.

3.4 Disclosure of personal data

Your personal data will only be disclosed to third parties if this is necessary for the purpose of carrying out the data processing set out below or if you have previously consented to the transfer. We only disclose personal data about interested parties, customers or suppliers if we are obligated to do so by law or by a court order or if the disclosure is necessary to enforce or protect our contractual obligations. This also applies accordingly with regard to the storage of data. The data is not disclosed for commercial purposes.

For certain processing activities, we use external service providers that we select with due care. 

If personal data is transferred to these service providers as part of so-called order processing, this is done in accordance with the requirements of Art. 28 GDPR. Our processors are contractually bound by our instructions and are regularly monitored by us. We only work with partners who are demonstrably able to meet the requirements of the GDPR and the Federal Data Protection Act (BDSG) and ensure the protection of your rights through suitable technical and organisational measures. Our processors or other third parties may not use the data for other purposes. Our employees and the employees of the companies commissioned by us are committed by us to maintain confidentiality.

3.5 Data transfer to third countries

The General Data Protection Regulation (GDPR) ensures a uniformly high level of data protection within the European Union. Therefore, when selecting our service providers and co-operation partners, we generally prefer European providers if the processing of your personal data is necessary. Processing outside the European Union or the European Economic Area only takes place in exceptional cases and in connection with the use of third-party services.

Processing of your data in a so-called third country is only permitted on condition that the strict requirements of Art. 44 et seq. GDPR are fulfilled. As a rule, we obtain your express consent for this in accordance with Art. 49 (1) (a) GDPR. Alternatively, processing can be carried out on the basis of special guarantees. Such guarantees can be, for example, an officially recognised equivalence of the level of data protection by the EU Commission, as guaranteed by the Data Privacy Framework (DPF), or the application of so-called 'standard contractual clauses', which are officially recognised contractual obligations.

3.6 Profiling and automated decision-making

At BGZ Fondsverwaltung GmbH, personal data is neither used for automated decision-making nor for profiling in accordance with Art. 22 GDPR.

4. Rights of data subjects

You have the right to receive information about the origin, recipient and purpose of personal data stored concerning you free of charge and at any time. You also have the right to request the rectification, blocking or erasure of this data. You can contact us at any time if you have further questions on the subject of data privacy. You also have the right to lodge a complaint with the competent supervisory authority.

4.1 Right of access

In accordance with Art. 15 GDPR, you have the right to obtain information on the personal data concerning you, its origin and recipients and the purpose of the data processing, free of charge and at any time .

4.2 Right to rectification

If your data is not (or no longer) correct, you can request a rectification in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed. If we have passed on your data to third parties, we will inform these third parties of the rectification – if this is required by law.

4.3 Right to erasure

The stored personal data will be erased in accordance with Art. 17 GDPR after expiry of the statutory retention periods. Stored personal data will also be erased if you withdraw your consent to storage and there is no other legal basis for the storage, if knowledge of the data is no longer required to fulfil the purpose for which it was stored or if its storage is inadmissible for other legal reasons, unless statutory retention requirements prevent erasure, in which case processing will be restricted (blocked) instead of erased.

Stored personal data will also be erased if your personal data has been processed unlawfully or must be erased in order to comply with legal requirements. In the event that erasure cannot be realised or can only be realised with disproportionate effort, processing shall be restricted instead of erased.

4.4 Right to restriction of processing

You have the right to request the restriction of the processing of your personal data in accordance with Art. 18 GDPR. You can contact us at any time for this purpose. The right to restriction of processing  applies in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to check this. While the check is ongoing, you have the right to request that the processing of your personal data be restricted.

• If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of erasure.

• If we no longer need your personal data, but you need it for the exercise, defence or assertion of legal claims, you have the right to request the restriction of the processing of your personal data instead of its erasure.

• If you have lodged an objection in accordance with Art. 21 (1) GDPR, your interests must be weighed against ours. As long as it has not yet been determined whose interests prevail, you have the right to demand the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data – apart from its storage – may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

4.5 Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw any consent you have already given at any time in accordance with Art. 7 (3) GDPR. All you need to do is to notify us by sending an informal email. The lawfulness of the data processing carried out until its withdrawal remains unaffected by the withdrawal.

4.6 Right to object to the collection of data

If the data processing is carried out on the basis of Art. 6 (1) (f) GDPR, you have the right to object to the processing of your personal data at any time in accordance with Art. 21 GDPR for reasons arising from your particular situation. If you lodge an objection, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing is required for the establishment, exercise or defence of legal claims.

4.7 Objection to advertising emails

We hereby object to the use of contact data published in the context of the legal notice requirement to send unsolicited advertising and information material. BGZ Fondsverwaltung GmbH expressly reserves the right to take legal action in the event of the unsolicited sending of advertising material, such as spam emails.

4.8 Right to data portability

In accordance with Art. 20 GDPR, you have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract provided to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent that it is technically feasible.

4.9 Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR, in particular in the Member State of your habitual residence, place of work or place of the alleged violation. The right to lodge a complaint exists notwithstanding other administrative or judicial remedies.

A list of data protection officers and their contact details can be found at the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html

5. Online offers

5.1 Visits to our website

Purpose of data processing and data categories

If you only use the website for information purposes, i.e. if you do not transmit any other information to us, only the personal data that your browser transmits to the server will be processed when you visit this website. The data collected is used exclusively to provide and improve the content and functionality of our websites. 

When you visit our website, information is transmitted that we need in order to display and provide you with our webpages, such as

• IP address of the requesting computer (for a maximum of 7 days)

• Operating system of the calling computer

• Browser version of the calling computer

• Name of the file retrieved

• Date and time of access

• Amount of data transferred

• Referring URL

As a rule, this data cannot be assigned to a specific person. This data is not merged with other data sources.it is not merged with other data sources.

