Data Privacy

Information on Data Processing

in relation to the use of the website https://wollmilchsau.de

including the use of download offers

as well as in relation to recruitment processes

1. Controller

The controller for data processing on this website as well as in the context of application processes within the meaning of Art. 4 (7) GDPR is:

Wollmilchsau GmbH
Koppel 97
20099 Hamburg

Tel.: +49 (0)40 444 0 557 0
E-mail: info[at]wollmilchsau.de

Represented by:

• Jan Kirchner
• Alexander Fedossov

– hereinafter referred to as Wollmilchsau GmbH –

2. Subject of Data Protection

The subject matter of data protection is personal data. According to Art. 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person. This includes, for example, details such as names, postal addresses, email addresses or telephone numbers, usage data such as IP addresses, content data such as your blog comments, as well as information you provide to us in the course of application procedures.

3. Scope and Purpose of Data Collection and Storage

In the following, we explain the scope of data collection, storage and use (referred to collectively as “data processing” within the meaning of Art. 4(2) GDPR), as well as the purposes of the respective data processing activities carried out via this website and within the recruitment processes of Wollmilchsau GmbH.

4. Processing of Personal Data in the Context of Website Use

As a general rule, you can use this website without providing personal data. The only exception is your IP address, which we necessarily require for a short period of time (see Section 4.1 for details).

4.1 IP Addresses

Put simply, the internet cannot function without Internet Protocol addresses, or “IP addresses.“ An IP address serves as an identifier within computer networks that enables web servers and/or individual end devices to be reached and addressed. Without IP addresses, web servers and end devices cannot communicate—and therefore cannot display anything.

When you access our website, the web server hosting it is “pinged” with a data request from your device. In order to return the requested data, the web server must know your IP address. Accordingly, at the moment of the data request, the web server processes your IP address. In doing so, the server also receives information about which webpage or file was accessed, which browser and operating system were used, and similar technical details.

Ordinarily, such data would be fully stored for a longer period of time in so-called server log files. Wollmilchsau, however, does not store users’ full IP addresses beyond the moment of necessary processing. Instead, we anonymize the IP addresses by automatically replacing them with the generic value 0.0.0.0 in the log files.

The legal basis for this data processing is regularly Art. 6(1)(b) GDPR, as we require your IP address to transmit the website and the information contained therein to you in the first place.

4.2 Cookies

Cookies are small text files stored on your computer by websites in order to

• make the website usable in the first place, for example by storing the content of a shopping cart during a session, or by saving the information that no cookies should be stored at all (so-called necessary cookies);

• store user preferences over a longer period of time, such as language settings, or to personalize content (so-called preference cookies);

• enable analysis of how the website is used (so-called statistics cookies);

• transmit user information to third parties (so-called marketing cookies).

When you visit our website for the first time, a cookie banner will appear. Through that banner, you can individually decide (i.e. give consent) regarding which categories of cookies may be set. Below you can see the consent currently granted by you and which cookies are set by us or by third-party providers within each category:

You can also prevent the installation of cookies altogether by disabling cookie storage through the appropriate settings in your browser software (usually found under “Settings” in most browsers). Please note, however, that doing so may mean that not all functions of the website can be used in full.

In addition, cookies that have already been set can be deleted (also under “Settings” in your browser).

The legal basis for this data processing is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time by clicking on “Change consent.”

Furthermore, we would like to provide you with specific information about the integration of Google Analytics (Section 4.2.1) and about the use of our social plugins (Section 4.7).

4.2.1 Use of Google Analytics

Google Analytics is integrated into our website. Google Analytics is a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). As a service provider, Google determines the usage behavior of website visitors and enables us to understand whether and how we can improve our website and its user navigation—e.g., which parts are particularly relevant and which are not. This allows us to optimize the content and functionality of the website for you and for us. For this purpose, Google sets cookies. The integration of Google Analytics is carried out via the Google Tag Manager.

Through Google Analytics and the cookies set in this context, we process the following data:

• Browser type

• Operating system used

• Time spent on our website

• Time of the server request

• Your approximate location (based on the IP address), accurate to roughly the city/district level

As explained above, you determine via the cookie settings whether we may set cookies for statistical purposes. If you decline, no cookies will be set. Accordingly, the legal basis for this data processing is your consent pursuant to Art. 6(1)(a) in conjunction with Art. 7 GDPR. Google is contractually bound to us for data protection purposes under a data processing agreement.

You can prevent the storage of Google Analytics cookies (as well as other cookies) by adjusting the general settings of your browser software (found under “Settings” in most browsers). However, please note again that if you do so, not all functions of this website may be fully available.

