Data protection: How personal data is processed at WBS (pursuant to Article 13 DSGVO)
The WBS GRUPPE (WBS), which includes WBS TRAINING AG, WBS TRAINING SCHULEN gGmbH and app2job GmbH, is pleased to be able to offer the following basic information about data protection and how your personal data is handled.
Table of Contents
1. Data controller as defined by data protection law; contact
The data controller as defined by data protection law is the relevant WBS GRUPPE company as described below.
You can contact our data protection officer at JSoetbeer@intersoft-consulting.de or at the respective postal address by adding “For the attention of the data protection officer” to the address line.
1.1. WBS TRAINING AG
The data controller pursuant to Article 4 Paragraph 7 of the EU General Data Protection Regulation (GDPR) is WBS TRAINING AG, Lorenzweg 5, 12099 Berlin, Germany; phone: +49 (0)30 695450400; email@example.com
This data controller is responsible for the following websites:
1.2. WBS TRAINING SCHULEN gGmbH
The data controller pursuant to Article 4 Paragraph 7 of the EU General Data Protection Regulation (GDPR) is WBS TRAINING SCHULEN gGmbH, Lorenzweg 5, 12099 Berlin, Germany; phone: +49 (0)30 695450400.
This data controller is responsible for the following website:
1.3. App2job GmbH
2. Data we collect, purpose for collection and legal basis for collection:
2.1. As a prospective customer or participant/student using our educational products:
Please note: Information on in-house events run by WBS AKADEMIE is available in Section 2.2.
When you contact us using the contact options provided on the website, by email or by visiting one of our WBS locations, we collect various personal data, depending on whether you are receiving a consultation or are concluding a contract with us:
2.1.1. Depending on the educational product, we process the following data for the purpose of executing and initiating a contract (Article 6 Paragraph 1(b) GDPR):
If you book an educational course, training, continuing education course or coaching session with us, we collect and process the data that is necessary to execute the contract. The scope of the data depends on the product and on your funding situation. If you contact us as a prospective student, we collect much of this data in the course of initiating a contract. The legal basis for the processing of data in this case is Article 6 Paragraph 1(b) GDPR.
- Personal data and contact details
- Professional/CV data and data regarding qualifications (e.g. educational qualifications)
- Details about the profession, traineeship or workplace being pursued
- Details regarding financing and, if applicable, your source of funding
- In special cases, certificate of health or good conduct, where applicable
- If applicable, details regarding mobility and willingness to travel
- In special cases, details regarding impairments relevant to the labor market and the degree of disability
- Your account details, should we apply to your funding source for travel expenses on your behalf
- From integration course participants, we also over require details regarding residence status and country of origin
- If you would like to participate from home, we collect data relating to the quality of your internet connection
- If you have provided your contact details as a prospective student, we use this data to contact you regarding the initiation of a contract, e.g. to arrange a consultation appointment, to send you offers that correspond with your stated qualification goals, to remind you of agreed appointments, or for queries regarding quotes issued.
- Data generated in the course of executing the contract, e.g. examination results, dates of attendance and absence and reasons for absence, meeting minutes.
- Information about an employment relationship that has been entered into in the meantime upon completion of your qualification for quality control as contractually agreed. It is very important to WBS that your qualification brings you success. If you are a participant of a measure that is subsidized by the German Employment Agency, we are required to inform the German Employment Agency and/or the job center of this pursuant to Sections 183 and 318 of the German Social Code, Book III (Sozialgesetzbuch Drittes Buch [SGB III]) and Section 2 Paragraph 2 of the German Accreditation and Licensing Ordinance on Employment Promotion (Akkreditierungs- und Zulassungsverordnung Arbeitsförderung [AZAV]). To that end, we will contact you once you complete said measure.
2.1.2. On the basis of consent granted voluntarily and which may be revoked at any time (Article 6 Paragraph 1(a) GDPR):
- If you have granted us your consent to do so, we process your data in order to send you information pertaining to other course offerings, our newsletter and invitations to customer surveys.
