Privacy Notice

Data Controller

4C GROUP AG
Elsenheimerstraße 55a
80687 Munich (“4C GROUP”)
Contact: kontaktaufnehmen@4cgroup.com

You can reach our Data Protection Officer at:

4C GROUP AG
Elsenheimerstraße 55a
D-80687 Munich
datenschutz@4cgroup.com

The Data Protection Officer at 4C GROUP AG is available to answer any questions you may have regarding data protection, either by mail or by email.

Collection and Processing of Personal Data on This Website

Note: To protect your data as comprehensively as possible against unauthorized access, we implement technical and organizational measures and use an encryption method on our website. Your data is transmitted over the Internet from your computer to ours and vice versa using TLS encryption. TLS stands for “Transport Layer Security” and is an encryption protocol for data transmission over the Internet. You can usually recognize “TLS” by the fact that the lock icon in your browser’s status bar is closed and the address begins with , https://, or .

1. Collection of Access and Log Data

This website automatically collects and stores server log file information that your browser transmits to us.

This includes:

• The user’s IP address
• Date and time of access
• Type of request
• Customer information such as type and version
• User’s operating system (device, device OS version),
• Referrer information (i.e., the source of the access)

The legal basis for this data processing is our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Our legitimate interest lies in being able to identify indications of unlawful use of our website. This data is stored separately from any other personal data you may have provided. Your personal data is generally not transferred to third parties. We have entered into a data processing agreement pursuant to Article 28 of the GDPR with the provider of this website, IONOS SE, headquartered in Montabaur (Germany).

The provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us, and stores this information for a maximum of 7 days. We store the server log files only in the event of attacks on our server infrastructure or other legal violations. This extended retention period is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR and serves solely to preserve evidence.

Furthermore, our web agency, WMM Software Development GmbH, based in Germany, has access to the backend of our website. We also have a data processing agreement in place with WMM Software Development GmbH.

2. Inquiries via the Contact Form, Email, and Phone

We naturally treat any personal information you voluntarily provide to us as confidential. We use the personal data you provide exclusively to process and respond to your inquiry. The legal basis for data processing is our legitimate interest pursuant to Article 6(1)(f) of the GDPR. This stems from our interest in responding to inquiries from our customers, business partners, and prospective clients, and in promoting and maintaining customer satisfaction. An additional legal basis for natural persons is the initiation or performance of a contract pursuant to Article 6(1)(b) of the GDPR.

We use the Microsoft Dynamics 365 CRM system to process and manage your inquiry. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, which we engage as a data processor within the meaning of Article 28 of the GDPR on the basis of a data processing agreement. To the extent that data is transferred to Microsoft Corporation (U.S.), we base this transfer on the EU Commission’s Adequacy Decision (EU-U.S. Data Privacy Framework), for which Microsoft is certified. In addition, and for any transfers to other third countries, Standard Contractual Clauses of the EU Commission pursuant to Article 46 of the GDPR apply.

All personal data that you provide to us with your inquiry will be deleted or anonymized by us no later than 2 years after we provide you with a final response, provided that no contract is concluded. The 2-year retention period is based on the fact that, in isolated cases, you may contact us again regarding the same matter after receiving a response and refer to the previous correspondence. Based on our experience, we have found that after 2 years, no further inquiries follow up on our responses.

3. Sending Newsletters

Based on your express consent, we will periodically send you our newsletter or similar target-group-specific content (e.g., invitations and registration information for company events and working groups) via email to the email address you provided. The legal basis for sending the newsletter is your consent pursuant to Article 6(1)(a) of the GDPR in conjunction with Section 7(2)(2) of the German Unfair Competition Act (UWG). When you subscribe to the newsletter at , we collect and store the data you enter into the form. Only your email address is required. All other information, such as title, first name, and last name, is provided on a voluntary basis. After submitting the registration form, you will receive an email from us containing a confirmation link. As soon as you click on the link contained therein, you give us your consent to receive our newsletter and have successfully subscribed to it. You will be notified of this via another email. You also grant us your consent to process your email address and, if applicable, your other data. This ensures that no third party or unauthorized person subscribes to our newsletter (compliance with the double opt-in procedure).

