recruiting.ki - KI-Recruiting für Agenturen & Unternehmen

Definitions

For the purposes of the following privacy information, the following terms apply, whereby all personal designations refer to all genders and associated language forms and are always to be understood with the addition "m/f/d":

Controller. The controller for data processing is AI SCALING LTD, Kykladon 7, Pyla 7081, Cyprus (EU), E: [email protected], represented by Director Andre Thomas.
Data Subjects. Data subjects are all natural persons who visit the controller's website on which this privacy information is linked.
Personal Data. This refers to all information that directly or indirectly allows conclusions about natural persons, i.e., human beings.
Processing of Personal Data. This refers to any active or passive handling of personal data, from collection through core processing to deletion.
Consent. This is a demonstrable declaration of intent by which data subjects voluntarily and in advance agree to specific data processing.
Social Media / Upload to Custom Audience. This wording means that the controller uploads the data subjects' data (typically the email address) to a third-party provider of a social network or medium; naturally only after consent has been granted. This enables the controller to display interest-based advertisements ("ads") to data subjects when they visit a social network or medium. This works as follows: The controller uploads the contact data (typically the email address) to the respective third-party provider. The third-party provider then checks whether the data subjects are registered with these contact data. If not, the contact data are not entered into the Custom Audience (a type of database maintained by the controller with the respective third-party provider). If yes, the data are entered into the controller's Custom Audience. If the data subjects then visit the social network or medium provided by the respective third-party provider, the controller has the ability to show them advertising that may be of interest to them.
Social Media or Video Embeddings / Publication of Media Recordings. This wording means that the controller uploads media recordings of data subjects (photo, audio, and/or video recordings) to the respective social medium or network or video portal and publishes them there.

Notices to Data Subjects

Data subjects have the following rights regarding data stored about them: the right of access, the right to rectification of inaccurate data, the right to erasure of data for which there is no longer a reason for retention, the right to restriction of processing, and the right to data portability. They also have the right to file a complaint with the supervisory authority responsible for the controller.
If the processing is based on consent, data subjects may withdraw their consent at any time with effect for the future; for example, by informal notification to one of the contact channels mentioned above (see Definitions / Controller).
If the processing is based on a legitimate interest, i.e., on Article 6(1)(f) GDPR, data subjects may object to the processing at any time; for example, by informal notification to one of the contact channels mentioned above (see Definitions / Controller). If the objection is justified, the processing will be terminated. Where the legitimate interest lies in direct marketing, the objection is always justified.
No automated decision-making, including profiling, takes place.
A legal obligation to process only exists if reference is made below to Article 6(1)(c) GDPR.
If a data processing activity is described below, this does not mean that data subjects have any kind of claim to the associated actions (e.g., media recordings, evaluations). The rights of data subjects arise from paragraphs 1 to 3 of this section. The data processing activities described below only describe possible courses of action that do not apply to all data subjects.
If personal data is transferred to locations outside the European Union (third country), the controller must provide additional protective guarantees under Articles 44 ff. GDPR. If the controller relies on:
- Article 45 GDPR, this means that the receiving entity is located in a country, territory, or specific sector for which the EU Commission has determined that it provides an adequate level of data protection.
- Article 46 GDPR in conjunction with EU Standard Contractual Clauses, this means that the receiving entity has contractually committed to respecting the principles of EU data protection law, based on a model contract of the EU Commission.
- Article 47 GDPR, this means that the receiving entity has subjected itself to binding internal data protection rules that have been approved by a supervisory authority based in the EU.
- Article 49(1)(a) GDPR, this means that the data subjects have consented with knowledge of all risks of the data transfer to a third country.

Standard Data Processing

Informational Use

Data subjects initially use the website for informational purposes, i.e., they access the website without actively interacting with it. In doing so, the controller collects the following data of the data subjects, insofar as technically necessary for displaying the website: IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred, website from which the request originates, browser, operating system and its interface, language and version of the browser software. The purpose is the display of the website. The legal basis is Article 6(1)(f) GDPR, whereby the legitimate interest arises from the aforementioned purpose.

