Data protection information
We, EB – Sustainable Investment Management GmbH, welcome you to our website. We appreciate your visit and your interest in our company. The purpose of this notice is to inform you about the processing of your personal or personal-related data (hereinafter referred to as “data”). This includes your e-mail or IP address.
1. Person responsible for data processing
The controller within the meaning of Art. 4 No. 7 GDPR is EB – Sustainable Investment Management GmbH – more information can be found in the legal notice.
You can reach our data protection officer as follows:
TeamPrivacy@creditreform-compliance.de
2. Informational use
For the informational use of our websites, we only collect the data that your browser automatically transmits to us, such as:
- IP address (network address)
Address of the website from which you came - Address of the retrieved files (retrieval address = URL)
- Date and time of a retrieval
- as well as the operating system and browser version of your end device (user agent)
The data is stored in (technical) protocols (logs).
2.1 Storage period
The storage period for this data (logs) is 7 days.
2.2 Legal basis(s) for data processing
The above-mentioned data is technically necessary to provide you with our websites and to ensure stability and security, in accordance with Art. 6 para. 1 lit. f) GDPR.
3. Cookies
We use cookies and similar technologies to enable certain functions within our websites. A cookie is a small package of information and consists of a pair of data, a key and a value. A cookie is managed by the browser on the user’s end device and thus stored there. We may use cookies if they are absolutely necessary for the operation of our websites. We require your permission for all other cookie types. Some cookies are used by third-party providers that we have integrated into our websites.
An overview of all cookies used, including storage duration and the corresponding legal basis, can be found in our Consent Manager (cookie banner). You can also use this to manage your consent at any time. The Consent Manager is automatically displayed on your first visit.
Session cookies:
Our websites receive some session cookies that are used to display our content.
These cookies are deleted after you close your browser or tab. The legal basis for the cookies and data processing is § 25 para. 2 no. 2 TDDDG and Art. 6 para. 1 lit. f) GDPR.
Cookie | Purpose and legal basis | Storage duration |
cookieConsent | – Consent Manager (cookie settings) – remembering your cookie selection – balancing of interests in accordance with § 25 para. 2 no. 2 TDDDG, Art. 6 para. 1 lit. f) GDPR | 12 months |
_pk_id. | – Matomo web analysis – recognition of your visit and statistical analysis – consent pursuant to § 25 para. 1 TDDDG, Art. 6 para. 1 lit. a) GDPR | 12 months |
YouTube (several cookies) | – YouTube – use by YouTube itself – cookies are only set if you click on a YouTube video – balancing of interests in accordance with § 25 para. 2 no. 2 TDDDG, Art. 6 para. 1 lit. f) GDPR | Control through YouTube |
Here you can check your current consent or settings in the Consent Manager and adjust them if necessary: Cookie settings
4. contact
When you contact us by e-mail or using the contact form, the data you provide, e.g. your e-mail address, your name, your telephone number and the content of the message, will be processed to clarify your request.
4.1 Storage period
We delete the data arising in this context after storage is no longer required for these purposes, or restrict processing if there are statutory retention obligations (archiving obligations for business and commercial letters).
4.2 Legal basis(s) for data processing
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, pursuant to Art. 6 (1) (b) GDPR.
Alternatively, the processing is carried out in our and your interest in processing your request, pursuant to Art. 6 para. 1 lit. f) GDPR.
5. Newsletter
In the following section, we inform you about the delivery of our newsletter. Further information on the newsletter service provider used can be found in the overview of integrated service providers below in our data protection information.
5.1 Newsletter for existing customers
In order to inform our existing customers about current developments regarding comparable products and services, we process your e-mail address as well as your first and last name for the delivery of our newsletter for existing customers, which usually differs in content from the general newsletter subscription.
Performance measurement:
We would like to point out that we can track the opening of the newsletter using so-called web beacons or tracking pixels (image files). To measure success, we link the web beacons or tracking pixels with your e-mail address (possibly also with your first name and surname) and an individual ID. Such tracking is not possible if you have deactivated the display of images in your e-mail program by default and do not open links placed in the newsletter.
Objection:
You can unsubscribe from the newsletter at any time by clicking on the corresponding link at the end of the newsletter.
5.2 Storage period
Your data will be stored for as long as you have subscribed to the newsletter. After you unsubscribe, we only store information for measuring success in an anonymous form.
5.3 Legal basis(s) for data processing
The processing of your data in the context of the delivery of our newsletter is in our and your interest to be regularly informed about current developments, in accordance with Art. 6 para. 1 lit. f) GDPR and § 7 para. 3 UWG as well as § 25 para. 2 no. 2 TDDDG for the measurement of success through the use of web beacons or tracking pixels (image files)
6. Matomo (web analysis)
With your consent, we collect data on your individual user behavior in order to understand how many visitors visit our websites, which content plays a significant role and how we can make our websites more attractive.
Your person is recognized by a pseudonym (sequence of numbers), which is stored in cookies as so-called user identification numbers (user ID or client ID).