You can unsubscribe from the newsletter at any time by clicking the “Unsubscribe” link at the bottom of each newsletter. If you revoke your consent, your data will be deleted immediately. We will retain proof of the revocation for an additional three years so that we can fulfill our accountability obligations under Article 5(2) of the GDPR. This retention is based on our legitimate interest under Article 6(1)(f) of the GDPR. The legal basis for the confirmation email is our legitimate interest under Article 6(1)(f) of the GDPR, which is based on the need to be able to prove that you have given your consent. The controller’s obligation to provide proof is set forth in Article 5(2) of the GDPR.

This website uses CleverReach to send this electronic, target-group-specific content. The provider is CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede. CleverReach is a service that enables the electronic distribution of target-group-specific content to be organized and analyzed. The data you enter to receive this electronic, target-group-specific content (e.g., email address) is stored on CleverReach’s servers in Germany or Ireland.

The electronic, target-group-specific content we send via CleverReach enables us to analyze recipient behavior. Among other things, we can analyze how many recipients opened the electronic messages and how often each link in the message was clicked. Using what is known as conversion tracking, we can also analyze whether a predefined action (e.g., signing up and registering for an event on our website) took place after the link in the email was clicked. For more information on data analysis through electronic messages sent via CleverReach, please visit: https://www.cleverreach.com/de/funktionen/reporting-und-tracking/.

It is not possible to opt out of performance tracking separately; if you do not consent, you must cancel your entire newsletter subscription.

4. Registration for Events

When you register for an event using our forms, we process the data you provide (company, title, first name, last name, email address, phone number, and your comment) to process your registration, organize and conduct the event, and communicate with you regarding the event. Required fields are company name, first name, last name, and email address; without this information, we cannot process your registration. The legal basis is the performance of the (pre-contractual) relationship established by the registration pursuant to Article 6(1)(b) of the GDPR, as well as our legitimate interest in the organizational management of the event pursuant to Article 6(1)(f) of the GDPR.

We use the service provider CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, to send event-related emails. For more information about CleverReach, see 3. SENDING NEWSLETTERS.

If you would also like to be informed by email about other events and news from the 4C GROUP, you can check the box provided for this purpose on the registration form. This information will then be sent exclusively on the basis of your consent given by checking the box, in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 7(2) of the German Unfair Competition Act (UWG). You may revoke your consent at any time with future effect, for example via the unsubscribe link in every email; the lawfulness of the processing carried out up until the revocation remains unaffected.

We store your registration data for the duration of the event and beyond, to the extent that statutory retention requirements apply.

5. Use of Web Analytics Tools and Cookies

We use cookies to facilitate and improve the use of our website. Cookies are small text files that may be stored on your computer or smartphone (end device) via your browser when you visit a website. Cookies can also provide us with information about how you use our website, enabling us to continuously improve its design.

Among other things, cookies help us uniquely identify what our customers find interesting and useful on our website. We also use so-called “web beacons” (small graphic images, also known as “pixel tags” or “clear GIFs”) on our website. They are used in conjunction with cookies to track general user behavior on the website. The following rules regarding consent also apply to web beacons and similar technologies.

In Germany, the storage of information on your device and access to information already stored there are governed by Section 25 of the Telecommunications and Digital Services Data Protection Act (TDDDG). This provision applies regardless of whether the information in question is personally identifiable.

We use technically necessary cookies and similar technologies without requiring your consent. Access is permitted under Section 25(2)(2) of the TDDDG because it is strictly necessary for us to provide the service you have expressly requested (such as to display our website correctly or to enable you to use the features you have requested). We base the processing of personal data that occurs in this context on our legitimate interests and the interests of third parties pursuant to Article 6(1)(f) of the GDPR or, where applicable, on Article 6(1)(b) of the GDPR.