Changes in Data Processing

If the controller changes the manner of data processing, particularly by introducing new recipients, it will inform the data subjects by email about the change; by transmitting the updated privacy information. The purpose is to fulfill the transparency obligations under the GDPR (Articles 12 to 14 GDPR). The legal basis is Article 6(1)(c) GDPR.

Claims, Rights, and Conflicts in the Contractual Relationship

(1) If data subjects assert their rights under the GDPR or other legal provisions (including contractual claims), the controller processes the data to review and, if applicable, fulfill these claims. The purpose is the review of and response to the claims, including their fulfillment or rejection. The legal basis is Article 6(1)(f) GDPR, whereby the legitimate interest follows from the nature of the respective right asserted.

(2) In the event of a legal conflict between the data subjects and the controller, the data is processed to issue corresponding declarations (e.g., assertion of claims) and, if applicable, to obtain external legal advice. The following data is processed: name, contact data, all events related to the legal conflict. The processing serves the procurement of external legal advice/representation and the exercise of the controller's own rights. The legal basis is Article 6(1)(f) GDPR, whereby the legitimate interest follows from the aforementioned purposes.

Retention and Deletion

(1) After the end of the employment relationship, all aforementioned data that is still stored will be retained. With regard to retention, the purpose and legal basis arise from the following list of retention periods (paragraph 2).

(2) The following retention periods apply:

Accounting, invoices, tax-relevant documents
- Internal accounting-relevant records (e.g., annual financial statements, inventories, reports, accounts) are generally retained for 6 years, beginning at the end of the calendar year in which the respective document was created or relates to the relevant fiscal year. Processing serves the fulfillment of legal bookkeeping and tax obligations and is based on Art. 6(1)(c) GDPR in conjunction with Companies Law (Cap. 113), Income Tax Law (118(I)/2002), and the Value Added Tax Law.
- Booking vouchers, invoices, and other tax and levy-relevant documents (including VAT-relevant documents) are likewise retained for 6 years, beginning at the end of the calendar year in which the respective transaction took place. Processing occurs to fulfill legal bookkeeping and tax obligations and is based on Art. 6(1)(c) GDPR in conjunction with Income Tax Law (118(I)/2002) and Value Added Tax Law.
- Data from business communication with customers, insofar as it is tax or accounting-relevant (e.g., contract-modifying correspondence, written agreements, complaints with tax relevance), is likewise retained for 6 years, beginning at the end of the calendar year in which the respective communication occurred, to fulfill the aforementioned tax and commercial law obligations. The legal basis is Art. 6(1)(c) GDPR in conjunction with the mentioned Cypriot legal provisions.
Other business communication with customers
- Other business communication with customers that is not tax or accounting-relevant (e.g., general inquiries, support communication without contractual or tax implications) is stored only as long as necessary for the handling of the customer relationship, the processing of the inquiry, or the documentation of processes (e.g., during an ongoing contractual relationship and for a subsequent period oriented to applicable civil law). Processing is based on Art. 6(1)(b) GDPR (contract/initiation) or Art. 6(1)(f) GDPR (legitimate interest in documentation and customer service).
- The specific duration depends on the underlying purposes (e.g., contract execution, warranty, liability) and the applicable limitation periods under the Limitation of Actions Law 66(I)/2012, particularly the general 6-year limitation period for many contractual and tortious claims, although different, particularly shorter, periods may apply for certain claims (e.g., personal injury).
Data subject claims (GDPR and other claims)
- Data arising when data subjects assert data protection claims (e.g., access, deletion, damages for data protection violations) are stored for the duration of claim processing and thereafter for a period oriented to the applicable civil law limitation periods; regularly up to 6 years from the end of the calendar year in which the controller responded to the claim, unless a shorter or longer limitation period applies in individual cases. Processing serves to protect the legitimate interest in defending against claims and is based on Art. 6(1)(f) GDPR.
- Data arising when data subjects assert other civil law claims against the controller (e.g., contractual or tortious claims) are likewise stored for the duration of processing and subsequently for a period oriented to the applicable limitation provisions (regularly up to 6 years from the end of the calendar year in which the controller responded), unless special statutory provisions prescribe different (shorter or longer) periods. The legal basis is Art. 6(1)(f) GDPR (defense against legal claims).
Consents and consent records
- Data based on the data subjects' consent (e.g., marketing communication) is retained until the withdrawal of consent or until the processing purpose ceases, whichever occurs first. Processing is based on Art. 6(1)(a) GDPR.
- Data for proving consent granted (e.g., log data, consent texts, timestamps) is stored beyond the withdrawal of consent or the cessation of purpose only as long as necessary to defend against possible civil or regulatory claims; regularly, the general limitation periods under the Limitation of Actions Law 66(I)/2012 can be applied (generally up to 6 years, subject to different periods in individual cases). Processing is based on Art. 6(1)(f) GDPR (legitimate interest in evidence preservation).

