Privacy Policy of the Otto Group Solution Provider (OSP) GmbH

Content

1. Controller's name and contact details

2. Data protection officer's contact details

3. Purposes of data processing, legal bases and legitimate interests

    3.1 Accessing our websites

        3.1.1 Log files

        3.1.2 Cookies, tracking, social media plugins

    3.2 Data processing for advertising purposes

        3.2.1 Newsletter

        3.2.2 Sweepstakes

4. Website and website optimisation (using cookies) including consent

    4.1 Cookies – general information and consent

    4.2 Intervention options / browser settings

    4.3 OneTrust consent management

    4.4 Consent to the use of individual online services / the collection of tracking data

        4.4.1 Consent for performance cookies

            4.4.1.1 Google Conversion Tracking

        4.4.2 Consent for targeting cookies 

            4.4.2.1 Consent for Google Remarketing

            4.4.2.2 Consent to Google DV360

            4.4.2.3 Consent for Facebook Retargeting (Website Custom Audience)

            4.4.2.3 Consent for LinkedIn Ads / Retargeting

        4.4.3 Consent for social media plugins

            4.4.3.1 YouTube   
  
        4.4.4 Revocation of all consents

        4.4.5 Further processing of tracking data for legitimate interests

            4.4.5.1 Legitimate interests of OSP / balancing of interests

            4.4.5.2 Google Analytics (Basic version)

5. Contact

6. Data protection information for applicants

    6.1 Data processing for the application procedure

    6.2 Duration of storage

    6.3 Recipients of applicant data

7. Recipients outside the EU

8. Your rights

    8.1 Overview

    8.2 Right to object

    8.3 Right of revocation

1. Controller’s name and contact details

This Privacy Policy applies to data processing by

Otto Group Solution Provider (OSP) GmbH
Freiberger Straße 35
01067 Dresden
Deutschland

Represented by the directors Dr. Stefan Borsutzky and Norbert Gödicke

Tel.: +49 (0)351 4923 0
Email: info(at)osp.de
Website: www.osp.de

for the following website: www.osp.de

2. Data protection officer's contact details

The controller’s operational data protection officer can be reached at

Otto Group
Werner-Otto-Str. 1-7
22179 Hamburg
Deutschland

Email: datenschutzbeauftragter(at)ottogroup.com

3. Purposes of data processing, legal bases and legitimate interests pursued by the controller or a third party as well as categories of recipients

3.1 Accessing our websites

3.1.1 Log files

Every time you access www.osp.de, information is sent to the server of our website by the internet browser of your respective device and temporarily stored in log files. The records stored contain the following data, which are stored until automatic deletion: Date and time of retrieval, name of the page requested, IP address of the requesting device, referrer URL (origin URL from which you came to our web pages), the amount of data transferred, load time as well as product and version information of the respectively used browser and the name of your access provider.

The legal basis for processing the IP address is Art. 6 (1) lit f) GDPR. Our legitimate interest lies in

• guaranteeing a trouble-free connection
• guaranteeing comfortable use of our website,
• evaluation of system security and stability.

It is not possible to directly infer your identity on the basis of the information, nor do we endeavour to do so.

The data is stored and automatically deleted after the accomplishing the aforementioned purposes. The standard deletion periods are determined according to necessity.

3.1.2 Cookies, tracking, social media plugins

We use cookies, tracking tools, targeting procedures and social media plugins for our website. The exact procedures and how your data is used for this purpose is explained in detail below.

3.2 Data processing for advertising purposes

3.2.1 Newsletter

On our website, we give you the option to subscribe to our newsletter. To ensure that no errors have occurred when entering an email address, we use the double-opt-in procedure (DOI procedure): After you have entered your email address in the registration field, we will send you a confirmation link to the address provided. Your email address will be only entered in our newsletter mailing list after you click on this confirmation link. The legal basis for this data processing is Art. 6 (1) lit. a) GDPR.

Information on the right of revocation
You can revoke your consent at any time with effect for the future by sending a mail to info(at)osp.de or by using the unsubscribe option at the end of each newsletter.