- If you have explicitly consented, we use data regarding your suitability (CV, qualifications booked) to compare with enquiries from potential employers and, if applicable, to send this data to the company making the enquiry.
2.1.3. On the basis of WBS’ legitimate interests (Article 6 Paragraph 1(f) GDPR):
- In order to safeguard our legitimate interests as defined by Article 6 Paragraph 1(f) GDPR, we reserve the right to send you regular or one-off invitations to customer surveys and offers for products similar to those you have already purchased from our range of products by email. You may object to this use of your email address at any time by clicking on the unsubscribe link in the marketing email provided for this purpose without incurring any costs other than the base rates charged to send this data.
- We would also like to facilitate independent quality checks by institutes. As such, we may hire other companies to conduct customer surveys, so you might be contacted by a company other than WBS. We conclude contracts for data processing with these companies in compliance with the provisions of the GDPR.
- We use your contact data in connection with the products you book through our company to invite you to company presentations. We do this to offer you the best possible support in finding suitable employment and thereby to increase the success of our qualifications. Please inform us if you do not wish to be contacted for this purpose.
2.2. As a participant of an in-house event run by WBS AKADEMIE
Depending on the product and depending on the agreement in place with your employer, we collect the following data when you attend an in-house event:
- Your name and contact details so we can contact you during your enrolment
- Data about your job title or position in your organisation, if necessary to carry out/organise the training
- Data on your source of funding if you are in receipt of funding and if we need to verify your identity by matching this information to your records
- Depending on the content of the event(s), additional personal data may be collected to ensure the content is appropriately presented (e.g. biographical information for application coaching)
- Dates of attendance and absence
- For online training, data about the quality of your internet connection is also collected
- If your employer requested for the event to be recorded, clips of you speaking may be recorded, along with your name
The purpose of processing is to fulfil contractual obligations. The legal basis for processing is therefore Article 6 Paragraph 1(b) GDPR.
2.3. As the contact person for a company/organization
If you are the contact person for your organization and you contact WBS (e.g. as a corporate client, partner or supplier), we collect the following data:
- Name and contact details
- Employer and, if applicable, your position in your organization
The purpose of processing is to fulfill contractual obligations. The legal basis for processing is therefore Article 6 Paragraph 1(b) GDPR.
2.4. When using our websites
When using our website purely for informational purposes, i.e. if you do not register or otherwise send us information, we only collect the data your browser transmits to our server, including any personal data that includes. When you view our website, we collect the following data, which we require for technical reasons for the proper display of our website and to ensure its stability and security:
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access status/HTTP status code
- Amount of data transmitted in each case
- Website where the request initiates
- Operating system and its interface
- Language and version of the browser software
If the data processed is personal data, the legal basis for processing is Article 6 Paragraph 1(f) GDPR. Under the above provision, our legitimate interest here is in making our website technically available and securing it.
Our websites offer you the option to subscribe to our newsletter. We use what is known as a double-opt-in procedure when you subscribe to our newsletter. This means that when you subscribe, we send a confirmation email to the email address you provided asking you to confirm that you want to subscribe. If you do not confirm your registration within 30 days, your information is automatically erased. In order to document and verify a specific newsletter subscription, we store the data transmitted when subscribing to the newsletter, including the source IP address, a time stamp and the IP address of the receiving server. We also record the activation of the confirmation link, including the source IP address, a time stamp and the IP address of the receiving server.
Once you confirm, we store your email address for the purpose of sending you the newsletter. The legal basis is Article 6 Paragraph 1 Sentence 1(a) GDPR. You may revoke your consent to the newsletter being sent and cancel the newsletter at any time. You can revoke your consent by clicking on the link provided in each newsletter email or by sending an email to firstname.lastname@example.org. Revoking your consent does not affect the legality of the processing carried out before your consent was revoked.
2.4.2. Notification of absence
Our websites www.wbstraining.de and www.wbs-schulen.de provide the option for you to send notification of absence online. The data you send in the process of notifying us of an absence is stored with your contractual data. The legal basis is Article 6 Paragraph 1(b) GDPR, i.e. the contractual relationship between you and us.