Any use of cookies and similar technologies that is not technically necessary is permitted only with your prior, explicit, and active consent. The legal basis for accessing your device in this regard is Section 25(1) of the TDDDG; we base the subsequent processing of your personal data on your consent pursuant to Article 6(1)(a) of the GDPR. Using our “Cookie Consent Tool,” you can choose which cookie categories you wish to consent to when visiting our website. You can also revoke or modify your consent at any time with future effect.

You can also delete cookies that have already been stored at any time via your web browser’s settings. You can also adjust your web browser’s settings so that no cookies are stored. In that case, however, not all features of our website may be available.

We use cookies for the following purposes:

• Technically necessary: Cookies and similar methods without which you cannot use our services, for example, to display our website correctly or to use the features you request. These techniques do not require consent under Section 25(2)(2) of the TDDDG.
• Convenience: Technologies that allow us to take into account your actual or presumed preferences for the convenient use of our website, such as displaying content in a language suitable for you. These technologies are used only with your consent in accordance with Section 25(1) of the TDDDG.
• Statistics: Techniques that enable us to compile statistics on the use of our services in order to better tailor our website to our users’ habits. These are used only with your consent pursuant to Section 25(1) of the TDDDG.
• Marketing: Technologies that allow us to display personalized advertising content based on an analysis of your usage behavior. Your usage behavior may also be tracked across different websites, browsers, or devices using a user ID (unique identifier). These technologies are used only with your consent in accordance with Section 25(1) of the TDDDG.

Consent Management

We use cookie consent technology to obtain your consent under data protection law to the storage of certain cookies on your device or to the use of certain technologies, and to document this in compliance with data protection regulations. The cookie consent technology is hosted by WMM Software Development GmbH, based in Germany.

To store your data protection consents, we set a technically necessary cookie. The following information is stored in the cookie:

• Cookie Duration
• Cookie version
• Domain and path of the website
• Consents
• ID

This tool is used to obtain the legally required consents for the use of cookies. The legal basis for this is our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Our legitimate interest lies in the legally compliant documentation and verifiability of consents (Article 6(1)(c) of the GDPR) to fulfill our accountability obligations under Article 5(2) of the GDPR.

Use of Google Analytics

This website uses Google Analytics if you provide your consent in accordance with Article 6(1)(a) of the GDPR. This is a service provided by Google Ireland Limited (“Google”), a company incorporated and operating under Irish law (registration number: 368047) with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC (USA) (“Google”).

Google Analytics uses so-called “cookies.” These are text files that are stored on your computer and enable an analysis of how users interact with the website. The information collected by the cookies regarding your use of this website is generally transmitted to a Google server in the United States and stored there. We base data transfers to Google in the U.S. on the EU Commission’s Adequacy Decision (EU-U.S. Data Privacy Framework), for which Google is certified. In addition, Standard Contractual Clauses of the EU Commission pursuant to Art. 46 of the GDPR are in place. You can view Google’s certification here.

Google Analytics does not log or store IP addresses. The IP address is evaluated only briefly for rough location determination and is not stored permanently. On our behalf, Google uses the collected information to evaluate your use of the website, compile reports on website activity, and provide us with other services related to website usage. We have a data processing agreement with Google in accordance with Article 28 of the GDPR. We do not use the data processed within the scope of Google Analytics to identify you as an individual, nor do we combine it with other data sources.

You can view the cookies set in connection with Google Analytics in the list above.

You can withdraw your consent at any time by adjusting the relevant settings directly via the cookie banner. User and event data are deleted 12 months after the last activity. The “Reset user data upon new activity” feature is disabled. This means that if you visit the site again before the retention period expires, your data will not be deleted.

Embedding YouTube Videos

We embed videos on our websites that are not stored on our servers. To ensure that visiting our websites with embedded videos does not automatically result in third-party content being loaded, we initially display only locally stored thumbnails of the videos. This prevents the third-party provider from receiving any information.