3.2.2 Sweepstakes

If you register for a lottery organised by us, we will use the data you provide at the time of registration for the purpose of concluding the participation contract, in particular to notify you of your winnings and, if applicable, to advertise our offers and services. Detailed information can be found in the conditions of participation for the respective lottery. The legal basis for this data processing is Art. 6 (1) lit. a) GDPR, Art. 6 (1) lit. b) GDPR and Art. 6 (1) lit. f) GDPR.

4. Website and website optimization (using cookies) including consent

Brief summary

As the operator of the website osp.de, OSP collects data on the behaviour of users on the aforementioned website (tracking data). This includes, among other things, which individual sub-pages were visited. For this purpose, OSP and/or partners of OSP may set cookies in the browser used by the respective user. The collection of tracking data is generally only permitted if you have previously consented to this (§ 25 para. 1 sentence 1 TTDSG). You can grant such consent by clicking the "OK" button in the "cookie banner" displayed at osp.de. However, consent is not required for the processing of such tracking data, which is necessary for using the osp.de website (§ 25 para. 2 no. 2 TTDSG). OSP may use the information about your usage behaviour, among other things, to display offers at osp.de that may be of interest to you, or to advertise on other websites using personalised content (e.g. retargeting). Insofar as personal data about your usage behaviour at osp.de can also be used by other providers, e.g. for the purpose of "enriching their own information", such use will only occur in these cases if you have given your prior consent. In these cases, further processing of the data collected on osp.de normally occurs on the sole responsibility of the providers. The providers can transmit the data to the USA as part of this further processing. With regard to the USA, the European Court of Justice has ruled that it is a country with an insufficient level of data protection. In this context, there is a particular risk that your data will be processed by US institutions/authorities for control and surveillance purposes without you having an adequate legal remedy against this. Tracking data that OSP collects and stores itself are only processed by OSP in pseudonymised form. This prevents the data being linked to your person. If you wish to delete individual cookies set in your browser or find out which service providers / providers have set cookies in your browser, you can do so using a "preference manager". Such a preference manager is available, for example, at www.youronlinechoices.com. You also have the option of setting your browser in such a way that it prevents cookies from being set or only allows certain types of cookies to be set. Detailed information on how to change the settings in the most common browser types (including Google-Chrome, Firefox) can be found in section 4.2. of this Privacy Policy.

4.1 Cookies – general Information and consent

This website uses cookies. Cookies are small text files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.). Information arising in connection with the specific device used is stored in the cookie. However, this does not mean that we immediately become aware of your identity.

Some of the cookies we use are deleted after the end of the browser session (session cookies). Other cookies remain on your computer and allow us to recognise your computer the next time you visit (persistent or multi-session cookies). Among other things, these cookies serve, in particular, to make our offer more attractive.

According to legal requirements, the storage of information on end devices (desktops, cell phones, tablets or similar) - e.g. by setting cookies - and the retrieval of information from end devices (tracking) is only permitted if you have given your prior consent. The legal basis for this is section 25, paragraph 1, sentence 1 TTDSG. However, consent does not have to be granted if such storage / retrieval is necessary for the services offered on the website (e.g. technically necessary cookies). The legal basis for this is Section 25 (2) No. 2 TTDSG. Storage / Retrieval is considered necessary, for example, for ensuring the following functionalities / achieving the following purposes:
- Ensuring system security.

You have no right of objection with regard to the data processing necessary for the operation of the website. Therefore, the option "strictly necessary cookies" is always activated and cannot be deselected in the consent preferences in the content tool.

You can use the osp.de website without data being retrieved from or stored on your terminal device for purposes that are not necessary for the services offered on the osp.de website. For this reason, only basic tracking is activated when you use the osp.de website, unless you have given your further consent.

4.2. Intervention options / browser settings

Of course you can set your browser so that it does not store certain cookies on your terminal device. The Help menu on the menu bar of most web browsers tells you how to prevent your browser from accepting new cookies, how to make your browser inform you when you receive a new cookie, or how to delete all cookies you have already received and how you can block all others.