2.4.3 Comment feature on www.hallokarriere.com:
Our website www.hallokarriere.com offers a comment feature. By using this feature, in addition to your comment, we process your IP address, the name you specify and your email address. The legal basis of this is your consent, which you may revoke at any time, pursuant to Article 6 Paragraph 1(a) GDPR. There is no rigid erasure deadline for comments published there. In general, a comment is only erased if the article to which the comment refers is no longer available or if you revoke your consent to your comments being published. In addition, we reserve the right to immediately erase comments with any unlawful, offensive or abusive content. Revoking your consent does not affect the lawfulness of the processing carried out before your consent was revoked.
2.5. As an applicant for a job at WBS or as a freelance trainer
Our website www.wbs-gruppe.de gives you the option to apply for a job at WBS online. In addition to the information provided as part of the application form, we also collect information about your educational background and professional career during the application process. Any documents sent with the application (covering letter, CV, transcripts, letters of reference and other documentation) and the information those documents contain are stored. Applicants’ personal data may only be processed for the purpose of the application process if necessary to decide whether to enter into an employment relationship with us.
The legal bases for processing your application data are the provisions of the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz [BDSG]) and the German Works Constitution Act (Betriebsverfassungsgesetz [BetrVG]). Specifically, we process your data on the basis of Article 6 Paragraph 1(b) GDPR, Article 88 GDPR, Section 26 Paragraph 1 BDSG. In this case, you provide us with your data as part of a pre-contractual measure. Otherwise, we would be unable to make a decision on your application. We process what are known as special categories of personal data, in particular data related to health, to the extent necessary on the basis of Article 9 Paragraph 2 GDPR. Under EU requirements, all companies, ourselves included, are required to compare applicant data with EU terror lists on the basis of Article 6 Paragraph 1(c) GDPR. We have a legitimate interest in processing data for documentation purposes in order to mount a defense against legal claims brought under the German Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz [AGG]).
2.6. As a participant/as part of the “Refer a friend” program
If you use the “Refer a friend” program as a participant or graduate of a continuing education course at WBS Training, the terms and conditions of participation set out on the website apply. Details can be found on our website at https://www.wbstraining.de/freunde-werben/. To be able to verify compliance with the terms and conditions of participation, we need to process personal data from both you and the person to whom you have provided the referral. We only collect the data listed on the program form, which can be accessed through the above website. Mandatory information is marked with an *.
If you wish to take part in the “Refer a friend” program as a referrer, we need your first name, surname, email address, course title and WBS location. We process this data to operate the referral program, specifically to verify your eligibility to participate and to send you your reward when a referral is successful. Data is therefore processed on the basis of Article 6 Paragraph 1(b) GDPR.
If you have received a referral as part of the referral program, this means we have received your personal data (name, surname, email address) from the referrer for the purpose of contacting you and extending you an offer. In line with our terms and conditions of participation, the referrer is required to obtain your consent to data processing in advance and confirm that they have done so. Your personal data is processed on the basis of Article 6 Paragraph 1(f) GDPR. Processing, in this case, is in our legitimate interest since it is the only way to grant the reward and no conflicting interests are apparent.
If you would like to prematurely end your participation in the “Refer a friend” program, please inform us of this by sending an email to email@example.com. We then erase the data stored for the purpose of the “Refer a friend” program.
3. Data we collect from third parties
3.1. As a prospective customer or participant/student using our educational products:
Depending on whether other partners are involved in your qualification course, we collect the following data so we are able to provide our contractually agreed services (Article 6 Paragraph 1(b) GDPR):
- We obtain details regarding the status of your registration, process organization and examination results from the competent professional chamber or practice.
- We obtain your examination results from certification partners.
- We obtain details relating to the progress of your internship or practical training (e.g. progress, effort, absences) from your internship or cooperation company.
- If you receive benefits for participation, we obtain medical findings and reports from your occupational rehabilitation institution, such as Deutsche Rentenversicherung, your accident insurance provider or the rehabilitation department of the German Employment Agency and the job center for persons with disabilities, where applicable.