Among other things, the following data is processed:
- Your (shortened) IP address, your (approximate) location
- Information about your browser, operating system and end device (desktop, tablet, smartphone, etc.)
- Information on websites visited, the time spent on individual websites, links opened
Withdrawal of your consent:
You can withdraw your consent at any time by deactivating the statistics cookies in the Consent Manager(cookie settings) or generally only agreeing to the use of strictly necessary cookies.
6.1.1 Storage period
The data will be deleted after 12 months.
6.1.2 Legal basis(s) for data processing
The processing of your data in this context is based on your consent (consent cookies in the Consent Manager), in accordance with § 25 para. 1 TDDDG and Art. 6 para. 1 lit. a) GDPR.
7. Careers/applications
We process the data that you have sent us in connection with your application in order to check your suitability for the position (or any other open positions) and to carry out the application process. As a rule, this is the following data:
- Personal master data (e.g. name, address, date of birth)
- Communication data (e.g. telephone, e-mail)
- Curriculum vitae (e.g. professional career, sideline activities, leisure activities)
- Results of selection procedures (e.g. tests, interviews)
- Organization (e.g. status, dates)
Access to your data is only granted to (authorized) persons who need it to carry out the application process (e.g. HR department and the respective managers of the responsible department).
You will receive further data protection information within the job description or the application for a specific position.
7.1 Storage period
Applicants’ data will be deleted after 6 months in the event of rejection.
In the event that you have consented to further storage of your personal data, we will include your data in our applicant pool. There the data will be deleted after 2 years.
If you are accepted for a position as part of the application process, your data will be transferred to our personnel information system.
7.2 Legal basis(s) for data processing
The processing of your data as part of the application process is permitted for the decision on the establishment of an employment relationship, pursuant to Art. 6 para. 1 lit. b) GDPR and § 26 BDSG.
Should the data be required for legal prosecution after completion of the application process, data processing may be carried out to safeguard legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR. Our interest then lies in the assertion of or defense against claims.
If, in individual cases, you have consented to your application documents being stored for a longer period (e.g. because we are currently unable to offer you a position), further processing will be based on your consent in accordance with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time.
8. YouTube
We embed videos that are stored on YouTube (Google) and can be played directly from our websites.
If you are also logged in to YouTube or Google with an existing user account at the same time as visiting our websites, Google can also assign the visit to our websites to your user behavior. If you do not wish to be associated with your YouTube profile, you must log out before activating the video.
Further information can be found in the overview of integrated service providers below in our data protection information.
8.1.1 Storage period:
See storage duration of the logs under Informational use above in this privacy policy. We do not collect any other data in connection with YouTube.
8.1.2 Legal basis(s) for data processing:
The connection to YouTube is carried out in our mutual interest in accordance with § 25 para. 2 no. 2 TDDDG and Art. 6 para. 1 lit. a) GDPR.
For the exceptional cases in which personal data (at least your IP address) is transferred to the USA, YouTube (Google) relies on the European Standard Contractual Clauses:
https://policies.google.com/privacy/frameworks?hl=de
9. Integrated service providers
Below you will find an overview of all service providers who are involved in the provision and further development of our websites and in enabling special functions.
Service provider | Purpose and legal basis | Notes |
Atruvia AG Fiduciastrasse 20 76227 Karlsruhe | – Hosting of IT systems and websites – order processing in accordance with Art. 28 GDPR | Provision and administration of the IT infrastructure. |
CleverReach GmbH & Co KG Schafjückenweg 2 26180 Rastede Germany | – Newsletter system – order processing pursuant to Art. 28 GDPR – delivery of the newsletter based on your consent pursuant to Art. 6 para. 1 lit. a) GDPR (web beacons via § 25 para. 1 TDDDG) and, if applicable, in the context of a balancing of interests pursuant to Art. 6 para. 1 lit. f) GDPR (web beacons via Section 25 (2) No. 2 TDDDG) | Provision and administration of the IT infrastructure, delivery of our newsletter. |
PERBILITY GmbH Starkenfeldstraße 21 96050 Bamberg | – Applicant management system (BMS) – Order processing in accordance with Art. 28 GDPR – Cookies via § 25 Para. 2 No. 2 TDDDG | Provision and administration of the IT infrastructure. |
Adobe Systems Software Ireland Limited 4-6 Riverwalk Citywest Business Campus Dublin 24 Republic of Ireland | – Integration of fonts to display the text (Typekit Fonts) Balancing of interests pursuant to Art. 6 para. 1 lit. f) GDPR | Your IP address is passed on to Adobe, which is technically necessary for establishing a connection. |
Google Ireland Limited (YouTube) Gordon House, Barrow Street, Dublin 4 Republic of Ireland | – Integration of videos from our YouTube channel – balancing of interests pursuant to Art. 6 para. 1 lit. f) GDPR – cookies from YouTube via § 25 para. 2 no. 2 TDDDG | Initially, only your IP address is transmitted to YouTube when you visit one of our websites with an embedded video. If you click on the video, further data will be processed, see YouTube in these notes. |
10. social media platforms (outside our websites)
In this section, we inform you about the processing of your data in connection with your visit to a social media site operated by us within an external social media platform.