Extraordinary Data Processing

External Web Hosting

The controller uses an external web host that displays the website and processes the technically required data for this purpose. The following data is processed: IP address, date and time of the request, time zone difference to GMT, content of the request (specific page), access status/HTTP status code, amount of data transferred, referral website, browser, operating system and its interface, language and version of the browser software. The purpose is the display of the website. The legal basis is Article 6(1)(f) GDPR, whereby the legitimate interest follows from the aforementioned purpose.

CDN

The controller uses a Content Delivery Network (CDN) for the accelerated provision of the website. The following data is processed: IP address, date and time of the request, time zone difference to GMT, content of the request (specific page), access status/HTTP status code, amount of data transferred, referral website, browser, operating system and its interface, language and version of the browser software. The purpose is the display of the website. The legal basis is Article 6(1)(f) GDPR, whereby the legitimate interest follows from the aforementioned purpose.

Cookie Consent

The controller gives data subjects the choice of whether to consent to the use of cookies and uses a cookie consent tool for this purpose. The following data is processed: IP address, date and time of the request, time zone difference to GMT, content of the request (specific page), access status/HTTP status code, amount of data transferred, referral website, browser, operating system and its interface, language and version of the browser software, consent status, date of consent. The purpose is the fulfillment of a legal obligation. The legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR.

Form

The controller provides a form tool on the website. Through this, communication takes place between data subjects and the controller, whereby the data subjects' inputs are documented and transmitted to the controller. The following data is processed: data about the content, manner, and scope of inputs in the respective form. The purpose is the initiation and/or performance of contracts. The legal basis is Article 6(1)(b) GDPR.

Signature

Data subjects visit the website and make declarations (e.g., checking checkboxes, shopping cart decisions). To confirm the declaration, the controller asks data subjects to digitally sign the declaration. This occurs, for example, by mouse movement or digital pen on a digital signature line. The following data is processed: content of the declaration of intent, signature image. The purpose is the initiation and/or performance of contracts. The legal basis is Article 6(1)(b) GDPR.

Payment

Data subjects visit the website and make declarations (e.g., checking checkboxes, shopping cart decisions) aimed at concluding a paid contract. The controller provides the option for online payment. For this purpose, data subjects are directed to an external payment provider that receives the payment order, executes it, and sends the controller confirmation that payment has been made. The following data is processed: payment status. The purpose is the initiation and/or performance of contracts. The legal basis is Article 6(1)(b) GDPR.