In addition, you can prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address), as well as the processing of such data by Google, by downloading and installing the browser plugin available at the following link:
http://tools.google.com/dlpage/gaoptout?hl=de

If you are using the site on a tablet or mobile device and wish to prevent Google Analytics from tracking visits to this website in the future, please click this link. Clicking the link will store an opt-out cookie in your mobile browser. If that cookie is deleted, the link must be clicked again.

4.2.2 Use of SalesViewer® Technology

Data is collected and stored on this website using the SalesViewer® technology of SalesViewer® GmbH for marketing, market research and optimization purposes, on the basis of the website operator’s legitimate interests (Art. 6(1)(f) GDPR).

For this purpose, a JavaScript-based code is used to collect company-related data and to enable the corresponding use of such data. The data collected by this technology is encrypted using a non-reversible one-way function (so-called hashing). The data is immediately pseudonymized and is not used to personally identify visitors to this website.

The data stored within the scope of SalesViewer® will be deleted as soon as it is no longer required for its intended purpose, and provided that there are no statutory retention obligations preventing deletion.

You may object to the collection and storage of data at any time with effect for the future by clicking the following link: https://www.salesviewer.com/opt-out to prevent future collection of data by SalesViewer® on this website. An opt-out cookie will be stored on your device for this website. If you delete the cookies in your browser, you will need to click the link again.

4.3 Contact via E-Mail, Processing of Prospect Data

When you contact us by email, you generally transmit the following personal data to us:

• Email address

• First and last name

• Telephone number

• Your inquiry

The legal basis for this data processing is also Art. 6(1)(b) GDPR, as we would not be able to respond to you and address your inquiry without receiving your personal contact details.

If your message expresses interest in our services, we process your data as prospect data. This means that we enter your contact details and the reason for your inquiry into our CRM system. This processing is carried out on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in maintaining and intensifying contact with potential customers. This is only possible if we do not delete the data. There is no overriding interest on your part in this case, as you have voluntarily provided us with the data in the context of expressing interest.

4.4 Newsletter Registration

When you subscribe to our newsletter, we naturally require your email address in order to send the newsletter. Since addressing people personally is friendlier, we also ask for your name. You are welcome to provide a nickname or pseudonym instead.

In addition, we collect statistical data on which users have opened the newsletter and which users have clicked on links within it. This helps us understand which content is of interest to our users. These data processing activities are based on your consent pursuant to Art. 6(1)(a) in conjunction with Art. 7 GDPR.

We obtain your consent through the double opt-in process. You first sign up for our newsletter and then receive an email containing information about this data processing and a confirmation link. Only after you click the confirmation link will you be added to the newsletter distribution list. We do this to ensure that it is truly you who entered your email address and that you wish to receive the newsletter, and to be able to prove this if necessary.

For the purposes of this documentation, we log your newsletter registration. Specifically, we store the registration and confirmation time as well as your full IP address at the time of registration or confirmation. We process this data on the basis of Art. 6(1)(f) GDPR, as we have a legitimate interest in being able to prove your registration for the newsletter in the event of potential legal disputes. There is no overriding legitimate interest on your part in preventing this processing. In fact, the double opt-in procedure is also in your interest, as it ensures that unauthorized third parties cannot subscribe on your behalf.

4.5 Data Processing for Whitepapers, Studies, Events or Webinars (Download Material)

If you wish to make use of the content or services provided through our download offerings (“download material”), we process your data for the purpose of performing the contract, as described in more detail in the following sections.

4.5.1 Contract for Download Services

In our download area, we offer, among other things, the following services:

• Whitepapers, checklists and studies available for download

• Tickets for HR events, including consultation sessions

• Access to webinars on relevant HR topics

In return for making use of these contents and services, you provide us with the data listed in Section 4.5.2 and grant us permission to contact you by telephone regarding a demo of the Jobspreader, as well as to inform you by email about new content available in our download offerings.

Otherwise, we are unfortunately unable to provide you with these services and you will not be able to use the offerings we make available. The download area, including the respective registration and download forms, constitutes our offer to you. You accept this offer when you enter your data, tick the required opt-in box referring to this agreement and the information on data processing, and then confirm your acceptance by clicking the link that you subsequently receive by email (so-called double opt-in).

Of course, you may withdraw the permission associated with your acceptance of this offer to use your personal data at any time.

4.5.2 Information on Data Processing for Download Offers

If you wish to make use of an offering from our download area, you must provide the following information:

• Last name

• First name

• Company name

• Telephone number

• Email address

As outlined in Section 4.5.1, we use this data to inform you about new Wollmilchsau content and to contact you regarding a Jobspreader demo. We enter your data into our prospective customer database. In this respect, we process your data on the basis of Art. 6(1)(b) GDPR for the performance of the contract. The prohibition of tying under Art. 4(7) GDPR is not affected here. Within the scope of private autonomy, Wollmilchsau GmbH may decide the conditions under which it provides its services, and you may decide under which conditions you wish to receive these services.