Only after you click on the thumbnail or give your consent via the cookie consent banner will content from the third-party provider be loaded. This provides the third-party provider with the information that you have visited our site, as well as the usage data technically required for this purpose. We have no influence over the third-party provider’s further data processing. By clicking on the thumbnail, you give us your consent to load the third-party provider’s content. The embedding is based on your consent pursuant to Art. 6(1)(a) of the GDPR, provided that you have previously given your consent by clicking on the thumbnail. We base data transfers to Google in the U.S. on the EU Commission’s adequacy decision (EU-U.S. Data Privacy Framework), for which Google is certified. In addition, Standard Contractual Clauses of the EU Commission pursuant to Article 46 of the GDPR apply. You can view Google’s (YouTube’s) certification here.

Video service provider: Google Ireland Limited/Google LLC (U.S.) (“YouTube”)

Withdrawal of Consent: When you click on a thumbnail, the third-party content is reloaded immediately. If you do not wish for such reloading to occur on other pages, please refrain from clicking on thumbnails or withdraw your consent for reloading via the cookie consent banner.

Data Processing in Connection with Job Application Processes

To receive and manage your application—and thus for the purpose of (potentially) establishing an employment relationship—you can submit your application to us via an online form that we provide through the Microsoft Forms service. Through this form, we collect the data you provide, specifically your title, first and last name, email address, the position you are applying for, and how you learned about us. After submitting the form, you will receive a confirmation email with a link to a personal file storage area where you can upload your application documents. Alternatively, you can submit your application to us via email. As part of the application process, we collect only the data from you that is necessary to establish an employment relationship with us. The legal basis for this data processing is Article 6(1)(b) of the GDPR in conjunction with Section 26(1) of the German Federal Data Protection Act (BDSG) (initiation of an employment relationship).

We engage Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, as a data processor within the meaning of Article 28 of the GDPR to provide the form and the file storage system. We have a data processing agreement in place with Microsoft. On this basis, Microsoft does not process the data transmitted via the form and the file storage system for its own purposes.

To the extent that data is transferred to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA, in connection with the use of Microsoft services, we base this transfer on the EU Commission’s adequacy decision (EU-US Data Privacy Framework), for which Microsoft is certified. In addition, and for any transfers to other third countries, the EU Commission’s Standard Contractual Clauses pursuant to Article 46 of the GDPR apply.

Within our company, only those individuals involved in the decision-making process have access to your personal data. If your application is successful, your personal data will be stored for the duration of your employment. Furthermore, after your employment ends, your tax-related data will be archived in accordance with statutory retention periods. If your application is unsuccessful, your personal data will be deleted six months after the rejection notice.

Rights of Data Subjects

You have the right, pursuant to Art. 15(1) of the GDPR, to receive, upon request and free of charge, information about the personal data stored about you. Furthermore, subject to the legal requirements, you have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), and restriction of processing (Art. 18 GDÜR) of your personal data. If you yourself have provided the processed data, you have the right to data portability under Art. 20 GDPR.

If the data processing is based on Art. 6(1)(e) or (f) of the GDPR, you have the right to object under Art. 21 of the GDPR. If you object to data processing, such processing will cease in the future, unless the controller can demonstrate compelling legitimate grounds for further processing that override the data subject’s interest in objecting.

If the data processing is based on consent pursuant to Art. 6(1)(a), Art. 9(2)(a), or art. 49(1)(a) of the GDPR, you may withdraw your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out up to that point.

in addition, you have the right to file a complaint with a data protection supervisory authority. in particular, you may file a complaint with a supervisory authority in the eu member state where you reside, where you work, or where the alleged violation occurred.

Contact information for the competent data protection authority:

Bavarian State Office for Data Protection Supervision
Mailing Address
P.O. Box 1349
91504 Ansbach

Phone: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800
Email: poststelle@lda.bayern.de

No Automated Decision-Making

We do not engage in automated decision-making in individual cases, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

Provision

Unless otherwise specified in the preceding sections, the provision of personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. Failure to provide your personal data may result, for example, in our inability to respond to your inquiries.