Please proceed as follows: 

In Internet Explorer

1. In the “Tools” menu, select “Internet Options”.
2. Click on the “Privacy” tab.
3. Now you can configure the security settings for the internet zone. Here you can set whether and which cookies should be accepted or rejected.
4. Confirm your settings by clicking “OK”.

In Firefox:

1. Click on the triple bar icon in the top right of the browser and select Preferences.
2. Click on “Privacy and Security”
3. In the drop-down menu, select “Use custom settings for history”.
4. Now you can set whether to accept cookies, how long you want to keep these cookies and add exceptions to which sites you always or never want to allow the use of cookies.
5. Confirm your settings by clicking “OK”.

In Google Chrome:

1. Click on the Chrome menu icon in the toolbar.
2. Then select “Settings”
3. Under “Privacy and security,” click "Content settings".
4. Under “Cookies”, you can make the following settings for cookies
   • Delete cookies (See all cookies and site data -> Remove)
   • Block cookies by default
   • Delete cookies and webpage data by default after quitting the browser,
   • Allow exceptions to cookies from certain websites or domains

In Safari:


1. Click on "Safari" in the menu bar.
2. Now select "Preferences".

3. Click on "Privacy".
4. Here you can set the following preferences for cookies:
   • Delete Cookies
   • Block cookies and website data by default
   • Change which cookies and website data are allowed
      

If you wish to delete individual cookies set in your browser or find out which service providers / providers have set cookies in your browser, you can do so using a "preference manager". Such a preference manager is available, for example, at www.youronlinechoices.com.

4.3 OneTrust consent management

To manage your settings and document the consent of users of our services, we use a consent tool ("OneTrust") provided by OneTrust, LLC (UK headquarters: Cannon Green, 27 Bush Lane, London EC4R 0AA, UK and US headquarters: 1350 Spring Street NW, Suite 500, Atlanta, Georgia 30309, USA). OneTrust is used, among other things, to store the cookie settings for the entire website. OneTrust stores information about the categories of cookies used by the website and whether users have given or revoked their consent to use each category. This allows us to prevent cookies from being set in each category in the user's browser if consent is not given for individual categories. OneTrust uses cookies with a normal duration of one year for information storage, so that the settings of regular visitors are stored.

4.4 Consent to the use of individual online services / the collection of tracking data

As already stated in section 4.1 of this privacy policy, OSP collects and processes tracking data, in some cases on the basis of consent. You grant this consent by clicking on the "OK" button in a banner on the website osp.de that links to these consent texts. By clicking on the "OK" button, you consent to OSP storing data on your terminal device (e.g. by setting cookies) or retrieving data from your terminal device. Furthermore, by clicking on the "OK" button, you give your consent to the use of certain advertising functions, the use of which in itself requires consent. You also have the option of clicking on "Settings" in the banner and managing your consent preferences there. A distinction is made there between "performance cookies", "targeting cookies" and “social media cookies”. Data processing that takes place in connection with these advertising functions is described below (section 4.4.1 to section 4.4.3 of this Privacy Policy).

All data processing that is recorded on the basis of the consent given by you by clicking the "OK" button serves the same purpose, namely that of "advertising".

4.4.1 Consent for performance cookies

4.4.1.1 Google Conversion Tracking

On this website we use conversion tracking when using the Google Ads service. A conversion tracking cookie will be installed on your computer/device when you click on an ad placed by Google. These cookies expire after 30 days, do not contain any personal data and thus cannot be used for personal identification purposes. The information gathered using the conversion cookie is used to generate conversion statistics for Ads customers who have opted for conversion tracking.

The legal basis for this data processing is Art. 6 (1) lit. f) GDPR.