Each time you use an additional product from us, download further content, register for a webinar, or otherwise contact us—for example at a trade fair—we record this information in our database. The same applies if you call us, for example, to arrange a consultation. In this way, we understand your needs and can build a prospective customer or customer relationship with you. We process this additional data on the basis of Art. 6(1)(f) GDPR.

4.6 Data Processing in Connection with Social Media Profiles

Wollmilchsau maintains several social media profiles:

• https://www.facebook.com/wollmilchsau/

• https://www.instagram.com/wollmilchsau_gmbh/

• https://www.linkedin.com/company/wollmilchsau/

We use these platforms to share information and to communicate with you.

We have no influence over how the respective platform operator processes your personal data. As a rule, when you visit our social media pages, the platform operator stores cookies in your browser that record your usage behavior and interests for market research and advertising purposes. These usage profiles, often created across multiple devices, are used by the platform operators to display personalized advertising to you. Even individuals who are not registered users of the respective social media platform may be affected by this data processing. Your data may also be processed outside the European Union, which can make the enforcement of your rights more difficult.

The processing of your personal data when visiting our social media pages is based on our legitimate interest in presenting our company externally in a diverse manner and in using an effective communication channel with you. The legal basis for this processing is the consent you have given to the respective platform operator pursuant to Art. 6(1)(a) GDPR.

In some cases, we also receive so-called “Insights” from the platform operators—i.e., statistical data about visitors to our profile on the respective platform. According to the judgment of the CJEU, the operator of the social media page and we are joint controllers for this data processing within the meaning of Art. 26 GDPR.

Accordingly, we have concluded joint-controller agreements with the respective providers.

These agreements stipulate that the platform operator bears the primary responsibility for the processing of “Insights data” within the meaning of the GDPR.

Detailed information regarding data processing in connection with the use of our social media pages, about objection options (opt-outs), and about exercising access rights can be found in the privacy policies of the respective platform operators. From our side, we process only pseudonymized Insights data on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the usage statistics of our Facebook and Instagram pages in order to further develop and optimize their content. There is no overriding legitimate interest of the affected users, since (a) we cannot identify individual persons, (b) users generally have accepted Facebook’s or Instagram’s privacy terms, and (c) users who have not consented can prevent the setting of cookies required for Insights through appropriate browser settings.

The respective joint-controller agreements and privacy policies can be found at the following links:

Facebook/Instagram:
Meta Platforms Ireland Limited
Joint-controller agreement
Privacy policy

LinkedIn:
Provider: LinkedIn Ireland Unlimited Company, Ireland
Joint-controller agreement
Privacy policy

4.7 YouTube Videos

We also offer videos on our website that are hosted on youtube.com. For visits from the EU, Switzerland, Liechtenstein and Norway, youtube.com is operated by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland).

Additional YouTube content—such as the video player and the respective video—is only loaded when you click on the video preview image. This is done via the “enhanced privacy mode” offered by YouTube. YouTube is then informed that you have accessed and started the video, and it receives the technically required usage data. If you are logged into YouTube or Google, the retrieval of the video on our website will be associated with your Google account.

The embedding of videos is based on your consent in accordance with Art. 6(1)(a) GDPR. Please note that accessing YouTube videos may result in Google processing pseudonymous data about you outside the EU or EEA, in particular in the United States.

Information regarding data processing when loading and playing YouTube videos can be found here:
https://www.youtube.com/t/privacy

5. Data Processing in the Context of Recruitment Processes

5.1 Candidate Data from Active Recruitment Processes

For recruitment purposes, Wollmilchsau GmbH also engages in active sourcing, meaning that Wollmilchsau GmbH searches proactively in social networks, forums or other publicly accessible online sources for potential employees. In the context of these active recruitment processes, Wollmilchsau GmbH processes data that has been clearly made public by the individuals concerned, such as:

• Names

• Information regarding professional qualifications

• Email addresses

• Account names/links to social media profiles (profile URLs, Bluesky names, etc.)

• Telephone numbers

Such candidate data is processed by Wollmilchsau GmbH on the basis of Art. 6(1)(f) GDPR. If special categories of personal data are processed, the legal basis is Art. 6(1)(f) GDPR in conjunction with Art. 9(2)(e) GDPR. Wollmilchsau GmbH has a legitimate interest in processing personal data of potential employees who have themselves clearly made such data public, for recruitment purposes. There is no overriding legitimate interest of the candidates preventing such processing, as exclusively data that has been made publicly available by the data subjects and that belongs to the social sphere is processed.

In accordance with statutory requirements, such data will only be retained beyond the retention periods specified herein if consent has been obtained from the individuals concerned. Candidates whose data has been processed within the scope of an active sourcing procedure for the establishment of an initial talent pool but who are ultimately not contacted regarding the relevant position—and whose data will be deleted after six months pursuant to Section 7—will not be notified on the basis of the disproportionate effort that such notification would require, in accordance with Art. 14(5)(b) GDPR. Pursuant to Art. 14(5)(b) GDPR, the present notice serves to inform you of this data processing.