- If you attend an integration course or a DeuFöV (German Language Ordinance) German language course, we obtain details from the German Federal Office for Migration and Refugees (BAMF) regarding your identity, suitability and eligibility for funding. If you switch courses, we obtain the data from your previous course provider.
If you have contacted us through our partner app2Job, we obtain the data collected there about you (Article 6 Paragraph 1(f) GDPR).
It may also be necessary for personal data to be exchanged between WBS TRAINING AG, WBS TRAINING SCHULEN gGmbH and app2Job GmbH for the purpose of processing your query.
3.2. As a participant of an in-house event run by WBS AKADEMIE
In general, some of the data listed in Section 2.2. is collected by your employer, specifically your name, business contact details, your position at the company and your source of funding, where applicable.
3.3. When using our website
4. Transmission of data to third parties
We sometimes use third-party service providers to process your data. These third parties may have access to personal data, provided this is necessary to complete their tasks. In terms of contracted data processing as stipulated in Article 28 GDPR, we ensure that these providers are similarly bound by the provisions of data protection laws. If service providers are data controllers as defined by the GDPR, they are bound by a duty of confidentiality and must comply with the statutory data protection regulations. Please also take note of the privacy notices for each service provider (see Section 7). The service provider in each case is responsible for the content of third-party services, whereas we verify that their services are in compliance with the statutory requirements to a reasonable extent.
It is important to us that your data be processed within the EU/EEA. However, we may use service providers that process data outside of the EU/EEA. In these cases, we ensure that the recipient has an adequate level of data protection in place before transmitting your personal data. This means that we are able to achieve a level of data protection commensurate with EU standards through what are known as EU standard contractual clauses or an adequacy decision by the EU Commission. Specific guarantees are explained with each procedure.
4.1. As a prospective customer or participant/student using our educational products:
What data does WBS send to funding sources and other partners?
We inform your funding source regarding the progress of your participation and about any special events. Only data necessary for both parties to complete their tasks is sent (e.g. contractual documents, dates of absence, certificates of incapacity to work, certificates, participation reports, information on conduct and performance relevant to the measure’s objective or incorporation). We are bound to comply with this requirement by Sections 81, 183 and 318 SGB III. If you receive benefits for participation, interim and final reports and, where applicable, psychological fitness reports are also sent.
Only the data necessary for the course/coaching is sent to freelance trainers/coaches hired to conduct your qualification course or coaching.
You may need to register with online portals to access digital learning materials, which may require you to provide personal data. These providers have been verified in terms of their compliance with German data protection laws.
As part of quality controls conducted by outside certifiers (including DQS) or the audit service of the German Federal Employment Agency, your data is sent to the auditing organization, if applicable.
Depending on whether other partners are also involved in your qualification course, we send the data necessary for the task in question (pursuant to Article 6 Paragraph 1(b) GDPR) to the following partners, where applicable, for the purpose of executing the contract:
- Professional chambers (e.g. Chamber of Industry and Commerce (IHK), Chamber of Handicrafts (HWK))
- Certification partners (e.g. SAP, DEKRA, Microsoft, LCCI, TELC)
- Internship and cooperation companies
- If you switch to another provider, we send them all the necessary data (only applies to those attending integration courses)
- As a participant of qualification courses generally involving the use of Microsoft tools (e.g. Microsoft Cloud, Azure Dev Tools), your first name and surname are used to assign you a Microsoft email address.
- Educational authorities
- School administration offices
- State statistical offices
- German Federal Education and Training Assistance Act (BAföG) office
- For Saxony, Sächsische Aufbaubank
4.2. As a participant of an in-house event run by WBS AKADEMIE
Depending on the agreement with your employer, we send your dates of attendance and absence, results of training sessions and recordings of events to your employer, if applicable, provided this is necessary to fulfill the contract.
5. When do we erase your data?
We store your personal data as long as it is required to meet our statutory and contractual obligations.
If it is no longer necessary to store your data to meet our contractual or statutory obligations, your data will be erased unless further processing is necessary to fulfil retention obligations.