You can prevent cookies from being saved by configuring your browser software accordingly; however, we would like to point out that in this case you may not be able to use the full functionality of this website. In addition, you can deactivate interest-based ads on Google and interest-based Google ads on the web (within the Google display network) in your browser by activating the "Off" button at https://www.google.de/settings/ads or by deactivating them at https://optout.aboutads.info/. For more information about your options in this regard and Google's privacy policy, please visit: https://policies.google.com/privacy?hl=en

4.4.2 Consent for targeting cookies

4.4.2.1 Consent for Google Remarketing

This website uses Google's Remarketing service. Google Remarketing is an online advertising program provided by Google Ireland Limited ("Google"). In this regard, we use the remarketing feature provided as part of the Google Ads service. The remarketing feature allows us to present ads based on your interests on other sites within the Google advertising network. In order to do this, we analyse your browsing behaviour on our website, e.g. which services you have viewed. This enables us to show you customised advertising on the online search engine Google itself, so-called "Google Ads", and on other websites even after your visit to our website. For this purpose, Google stores a cookie on your browser whenever you visit Google services or websites in the Google advertising network. This cookie is used to record your visits. The cookie is used to uniquely identify your web browser, not to identify you personally. It is possible that Google may use the data collected via the website osp.de about your usage behaviour for its own purposes or for the purposes of other Google customers (e.g. to display customised third-party ads). Any such further processing of the data as well as the processing of the data after its transmission by OSP to Google is carried out by Google as the sole data controller under data protection law. In this context, Google as the sole party responsible in terms of data protection law can store data regarding you in the USA. With regard to the USA, the European Court of Justice has ruled that it is a country with an insufficient level of data protection. In this context, there is a particular risk that your data will be processed by US institutions/authorities for control and surveillance purposes without you having an adequate legal remedy against this. The legal basis for this data processing is Art. 6 (1) lit. a) GDPR (consent).


For more information about Google Remarketing and Google's privacy policy, please visit: www.google.com/privacy/ads/. Here you can also assert your rights as a data subject (e.g. right to deletion) with regard to the data that Google processes as the data controller under data protection law. You can revoke your consent granted for the use of Google Remarketing here or refuse to consent to the use of Google Remarketing.

4.4.2.2 Consent to Google DV360

This website uses the online marketing tool Google Marketing Platform - Display & Video 360 (hereinafter referred to as "DV360"), an online marketing tool of Google Ireland Limited, Gordon House, Barrow St, Dublin 4, Ireland ("Google"). Among other things, DV360 uses cookies, small text files that are saved on your end device. Google uses a cookie ID to record which adverts were viewed in which web browser. In addition, with the help of the cookie IDs DV360 can record so-called conversions, which are related to advert queries. For example, this is the case if you view a DV360 advert on a website and later retrieve the website of the advertiser with the same browser and despatch an online application there. As a result of the use of DV360, your browser automatically establishes a connection with the server of Google and transmits the information that a corresponding part of our website was retrieved in your web browser or an advert of ours was clicked. The information generated by the cookies is transferred by Google for analysis to a server in the USA and stored there. Moreover, if you have a user account at Google and are registered, Google can assign the visit to your user account. Even if you are not registered at Google or are not logged in, it is possible for the provider to discover your IP address and store it. We use DV360 for marketing and optimisation purposes, especially in order to place adverts that are relevant and interesting to you, improve reports on the campaign performance or prevent you seeing the same adverts several times. The legal basis for this data processing is Art. 6 (1) lit. a) GDPR (consent).

You can find more detailed information about the data protection provisions of Google here: www.google.de/policies/privacy.

If you do not wish tracking data to be collected for the purpose mentioned, you can prevent this use by deselecting the category "Targeting Cookies" in the cookie settings:

4.4.2.3 Consent for Facebook Retargeting (Website Custom Audience)

A pixel of Meta Platforms Ireland Limited is integrated in this website (Website Custom Audience pixel). This pixel collects information about the use of this website (e.g. information about pages acessed) by Otto Group Solution Provider (OSP) GmbH and Meta Platforms Ireland Limited under joint responsibility and transmits it to Meta Platforms Ireland Limited. This information can be attributed to you with the aid of other information that Meta Platforms Ireland Limited has stored about you, for example because you have an account on the social network Facebook. The information collected by the pixel can be used to display interest-related ads about our offers in your Facebook account (retargeting). The information collected by the pixel can also be aggregated by Meta Platforms Ireland Limited and the aggregated information can be used by Meta Platforms Ireland Limited for its own and for third-party advertising purposes. Thus, for example, Meta Platforms Ireland Limited may infer certain interests from your browsing behaviour on this website and may also use this information to promote third-party offers. Meta Platforms Ireland Limited may also combine the information collected by the pixel with other information that Meta Platforms Ireland Limited has collected about you via other websites and/or in connection with the use of the social network Facebook, so that a profile about you may be stored at Meta Platforms Ireland Limited. This profile may be used for advertising purposes. Meta Platforms Ireland Limited is solely responsible for the permanent storage and displayed further processing of tracking data collected via the website custom audience pixel used on this website. In this context, Meta Platforms Ireland Limited as the sole party responsible in terms of data protection law can store data regarding you in the USA. With regard to the USA, the European Court of Justice has ruled that it is a country with an insufficient level of data protection. In this context, there is a particular risk that your data will be processed by US institutions/authorities for control and surveillance purposes without you having an adequate legal remedy against this. The legal basis for this data processing is Art. 6 (1) lit. a) GDPR (consent).


For more information on data protection at Meta Platforms Ireland Limited, please click here: https://www.facebook.com/policy.php. Here you will also find the possibility of asserting your rights (e.g. right to deletion) against Meta Platforms Ireland Limited.

You can withdraw your consent to the transfer to Meta Platforms Ireland Limited by using the pixel on this website here or refuse to consent to the use of Facebook Retargeting.

4.4.2.4 Consent to LinkedIn Ads / Retargeting

We use the retargeting service and conversion tracking of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn").

For this purpose, our website includes the LinkedIn Insight Tag, which enables LinkedIn to collect statistical, pseudonymous information about your visit and use of our website and to provide us with aggregated statistics based on this information. As a rule, the following information is collected:

• LinkedIn User ID (Cookie ID)
• IP Address
• Metadata of website visit, e.g. browser type, website visited

In addition, this information is used to provide you with offers and recommendations that are specific to your interests and relevant after you have informed yourself about certain services, information and offers on the website. This information is stored in a cookie. Insofar as LinkedIn Ireland Unlimited Company processes your data as the sole party responsible in terms of data protection law, your data may be transmitted by LinkedIn Ireland Unlimited Company to the USA. With regard to the USA, the European Court of Justice has ruled that it is a country with an insufficient level of data protection. In this context, there is a particular risk that your data will be processed by US institutions/authorities for control and surveillance purposes without you having an adequate legal remedy against this. The legal basis for this data processing is Art. 6 (1) lit. a) GDPR (consent).

You can find more information about LinkedIn's privacy practices in the LinkedIn Privacy Policy here: https://www.linkedin.com/legal/privacy-policy

You may opt out of LinkedIn's analysis of your usage patterns and the display of interest-based recommendations here or refuse to consent to the use of LinkedIn Retargeting.

4.4.3 Social media plugins

On our website, we use Social Plug-ins of the social network YouTube on the basis of Art. 6 (1) lit. f) GDPR in order to make our company better known about this. The advertising purpose behind this is to be regarded as a legitimate interest within the meaning of the GDPR. The responsibility for the data protection-compliant operation is to be guaranteed by their provider.

The purpose and scope of the data collection and the further processing and use of the data by the provider as well as your related rights and setting options for the protection of your privacy can be found in the data protection information of the provider, which is linked below.

By previously logging out from the pages of social networks and deleting cookies, you can prevent social networks from assigning the information collected about you to your user account at the respective social network during your visit to osp.de. If you do not want social networks to associate the information collected through our website directly with your profile, you must log out of those social networks before visiting our website. You can also completely prevent the loading of plugins with add-ons for your browser, e.g. with the script blocker "NoScript", which can be found at: https://noscript.net/.