Legal basis for data processing

The legal basis for the processing of personal data is Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in the secure, stable and efficient provision of the functions of the website and the information that can be accessed via it. If we fulfil an existing contractual obligation towards you by providing the website, the legal basis is Art. 6 (1) (b) GDPR.

Duration of storage

The data collected will be erased after a statistical analysis at the end of the session.

Disclosure of data to third parties

This data will not be passed on to third parties unless there is a legal obligation to pass it on or it serves the purpose of criminal prosecution.

5.2 Contact form

Purpose of data processing and data categories

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in the event of follow-up questions. We do not pass on this data without your consent.

Legal basis for data processing

This data is processed on the basis of Art. 6 (1) (b) GDPR, provided that your enquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the enquiries addressed to us (Art. 6 (1) f GDPR) or on your consent (Art. 6 (1) (a) GDPR) if this has been requested.

Duration of storage

We will retain the data you provide on the contact form until you request its erasure, withdraw your consent for its storage, or the purpose for its storage no longer pertains (e.g. after fulfilling your request).Mandatory statutory provisions – in particular retention periods – remain unaffected.

Disclosure of data to third parties

Your data will not be passed on to third parties.

Objection and withdrawal

Your consent to the processing of personal data on the basis of the use of our contact form can be withdrawn at any time. 

5.3 Job applications via our own services

Purpose of data processing and data categories

If you would like to apply to us, for example for an advertised vacancy, you can submit your application documents via an application form on our website or by email. We do not use any external, third-party applicant tracking software for this purpose; instead, we process your data exclusively on our own systems. As part of the application process, we process the data you provide, in particular your contact details (e.g. name, address, email address, telephone number), your application documents (e.g. CV, cover letter, certificates, references) and any other information you voluntarily provide (e.g. salary expectations, earliest possible start date).

Legal basis for data processing

Your application data is processed for the purposes of the application process on the basis of Article 6 (1) (b) of the GDPR in conjunction with Section 26 (1) of the BDSG, as the processing is necessary for the decision on whether to establish an employment relationship. To the extent that you voluntarily provide us with additional data, such data will be processed on the basis of your consent in accordance with Article 6 (1) (a) of the GDPR.

Duration of storage

Your application documents will be retained for the duration of the application process. In the event of a rejection, we will delete your data no later than 6 months after the end of the recruitment process, unless you have consented to your data being retained for a longer period, for example for future consideration within our candidate pool. The six-month period is intended to enable us to respond to any enquiries relating to the General Equal Treatment Act (AGG). If an employment relationship is established, the data provided during the application process will be further processed in the personnel file; the subsequent retention period will then be determined by the applicable statutory retention periods.

Disclosure of data to third parties

Under no circumstances will your application documents be passed on to third parties. Within BGZ Fondsverwaltung GmbH, only those individuals involved in the application process (e.g. the Human Resources department, the relevant specialist department) will have access to your data. Data will only be disclosed to external third parties to the extent that this is necessary for the purposes of the application process and there is a corresponding legal basis, such as a statutory obligation, or if you have given your express consent in advance.

Withdrawal and objection

You may withdraw your consent to the processing of personal data as part of the application process at any time, with effect for the future, for example by sending an email to datenschutz@pne-ag.com. Where the processing of your application data is based on our legitimate interest, you may object to such processing at any time on grounds relating to your particular situation. The lawfulness of the processing carried out up to the time of withdrawal or objection remains unaffected by this. Please note that we will be unable to consider your application unless we process the data required for this purpose.

5.4 Cookies

Purpose of data processing and data categories

We use different types of cookies:

• Session cookies: These cookies are only stored for the duration of your visit to our website. For example, they enable certain functions on the website and are automatically deleted as soon as you close your browser or end your visit.

• Persistent cookies: These cookies remain stored on your device even after you have finished your visit. For example, they enable us to recognise your device when you visit us again at a later date, or to save the settings you have chosen for a certain period of time. Persistent cookies are automatically deleted once the specified retention period has expired, or you can delete them beforehand via your browser settings.

Where cookies are technically necessary for the operation and provision of certain functions on our website, they are used to enable these functions. The use of cookies does not result in any programmes or other applications being installed or launched on your device.

Legal basis for data processing

If consent to the storage of cookies and comparable recognition technologies has been requested, the processing is carried out exclusively on the basis of this consent (Art. 6 (1) (a) GDPR and Section 25 (1) Telecommunications-Digital-Services-Data Protection Act (TDDDG)). 

BGZ Fondsverwaltung GmbH has a legitimate interest in the storage of cookies necessary for the technically error-free and optimised provision of its website. Cookies that are required to carry out the electronic communication process, to provide certain functions that you have requested or to optimise the website (e.g. cookies to measure the web audience) (necessary cookies) are stored on the basis of Art. 6 (1) (f) GDPR, unless another legal basis is specified.

Cookiebot is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 (1) (c) GDPR.

Duration of storage

Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your end device until you delete them yourself or they are automatically deleted by your web browser.

Disclosure of data to third parties

On our website, we use the Cookiebot consent management platform provided by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot is used to obtain, manage and document your consents in accordance with data protection regulations. To this end, a cookie is stored in your browser, which is used to track and record your consents and any withdrawal thereof.

The cookie banner is technically integrated and maintained by our advertising agency, Convoy Interactive GmbH, Friedensallee 120, D-22763 Hamburg, as part of the website management service. Convoy Interactive is solely responsible for the technical display and integration of the banner; Cookiebot manages and documents your consents.

We have entered into a data processing agreement with both service providers in accordance with Article 28 of the GDPR. This ensures that personal data is processed only in accordance with our instructions and in compliance with data protection regulations.