5.1. When using our websites
The data collected when you use our websites is collected solely for informational purposes and is stored for a period of six (6) months, after which it is automatically erased. For information on routine erasure and the tools used, please see the relevant paragraphs in Section 7.
5.2. As an applicant for a job at WBS or as a freelance trainer
If you do not consent to your application being stored for a longer period, your profile and your personal data will be erased automatically, normally no more than six (6) months after receiving your application.
If you have applied for a specific job vacancy and we decide we would like to keep your personal data for future job openings, we will always request your prior consent before doing so.
6. Your rights
6.1. Right to revoke consent:
If data processing is carried out on the basis of your consent, you may revoke your consent to your data being processed at any time with future effect without incurring any detrimental consequences. This does not affect the lawfulness of any data processing that was carried out before you revoked your consent. If you revoke your consent, all your data will be physically erased so that it is unrecoverable once we have received notice that you are exercising your right of revocation, provided this data is no longer required as verification of lawful processing.
Please notify us that you would like to revoke your consent by sending an email to the following address: Datenschutz@wbstraining.de
6.2. Right to object in the event of data processing on the basis of a legitimate or public interest
Under Article 21 Paragraph 1 GDPR, you have the right to lodge an objection to the processing of personal data relating to you for reasons relating to your particular situation where this is done on the basis of Article 6 Paragraph 1(e) (data processing in the public interest) or (f) (data processing to safeguard a legitimate interest) GDPR. This also applies to any profiling based on this provision. Please notify us that you would like to revoke your consent by sending an email to Datenschutz@wbstraining.de
6.3. Right to conduct direct marketing in the event of data processing:
If we process your personal data in order to engage in direct marketing, you have the right under Article 21 Paragraph 2 GDPR to lodge an objection against the processing of the personal data relating to you for the purpose of such marketing at any time. This also applies to profiling where this is connected to this kind of direct marketing.
6.4. Other rights:
You are further entitled to exercise the following rights, provided the legal requirements are met in each case:
- Right to information about your personal data stored with us in accordance with Article 15 GDPR. In particular, you are entitled to access information on the purpose of processing, categories of personal data, categories of recipients to whom personal data has been disclosed or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing and objection, the origin of your data if we did not collect this data from you directly;
- Right to rectification of incorrect or incomplete data pursuant to Article 16 GDPR;
- Right to erasure of the data we have stored on you pursuant to Article 17 GDPR unless we are required to comply with any legal or contractual retention period or other legal requirements or rights regarding further storage;
- Right to restriction of the processing of your personal data pursuant to Article 18 GDPR where the accuracy of the data is contested by you, its processing is unlawful, but you object to its erasure; the data controller no longer needs the data but you need it to assert claims, or exercise or defend claims, or you have lodged an objection against this data being processed pursuant to Article 21 GDPR;
- Right to data portability pursuant to Article 20 GDPR, i.e. the right to receive the data we have stored about you in a commonly used, machine-readable format, or to request that this data be sent to another data controller;
- Right to lodge a complaint with a supervisory authority. In general, you may contact the supervisory authority in your usual place of work or residence or in the location of our company headquarters for this purpose.
7. Information on technology used
The following web-based technology is generally used on the WBS GRUPPE’s websites. You can find out which technology is actually being used by looking at the overview of cookie consents on the website in question.
We usually send our personalised newsletter by using newsletter provider CleverReach by CleverReach GmbH & Co. KG, Mühlenstr. 43, 2618 Rastede, Germany (“CleverReach”). CleverReach is a member of the Certified Senders Alliance, which has set out its own internal guidelines for admissible email marketing.
We use CleverReach to measure and analyse the behaviour of recipients of our newsletter. This includes opening, clicking, bounce, service, unsubscribe, conversion and social sharing rates. We also embed the Google Analytics tool in the newsletter so we can analyse the correlation between the newsletter and the purchase of a product. This is done by attaching the appropriate parameters to all links in the newsletter. If you click the link, we place a small text file (cookie) on your computer. This allows us to pinpoint the newsletter as the starting point for your visit to our website. If you order a product within 14 days, this information is displayed to us.