10.1 YouTube (Google)
We use YouTube and are responsible for the operation of our YouTube channel. The YouTube channel primarily serves as a communication platform for customers and interested parties.
We offer you the opportunity to comment on our contributions. Your contributions can be accessed by anyone worldwide on the Internet.
We also receive “analytics” statistics information from YouTube about the popularity of our YouTube channel (e.g. number of page views, number of “likes”). YouTube (Google) is responsible for how this data is collected and processed.
Information on “analytics” from the perspective of the operator of a YouTube channel can be found here, for example: https://support.google.com/youtube/answer/9002587?hl=de&co=GENIE.Platform%3DDesktop
10.1.1 Data controller responsible for data processing
We are responsible for data processing on our YouTube channel. YouTube or Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland is responsible for data processing within the European Union (EU) and the European Economic Area (EEA) and Switzerland in connection with the operation of YouTube.
Further information on data protection at YouTube can be found here:
https://www.youtube.com/intl/ALL_de/howyoutubeworks/user-settings/privacy
You can contact YouTube’s data protection officer here:
https://support.google.com/policies/contact/general_privacy_form
Familiarize yourself with the data protection settings on YouTube (Google) and only activate the cookies or data processing that you personally consider appropriate. YouTube (Google) stores your data in user profiles and uses them to display personalized advertising, among other things.
10.1.2 Storage period
In principle, there is no fixed storage period for the publication of your contributions, so that we delete your data after the storage is no longer necessary (the data that we can actually delete ourselves), or restrict the processing if there are legal storage obligations.
You can also delete your contributions from our YouTube channel yourself at any time.
10.1.3 Legal basis(s) for data processing
We operate our YouTube channel in our own interest in order to communicate with customers, interested parties and users and to inform them about our offers, goods and events, in accordance with Art. 6 para. 1 lit. f) GDPR.
We process the statistical information “Analytics” provided by YouTube in our own interest to optimize our YouTube channel, pursuant to Art. 6 para. 1 lit. f) GDPR.
10.2 LinkedIn
We use LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland) and are jointly responsible with LinkedIn for the operation of our LinkedIn page. The page primarily serves as a communication platform for customers and interested parties.
We offer you the opportunity to comment on our posts, share them, give them a “like” or get in touch with us via the message function. In principle, your comments can be accessed by anyone worldwide on the Internet. However, only LinkedIn itself can access the content of the message function, e.g. as part of IT administration.
10.2.1 Data controller responsible for data processing
We are responsible for the data processing on our LinkedIn profile. LinkedIn is
responsible for data processing in the context of the operation of LinkedIn. Details on how they handle your personal data can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.
A possible transfer to the USA takes place. This is done on the basis of the
standard contractual clauses. Further details can be found here: https://www.linkedin.com/legal/l/dpa and
https://www.linkedin.com/legal/l/eu-sccs.
10.2.2 Storage period
In principle, there is no fixed storage period for the publication of your contributions, so that we delete your data after storage is no longer necessary (the data that we can actually delete ourselves), or restrict processing if there are statutory retention obligations.
You can also delete your posts from our LinkedIn profile yourself at any time.
10.2.3 Legal basis(s) for data processing
We operate our LinkedIn profile in our own interest in order to communicate with customers, interested parties and users and to inform them about our offers, goods and events, in accordance with Art. 6 para. 1 lit. f) GDPR.
11. your rights
You have the following rights vis-à-vis us with regard to the data concerning you:
- Right to information,
- Right to rectification or erasure,
- Right to restriction of processing and
- Right to data portability.
11.1 Right to lodge a complaint with a supervisory authority
You also have the right to complain to a data protection supervisory authority about the processing of your data by us. The supervisory authority directly responsible for us is
11.2 Right to object to direct marketing and processing in our legitimate interest
Insofar as we process your data exceptionally on the basis of Art. 6 para. 1 lit. f) GDPR (legitimate interests), you have the right to object, on grounds relating to your particular situation, at any time to processing of data concerning you by us. If we cannot demonstrate compelling legitimate grounds for further processing which override your interests, rights and freedoms, or if we process your data for the purpose of direct marketing, we will no longer process your data (see Art. 21 GDPR). If we enable you to exercise your objection by technical means, we will inform you about this in the individual data processing operations above in our data protection information.
11.3 Right of revocation if consent has been granted
You have the right to withdraw your consent to the collection and use of your data at any time with effect for the future. This does not affect the lawfulness of the processing carried out on the basis of the consent until revocation. You can revoke or individually configure your cookie consent in our Consent Manager (cookie banner)
11.4 Contact options regarding your rights
You can contact us at any time to exercise your rights. The best way to do this is to use the following e-mail address: info@eb-sim.de.
You are also welcome to use one of the contact options in our legal notice or contact our data protection officer directly (contact details above).