Recruiting Section

Data subjects can apply for employment on this website via a recruiting section and/or another contact channel. The controller receives this data and processes it to prepare a pre-selection and, if applicable, an interview and/or trial work day, or to communicate for other application-relevant purposes. The controller may: (1) access an internal area and view application data (including application documents and receipt date), (2) make notes associated with application data, (3) conduct internal communication about applications (if applicable with relevant departments), (4) document the decision regarding further handling of the application, (5) execute and document invitations to one or more interviews, (6) execute and document invitations to one or more trial work days, (7) transmit the employment contract document, (8) transmit and document a rejection, (9) carry out onboarding measures. The following data is processed: all data from the application and other communication content between the data subjects and the controller. The purpose is the initiation of an employment relationship. The legal basis is Article 6(1)(b) GDPR.

Login Area

On this website, data subjects have the option to register for the use of an internal area, subsequently log in, and finally log out. When registering for the internal area, the controller collects the data that data subjects provide during the registration process. Within the internal area, the controller records actions of data subjects insofar as necessary for providing the internal area with its functions. The following data is processed: (1) registration data entered by data subjects, (2) data about logins, (3) about actions performed by data subjects within the login area, (4) about the logout status. The purpose is the initiation and/or performance of contracts. The legal basis is Article 6(1)(b) GDPR.

Automated Communication

The controller receives data on the website that it processes for automated communication; both for (1) contractual and (2) advertising purposes. The following data is processed: name, email addresses, tags (indicating certain characteristics, e.g., existing customers, prospects, etc.), communication data, information about reading behavior (time of email opening, reaction status). Purpose (1) is the initiation and/or performance of contracts and purpose (2) is advertising outreach/direct marketing. The legal basis for purpose (1) is Article 6(1)(b) GDPR. The legal basis for purpose (2) is Article 6(1)(f) GDPR, whereby the legitimate interest follows from the aforementioned purpose (2).

Usage Behavior Analysis

For the analysis of user behavior of data subjects on this website, so-called cookies are used. These are text files stored on the data subjects' computers that enable analysis of website usage. From the information about usage behavior, reports on activities and interactions are generated. The controller uses this data to regularly improve the user experience on the website. Through the obtained statistics, it can also improve its offerings to direct data subjects' interest more precisely toward products and services suitable for them. The following data is processed: cookie-based data about interactions (especially sequence of interactions, dwell time). Further details are provided below in the information about third-party providers. The purposes are the optimization of this website and the improved advertising outreach to data subjects. The legal basis is Article 6(1)(a) GDPR.

Social Media

The controller uses social media and social networks. It has no influence on the collected data and data processing operations, nor is the full scope of data collection, processing purposes, storage periods, and circumstances of deletion of personal data fully known to it. When data subjects visit the controller's company and product pages in social media or advertisements (so-called ads), the providers of social media and networks may store the data collected about them as usage profiles and use these for advertising, market research, and/or needs-based design of their websites purposes. Regarding responsibility for this data processing: insofar as the controller analyzes visitor interactions with its company page, both it and the respective third-party provider of the social network or medium are jointly responsible under Article 26 GDPR. In all other cases, the respective third-party provider is engaged pursuant to Article 28 GDPR. The following data is processed: cookie or pixel-based data about interactions with the website and the controller's company and/or product pages, if applicable email address, name, and communication data. The purpose is the presentation of the controller. The legal basis is Article 6(1)(a) GDPR.

Videos

Plugins of a video portal are embedded on the website. Each time a page offering one or more video clips is accessed, a direct connection is established between the data subjects' browser and a server of the video portal. The following data is processed: cookie-based data transporting the following information: (1) that the data subjects visited this website (possibly also the specific subpage), (2) that a specific video was clicked. The purposes are the display of videos, the optimization of this website, and the improved advertising outreach to data subjects. The legal basis is Article 6(1)(a) GDPR.