CleverReach can embed Twitter, Facebook, LinkedIn and Xing social media buttons in the newsletter on our behalf. Clicking on one of these buttons establishes a direct connection to the button provider’s servers.
If you subscribe to the newsletter on our website hallokarriere.com, we use Mailchimp, operated by The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA (“Mailchimp”), to send your personalised newsletter. The data you provide is transmitted to a Mailchimp server in the US and stored there.
We have concluded a data processing agreement with Mailchimp, which includes the EU standard contractual clauses. This agreement serves to ensure that Mailchimp processes the data in compliance with the EU General Data Protection Regulation and to guarantee the rights of data subjects.
We use Mailchimp to measure and analyse the behaviour of recipients of our newsletter. This includes opening, clicking, bounce, service, unsubscribe and conversion rates. The analysis is also conducted by what are known as web beacons. Web beacons are pixel-sized graphics files embedded in the email. Web beacons collect information, including the IP address, browser type/version, email client and the date and time of access. They can also be used to track who opens the email and clicks and links contained in the email. User behaviour is analysed to measure the success of email campaigns and to improve Mailchimp’s products and services.
If your email client has trouble displaying or accessing the privacy notice properly, you can find it by clicking a link on the Mailchimp website. According to its own information, Mailchimp uses web bacons, cookies and tracking and targeting tools run by partners on the website to process personal data. We have no influence on this data processing.
This website uses Mouseflow, a web analytics tool operated by Mouseflow ApS, Flaesketorvet 68, 1711 Copenhagen, Denmark, to record individual visits selected at random (and only with an anonymised IP address). It generates a log of mouse movements, mouse clicks and keyboard interaction with a view to replaying individual visits to this website based on random samples, known as session replays, and to evaluate these session replays using heat maps to develop website optimisation potential. Mouseflow also hosts multiple choice surveys to record user satisfaction with the website or specific content. The conducting of these surveys and survey participation are also recorded in the cookie. The cookie generated by Mouseflow is erased after a period of 90 days.
The data recorded by Mouseflow is not personal data. In particular, Mouseflow only processes your IP address in an anonymised form. The information is stored for a period of three (3) months and is not disclosed to third parties. The data collected is stored and processed within the EU. If you do not want Mouseflow to record your data, you can object to this on any website that uses Mouseflow by visiting the following link: https://mouseflow.com/opt-out/.
- First name and surname
- Email address
- Telephone number
We use Hubspot on the basis of your consent pursuant to Article 6 Paragraph 1 Sentence 1(a) GDPR.
Date is processed in the US or Ireland.
Hubspot processes data on our behalf. We have concluded a data processing agreement with Hubspot. This agreement serves to ensure that Hubspot processes the data in compliance with the EU General Data Protection Regulation and to guarantee the rights of data subjects. Hubspot does not use customer data to contact you itself unless you arrange for this to happen or otherwise permit it. More information about data processing at Hubspot is available here: https://legal.hubspot.com/product-privacy-policy
You may revoke your consent at any time with future effect. Revoking your consent does not affect the lawfulness of the processing carried out before your consent was revoked.
7.5. Cookies and tracking – General information
When using our website, cookies are stored on the user’s device. Cookies are small text files your browser generates automatically and are stored on your device (laptop, tablet, smartphone, etc.), They provide certain information to the organisation that sets the cookies (in this case, us). Cookies do not harm your device and do not contain viruses, Trojan horses or other malware. They serve to make our online services more user-friendly and effective overall.
This website uses the following types of cookies and tracking, the scope and functionality of which are explained below:
7.5.1. Transient cookies, session cookies
These cookies are erased automatically when you close your browser. These cookies store what is known as a session ID. This allows us to assign various requests from your browser to a common session. This enables us to recognize your computer if you return to our website. Session cookies are erased when you log out or close your browser.
7.5.2. Persistent cookies
Persistent cookies are automatically erased after a given amount of time, which may differ depending on the cookie. You can erase these cookies at any time by adjusting your browser’s privacy settings.