5.2 Candidate Data from Applications

If you apply to us for a position—either in response to a vacancy or on your own initiative—or if you grant us consent for further processing of your data following an active approach by us and subsequently provide us with additional relevant application documents, we generally process the following data in order to potentially establish an employment relationship:

• Contact details

• CV data, including

  • Evidence of professional qualifications

  • Certificates

  • References

• Documentation generated in the application process (such as notes, interview evaluations)

Wollmilchsau GmbH processes applicant data in accordance with Art. 88 GDPR in conjunction with § 26 BDSG.

6. Purpose Limitation, Data Recipients, Disclosure

We observe the principle of purpose limitation. All of the aforementioned data is processed solely for the purposes already described. In addition to the controllers of the website, the recipients of your data include—where not already listed—our IT development team, our hosting provider, the provider of our CRM system, and the provider of our office software solution. All such providers are bound to us via data processing agreements or, where necessary, EU standard contractual clauses. Upon request, we will gladly provide you with specific information regarding the recipients of your data. For IT security reasons, however, we do not name them here.

Your personal data will not be transferred to third parties outside the scope described here without your explicit consent. Disclosure to government institutions or authorities entitled to receive information will take place only within the scope of statutory disclosure obligations or where we are required to do so by a court order.

7. Duration of Processing, Deletion of Data

7.1 Website Use

Your IP address is stored in the web server log files only for the purpose of establishing the connection and is then immediately anonymized. Data and cookies in connection with Google Analytics are automatically deleted after 14 months.

7.2 E-Mail Contact

The data you send to us by email will be deleted immediately after your inquiry has been resolved, unless it constitutes prospect data within the meaning of Section 7.3.

7.3 Prospect Data

Prospect data will be deleted two years after the last point of contact, unless statutory retention obligations pursuant to § 257 HGB must be observed. In such cases, the use of the data will be restricted to the fulfillment of the retention obligation in accordance with Art. 18 GDPR, and the data will be deleted after expiry of the retention periods referred to above.

A point of contact includes, for example, downloading a whitepaper, interacting with an employee at a trade fair or by telephone, or participating in a webinar. The long retention period is due to the long planning and budgeting cycles typical in the HR marketing industry.

If deletion of individual data or data sets would only be possible with disproportionate effort in terms of extraction and separation with regard to differing deletion periods, such data will instead be uniformly restricted after the matter is completed and deleted six years after the last point of contact. The period begins at the end of the calendar year in which the respective data was collected.

7.4 Newsletter

We require your data in order to send you the newsletter. For this reason, we process this data for as long as you remain subscribed to the newsletter. If you unsubscribe, we will promptly delete your data from our mailing lists. The documentation of your consent is excluded from this deletion; we retain it for an additional three years in order to be able to demonstrate your original consent in the event of a dispute.

7.5 Deletion periods within recruitment processes

7.5.1 Deletion periods for candidate data from active recruitment processes

Candidate data obtained through sourcing processes will be deleted six months after the start of the sourcing process, provided that no contact has been made and no consent for further processing has been obtained from the individual concerned.

7.5.2 Applications

Applicant data will be deleted eight months after the start date of the candidate we have hired. The reason for this period is that the probationary period generally lasts six months. Should the hired candidate decide against Wollmilchsau GmbH within this period, or should Wollmilchsau GmbH terminate the employment relationship during the probationary period, we must retain the possibility of reverting to other candidates. For any longer retention of application documents, consent will be obtained on a case-by-case basis.

8. Data Subject Rights

Regardless of the provisions above, you have the following rights:

You have the right to request information regarding the data we process about you. (Although you already know everything we know about you, we are of course happy to confirm it formally.) You may object to the processing of your data at any time, provided the requirements of Art. 21 GDPR are met, and you may withdraw any consent you have previously given at any time. If consent to data processing is withdrawn, or an objection is raised, this does not affect the lawfulness of processing carried out prior to the withdrawal or objection.

You may also request the rectification, restriction or deletion of the data we process about you at any time. We expressly point out that statutory obligations—such as retention periods—may require us to continue storing certain data. In such cases, the data can only be restricted. This means that the data will then be processed solely for the purpose of fulfilling statutory obligations and will not be used otherwise.

You additionally have the right to data portability according to Art. 20 GDPR, as well as the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR.

If you have any questions, please contact us at any time at [email protected] or directly contact our data protection officer.

9. Data Protection Officer

ANMATHO AG
Winterhuder Weg 82
22085 Hamburg

Phone: +49 (0)40 229 47 19-0
E-Mail: [email protected]