4.4.3.1 YouTube

This website uses the provider YouTube, represented by Google Ireland Limited, Gordon House, Barrow St, Dublin 4, Irland ("Google") for the integration of videos.

Normally, when you visit a page with embedded videos, your IP address is sent to YouTube and cookies are installed on your computer. However, we have integrated our YouTube videos with the enhanced data protection mode (in this case, YouTube still contacts Google's Double Click service, but according to Google's privacy policy, personal data is not evaluated). As a result, YouTube no longer stores information about visitors unless they watch the video. If you click on the video, your IP address will be transmitted to YouTube and YouTube will know that you viewed the video. If you are logged in to YouTube, this information is also associated with your user account (you can prevent this by logging out of YouTube before viewing the video). Otto Group Solution Provider (OSP) GmbH has no influence on the content of the plug-ins and the transmission of information.

Google provides detailed information on the scope, type, purpose and further processing of your data on its website. Here you will also find further information on your rights and setting options to protect your privacy.

Data protection references of Google: https://policies.google.com/privacy.

4.4.4 Revocation of all consents

4.4.5 Further processing of tracking data for legitimate interests

4.4.5.1 Legitimate interests of OSP / balancing of interests

OSP is entitled to further process tracking data collected after consent has been granted, based on legitimate interests. The legal basis for this further processing is Art. 6 (1) lit f) GDPR (balancing of interests). Insofar as OSP further processes tracking data on the legal basis of Art. 6 (1) lit f) GDPR, this is done exclusively for purposes in which OSP has a legitimate interest. In connection with the further processing of tracking data, OSP does not process any data that is classified as particularly sensitive by law in Art. 9 GDPR (e.g. health data). OSP does not use the tracking data to produce evaluation results which could be assigned to the specially protected areas under Art. 9 GDPR. Nor will OSP use the tracking data to make any automated decisions which would have legal consequences for you as a user of the osp.de website or which would significantly affect you in a similar way. In addition, depending on its scope and the risks arising from the processing of the tracking data for your rights to be safeguarded, OSP will pseudonymise the tracking data, which prevents the data from being assigned to you personally.

4.4.5.2 Google Analytics (Basic version)

For the purpose of designing osp.de to meet your needs and to enable its continuous optimisation, data collected on the basis of a granted consent will be further processed using the basic version of Google Analytics on the legal basis in Art. 6 (1) lit f) GDPR (legitimate interest). The basic version of Google Analytics is a web analytics service of Google Inc. (Google). Google Analytics uses cookies, text files which are stored on your computer and which enable analysis of your use of the website. Google will use this information on behalf of OSP to evaluate your use of the website and to compile reports on website activity. Google processes the data collected using the basic version of Google Analytics exclusively on OSP's instructions and for OSP's purposes.

You may object to the further processing of your data by Google Analytics at any time here. As a result of the objection, Google Analytics will no longer collect data on the terminal device used by you to visit osp.de when you submitted your objection.

5. Contact

You have the option to contact us in several ways: via email, via contact form, over the phone, by post or per WhatsApp. When you contact us, we will use the personal information you voluntarily provide to us for the sole purpose of contacting you and processing your request.

The legal basis for this data processing is Art. 6 (1) lit. a), Art. 6 (1) lit. b), Art. 6 (1) lit. c) and Art. 6 (1) lit. f) GDPR.

6. Data protection information for applicants

On our job page you have the opportunity to apply for open positions. In the following, we would like to provide you with information on the processing of your personal data in connection with an application.

6.1 Data processing for the application procedure

If you apply for a job vacancy via our job page, we will process the following data for the purpose of the application process and possible employment with us: Salutation, first name, last name, e-mail address, date of birth , telephone number, salary requirement , application documents (CV, covering letter) and any other optional information. We process the data that you have sent us in connection with your application in order to check your suitability for the position (or, if applicable, other open positions in our companies – if your consent is required here in accordance with the legal basis, we will obtain this beforehand) and to carry out the application process. If further data is processed as part of the ongoing application process, we will inform you of this separately.

