Privacy Policy: Social Media

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

4C GROUP AG
Elsenheimerstrasse 55a
80687 Munich
Germany
Email: datenschutz∂4cgroup.com">datenschutz∂4cgroup.com

2. Data Protection Officer

Our Data Protection Officer is available to answer any questions you may have regarding data protection and the exercise of your rights by mail or email:

4C GROUP AG
Data Protection Officer
Elsenheimerstrasse 55a
80687 Munich
Germany
Email: datenschutz∂4cgroup.com">datenschutz∂4cgroup.com

3. Our Social Media Presence

We maintain the following social media accounts. For the sake of transparency, we also provide the name of the respective platform operator and its address:

When you visit or interact with these sites, personal data is processed by both us and the respective platform operator. We provide detailed information on this below.

4. Data Processing by Us

4.1 Maintaining Our Social Media Pages and Communication

We maintain the social media pages listed above, publish content, and communicate with you. The personal data you enter on these pages (for example, comments, videos, images, likes, public messages, or direct messages via the available messaging services) is published on the respective platform or transmitted to us. We reserve the right to delete content if necessary. Where appropriate, we may share content on our page.

The legal basis is our legitimate interest in public relations, communication, and external presentation pursuant to Article 6(1)(f) of the GDPR. If you contact us via a messaging service, we process your data to handle and respond to your inquiry; the legal basis is Article 6(1)(f) of the GDPR.

4.2 Page Insights and Joint Control (Article 26 of the GDPR)

The platforms provide us with statistics and insights from which we gain an understanding of the types of actions people take on our site (so-called site insights). These insights are generated based on information about the people who have visited our site and are provided to us in an aggregated, anonymized form.

The legal basis for this processing is our legitimate interest in the statistical analysis of user behavior to improve our website, pursuant to Article 6(1)(f) of the GDPR.

This processing is carried out by us and the respective platform operator as joint controllers pursuant to Article 26 of the GDPR. We have entered into the required agreements on joint controllership with the operators. These agreements specify, in particular, who fulfills which information obligations and how you can exercise your rights. You can view the key provisions of these agreements via the following links:

• LinkedIn: legal.linkedin.com/pages-joint-controller-addendum
• Instagram: facebook.com/legal/controller_addendum

You may generally exercise your data subject rights with any of the joint controllers. Please note that the primary responsibility for processing Insights data lies with the platform operators, as only they have full access to the underlying user data.

5. Data Processing by the Platform Operators

In addition to us, the respective platform operator also processes personal data under its own responsibility. In this respect, the platform operator is also a data controller within the meaning of the GDPR. We have only limited influence over this processing. Where we can exert influence, we work within the scope of our capabilities to ensure that data is handled in compliance with data protection regulations. In many cases, however, we cannot influence the processing carried out by the operator and do not know exactly what data the operator processes.

The respective operator will inform you about the processing of your personal data in its own privacy policy:

• LinkedIn (LinkedIn Ireland Unlimited Company): de.linkedin.com/legal/privacy-policy
• XING (New Work SE): privacy.xing.com/de/datenschutzerklaerung
• Instagram (Meta Platforms Ireland Limited): help.instagram.com/519522125107875

6. Transfer to Third Countries

When using the platform, your personal data is generally also processed by the respective platform operator on servers located in third countries, particularly in the United States.

For certain third countries, the European Commission has determined, through a so-called adequacy decision, that a level of data protection comparable to that of EU or EEA law exists there. For the United States, such an adequacy decision exists based on the EU-U.S. Data Privacy Framework (DPF) for companies certified under the DPF. Meta Platforms (Instagram) and LinkedIn are certified under the Data Privacy Framework. To the extent that no adequacy decision exists for a transfer, we base the transfer on the Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR or on another permissible safeguard.

7. Retention Period

We store your personal data only for as long as is necessary for the respective purposes or as required by statutory retention obligations.

• Content you post (comments, messages, likes) generally remains stored until you delete it or we remove it as part of our moderation process.
• We store inquiries you send to us via messaging services for the duration of their processing and beyond, to the extent necessary for evidentiary purposes or due to legal obligations.
• Platform operators provide us with page insights only in aggregated, anonymized form and for a limited period of time.
• The storage of data by the respective platform operator is governed by that operator's own privacy policy.

8. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

• Right of Access (Art. 15 GDPR): You may request information regarding whether and what personal data we process about you.
• Rectification (Art. 16 GDPR): You may request the correction of inaccurate data or the completion of your data.
• Erasure (Art. 17 GDPR): Under certain conditions, you may request the erasure of your data.
• Restriction of processing (Art. 18 GDPR): Under certain conditions, you may request that the processing of your data be restricted.
• Data Portability (Art. 20 GDPR): You may request to receive the data you have provided in a structured, commonly used, and machine-readable format.
• Withdrawal of Consent (Art. 7(3) GDPR): To the extent that processing is based on your consent, you may withdraw it at any time with future effect. The lawfulness of the processing carried out prior to the withdrawal remains unaffected.

To exercise your rights, simply send an informal message to the contact information provided. Please note that you may also exercise some of these rights directly with the respective platform operator, as only that operator has full access to certain data.

9. Right to Object (Art. 21 GDPR)

To the extent that we process your personal data on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right to object to such processing at any time for reasons arising from your particular situation. You may submit your objection informally using the contact information provided.

10. Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

Without prejudice to other legal remedies, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR. You may exercise this right with a supervisory authority in the Member State of your residence, your workplace, or the location of the alleged violation.

The supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach, Germany

11. Necessity of Providing Data

The provision of your data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are not obligated to provide your personal data. If you do not provide your data, you will not be able to communicate with us or participate in interactions via our social media pages. In this case, please use the email address provided above to contact us.

12. Automated Decision-Making and Profiling

We do not use automated decision-making, including profiling, as defined in Article 22 of the GDPR, that produces legal effects concerning you or similarly significantly affects you. However, the platform operators may analyze your usage and behavioral data for their own purposes, in particular for personalized advertising, and may engage in profiling in this context. We have no influence over this processing. For more information, please refer to the operators' privacy policies.

13. Note on Web Tracking

The operator of the respective platform uses web tracking methods. Web tracking may occur regardless of whether you are logged in or registered with the platform. We have little control over these methods and, in particular, cannot disable them. It cannot be ruled out that the provider may use your profile and behavioral data to analyze, for example, your habits, personal relationships, or preferences. We have no control over this processing by the provider.