Ads/Remarketing

The controller places advertisements, so-called ads, in social media, search engines, or social networks. These ads are displayed to data subjects after they have visited the controller's website and a cookie has been set that re-identifies them, so-called remarketing. The following data is processed: cookie or pixel-based data about interactions with the website and the controller's company and/or product pages. The purpose of the processing is the presentation of the controller and advertising outreach. The legal basis is Article 6(1)(a) GDPR.

(1) The controller enables data subjects to subscribe to a newsletter on the website.

(2) First, it requests consent and documents the response. To obtain consent, the controller uses the so-called double opt-in procedure. This means that after newsletter registration, it sends data subjects an email to the provided email address asking them to confirm their consent. If they do not confirm their registration after a predefined waiting period, their information is blocked and automatically deleted after another waiting period. In addition, the controller stores the IP addresses used and the times of registration and confirmation. The following data is processed: name, consent status, date of decision, IP address. The purpose is the fulfillment of a legal obligation under Article 7(1) GDPR. The legal basis is Article 6(1)(c) GDPR.

(3) If consent is granted, the controller uses the data subjects' email addresses for advertising outreach. The following data is processed: name, email address. The purpose is advertising outreach/direct marketing. The legal basis is Article 6(1)(a) GDPR.

AI Chatbot

There is the possibility that data subjects make inputs that are processed using an application that imitates human capabilities such as logical thinking, learning, planning, or creativity. The input data is collected via input fields and other forms of interaction and transmitted via an interface to an external application that captures this data and processes it using artificial intelligence to interact with the data subjects. From the interaction, insights are gained that, on one hand, train the AI system and, on the other hand, are available to both the controller and the operator of the AI system. The purpose is targeted and always-available communication with data subjects. The following data is processed: input data, insights from the inputs. The legal basis is Article 6(1)(f) GDPR, whereby the legitimate interest follows from the aforementioned purpose.

External Map

A map is displayed on this website that shows data subjects directions. As soon as data subjects reach the corresponding page, the data mentioned below is transmitted to both the controller and the respective external third-party provider of the map service. The map is only displayed if consent has been given in advance. The following data is processed: (1) data about the use of this website, (2) IP address and, if applicable, (3) data about the address entered for route planning. The legal basis is the consent of the data subjects (Article 6(1)(a) GDPR).

External Fonts

In connection with the website, external font directories are accessed. Data is transmitted to external third-party providers who use it to determine results and success of certain font types to optimize them as their own offering. Specifically: as soon as data subjects visit this website, their browsers send HTTP requests to the respective external third-party font provider. The URL requested identifies the font families. This data is logged so that the respective external third-party provider can determine how often a specific font family is requested. Furthermore, the font is adapted to the respective browser type, which in turn requires the collection and storage of browser type data. This also produces statistics that are used to optimize fonts. Finally, the referral URL is logged so that the data can be used for product maintenance and an aggregated report on top integrations based on the number of font requests can be generated. The following data is processed: cookie-based data about interactions (especially sequence of interactions, dwell time). This data is processed to generate aggregated usage statistics with which the popularity of font families is measured. The legal basis is Article 6(1)(a) GDPR.

Reseller

If data subjects wish to acquire access to the controller's products/services, they are in some cases redirected to a so-called reseller who purchases the product from the controller and resells it to the data subjects. In this regard, the reseller is itself a controller. The controller then processes all data received from the reseller to fulfill the contract. This includes information (1) that and how long the data subjects use the product or service and (2) when the data subjects terminate the contractual relationship. The controller receives this information from the reseller. The purpose is the initiation and/or performance of contracts. The legal basis is Article 6(1)(b) GDPR.

Recipients

AWS

Applications of Amazon Web Services EMEA SARL (EU - Luxembourg) are used, engaged pursuant to Article 28 GDPR. A transfer of data to a third country that cannot be excluded (here to Amazon Web Services Inc., USA) is justified for employee data pursuant to Article 46 GDPR and for all other data pursuant to Article 45 GDPR. The following applications are used: AWS Hosting.