The legal basis for the processing of your personal data in this application process is laid down in the Data Protection and Digital Rights Act. According to which the processing of data necessary in connection with the decision to establish an employment relationship is permitted.

Should the data be required for legal prosecution after the application procedure has been completed, data processing may be carried out on the basis of the requirements of Article 6 GDPR, in particular to safeguard legitimate interests pursuant to Article 6(1) lit. f) GDPR. Our interest then consists in the assertion or defence of claims. Furthermore, in individual cases we are obliged to match your data with personal sanctions lists / embargoes (Article 6(1) lit. c) GDPR). In the application process for filling particularly risk-sensitive positions, we carry out a validation of your details and obtain further additional relevant security information. The legal basis for this is Article 6(1) lit. a) GDPR.

If you use the options of automatic transfer of personal data from portals such as XING or LinkedIn or via an upload of your CV, your data will be transferred to OSP once per update. There is no permanent connection to the portals.

6.2 Duration of storage

Applicant data:
In principle, your application data will be stored for a period of 6 months. In the event of a rejection, this data will then be anonymised.

Employee data:
If you have been accepted for a position during the application process, the data from the application data system will be transferred to our HR master data system. In principle, the data will then be stored for the duration of the employment relationship, unless longer retention periods are provided for by law.

6.3 Recipients of applicant data

Your applicant data will be viewed by the HR department after receipt of your application. Suitable applications are then forwarded internally to the person responsible for the respective open position. If consent is required by law and we have it, the application documents may also be forwarded to other responsible persons from other departments. In principle, only those persons in the company have access to your data who need it for the proper conduct of our application procedure. This also includes the members of the employee representation. In the course of system maintenance and servicing, your data may come to the attention of the persons entrusted with it. The relevant persons or, if applicable, the service providers used are obliged to maintain data secrecy.

7. Recipients outside the EU

With the exception of the above processing, we do not share your information with recipients located outside the European Union or the European Economic Area. The processing operations mentioned under 4. entail a data transfer to the servers of the providers of tracking or targeting technologies commissioned by us. These servers are located in the USA. Data is transferred on the basis of the EU Commission’s standard contractual clauses as well as in accordance with the principles of the Privacy Shield.

8. Your rights

8.1 Overview

In addition to the right to revoke your consent granted to us, you are entitled to the following further rights if the relevant legal requirements apply:

• the right to obtain information about your personal data stored by us (Art. 15 GDPR), in particular you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data was or is being disclosed, the planned storage period and the origin of your data, if it was not collected directly from you;
• the right to rectify incorrect data or to complete correct data (Art. 16 GDPR),
• the right to deletion of your data stored by us (Art. 17 GDPR), provided that we are not required to observe any statutory or contractual retention periods or other statutory obligations or rights concerning further storage,    
• the right to demand the restriction of the processing of your personal data (Art. 18 GDPR), provided that the accuracy of the data is disputed by you, the processing is unlawful, you however refuse its deletion and the controller no longer needs the data, you however need the data to assert, exercise or defend legal claims or you have objected to processing pursuant to Art. 21 GDPR,
• the right to data portability pursuant to Art. 20 GDPR, i.e. the right to transfer selected data stored by us in a common, machine-readable format, or to request transmission to another controller
• the right to complain to a supervisory authority. You can generally contact the supervisory authority of your usual domicile, place of work or our head office.

You can assert the aforementioned rights that you have regarding us under info(at)osp.de or via our contact form. You can assert the right to data portability under info(at)osp.de or via our contact form.

8.2 Right to object

Under the requirements of Art. 21 (1) GDPR, data processing can be objected to for reasons arising from the data subject's particular situation.

The above general right of objection applies to all processing purposes described in this Privacy Policy that are processed on the basis of Art. 6 (1) lit. f) GDPR. Unlike the special right of objection to data processing for advertising purposes (see above 3.2), under the GDPR we are only obliged to implement such a general objection if you give us reasons of overriding importance (such as a possible danger to life or health).