Framer

The CMS "Framer" by Framer B.V. (EU - Netherlands) is used, engaged pursuant to Article 28 GDPR.

Cloudflare

The Content Delivery Network (CDN) "Cloudflare" by Cloudflare, Inc. (USA) is used, engaged pursuant to Article 28 GDPR. A transfer of data to a third country that cannot be excluded (here USA) is justified pursuant to Article 45 GDPR.

Google

Applications of Google Ireland Ltd. (Ireland - EU) are used, engaged pursuant to Article 28 GDPR. A transfer of data to a third country that cannot be excluded (here to Google LLC in the USA) is justified pursuant to Article 45 GDPR. The following applications are used:

Google Analytics: Google Analytics: Google Analytics helps analyze user behavior on the website. The IP address is shortened by the third-party provider within member states of the European Union or in other contracting states of the Agreement on the European Economic Area beforehand. Only in exceptional cases is the full IP address transmitted to a server of the third-party provider in the USA and shortened there. The IP address transmitted by the browser within the scope of this tool is not merged with other data by the third-party provider. The tool is also used for cross-device analysis of visitor flows, which is carried out via a User ID.

The messenger service "WhatsApp" by WhatsApp Ireland Limited (Ireland - EU) is used. If data is processed through it, it cannot be excluded that this data is transmitted to the following companies:

Companies based in the EU:

Meta Platforms Ireland Limited (Ireland - EU)
Facebook Germany GmbH (Germany - EU)
FB Spain S.L. (Spain - EU)

Companies based in countries for which there is an adequacy decision within the meaning of Article 45 GDPR:

Facebook Israel Limited (Israel)
Facebook UK Limited (United Kingdom)

Here the transfer to entities outside the EU is justified pursuant to Article 45 GDPR.

Other companies with particularities:

WhatsApp LLC (USA). A transfer of data to a third country that cannot be excluded (here USA) is justified for employee data pursuant to Article 45 GDPR and for all other data pursuant to Article 45 GDPR.
Facebook Singapore Pte Limited (Singapore). A transfer of data to a third country that cannot be excluded (here Singapore) is justified for employee data pursuant to Article 46 GDPR and for all other data pursuant to Article 45 GDPR.
Meta Platforms Inc. (USA). A transfer of data to a third country that cannot be excluded (here to Meta Platforms Inc., USA) is justified for employee data pursuant to Article 46 GDPR and for all other data pursuant to Article 45 GDPR.

Details are explained here: https://www.whatsapp.com/legal/privacy-policy-eea#privacy-policy-how-we-work-with-other-meta-companies

Zoom

The webinar/video conferencing tool "Zoom" by Zoom Video Communications, Inc. (USA) is used, engaged pursuant to Article 28 GDPR. A transfer of data to a third country that cannot be excluded (here USA) is justified pursuant to Article 45 GDPR.

Microsoft

Applications of Microsoft Ireland Operations Limited (EU - Ireland) are used, engaged pursuant to Article 28 GDPR. A transfer of data to a third country that cannot be excluded (here to Microsoft Corporation, USA) is justified pursuant to Article 45 GDPR. The following applications are used:

Microsoft 365 (Cloud, Software)
Microsoft Teams (Project Management)
Microsoft Teams (Video Conferencing)

Vimeo (General)

The video playback tool "Vimeo" by Vimeo, LLC (USA) is used, engaged pursuant to Article 28 GDPR. A transfer of data to a third country that cannot be excluded (here USA) is justified for employee data pursuant to Article 46 GDPR and for all other data pursuant to Article 45 GDPR. The following are used:

Vimeo (Plugin)
Vimeo (Own Channel)

Jotform

The form tool "Jotform" by Jotform, Inc. (USA) is used, engaged pursuant to Article 28 GDPR. A transfer of data to a third country that cannot be excluded (here USA) is justified pursuant to Article 46 GDPR.

Privacy Policy for Website Visitors