7.5.3. Flash cookies, local shared objects
Flash cookies are set by the Adobe Flash plugin, which is installed in your browser. These objects store the necessary data, regardless of the browser you use, which means the data can be used across different browsers. They have no automatic expiry date. Depending on your browser, Flash cookies can be managed (e.g. erased) like other cookies, or they may not be visible in your browser’s cookie management system. If you do not want any Flash cookie processing to be carried out, adjust your Flash Player settings to prevent this or install a relevant add-on to your browser.
7.5.4. Web storage, DOM storage
Web storage is used to store data in your browser for the purposes listed below. There are two main types of storage: Local storage for persistent data (with no expiry date) and session storage for session data (which is erased once the browser window is closed). You can erase this data by adjusting your browser’s developer options.
7.5.5. Tracking pixels, pixel trackers
This method typically involves running a tracking script on the website, which requests a tracking pixel from the web analytics tool provider. Information for the purposes listed below is also sent and, where applicable, a cookie for the web analytics tool provider is set. If there is an existing cookie, this information is added to the information in the cookie. You can remove these cookies as explained above.
7.5.6. Further information about cookies
The necessary or essential cookies listed later in this text make allow us to store the connection status of your account and to adjust the website to tailor it to your device. For example, they enable you to have direct access to personal and protected zones on our website with a user name or data you have previously entered. The data processed by these cookies is necessary for the purposes stated in order to safeguard our legitimate interests as well as those of third parties in line with Article 6 Paragraph 1 Sentence 1(f) GDPR.
The analytical cookies listed help us to optimize our website to make it more convenient for you to use. For example, we use session cookies to recognize that you have already visited specific pages on our website. These cookies store what is known as a session ID. This allows us to assign various requests from your browser to a common session. This enables us to recognize your computer if you return to our website.
We aim to use these tracking measures to continuously optimize the design of our website to suit your needs. We also use these tracking measures to record the use of our website for statistical purposes. We also use the data to optimise advertising content. The purposes for data processing and the categories of data being processed can be found in the description of each tracking tool.
Data processing in connection with the setting of analytical, statistical or preference cookies and tracking cookies is conducted on the basis of your consent (Article 6 Paragraph 1 Sentence 1(a) GDPR). More information is available in the relevant sections covering web analytics tools in this Privacy Notice.
7.5.7. Overview of cookie consent
7.6. Google Tag Manager
This website uses the Google Tag Manager tool, operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). We use Google Tag Manager to manage the tools we use to provide information in this Privacy Notice. For details regarding these tools, please refer to the information about the specific tool.
The Tag Manager tool itself (which implements the tags) is a cookie-free domain. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If the tool is disabled on the domain or cookie level, it will remain disabled for all tracking tags implemented with Google Tag Manager.
7.7. Google Analytics
Our website uses Google Analytics, a web analytics service operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA “Google”). In this context, pseudonymised usage profiles are compiled and cookies are used. The information generated by cookies about your use of this website, such as
- browser type/version;
- operating system used;
- referrer URL (the page visited prior to visiting our website);
- hostname of the accessing computer (IP address);
- time of the server request;
is transferred to a Google server in the US and stored there. Google complies with the data protection provisions of the EU-US Privacy Shield and is registered with the US Department of Commerce’s Privacy Shield program. In addition, we have concluded a data processing agreement with Google for the use of Google Analytics. This agreement serves to ensure that Google processes the data in compliance with the EU General Data Protection Regulation and to guarantee the rights of data subjects.
This information is used to evaluate your use of this website, to compile reports on the website activities, and to perform further services linked to website and internet use for market research purposes and to tailor the design of this website.
Google may also disclose this information to third parties if this is legally required or if third parties process this data on behalf of Google. Under no circumstances will your IP address be associated with any other data held by Google. IP addresses are anonymized so that it is not possible to attribute them to individuals (known as IP masking).
You can also prevent the data generated by the cookie about your use of the website (including your IP address) from being sent to and processed by Google by downloading and installing a browser add-on, available here.
More information about data protection at Google Analytics can be found in the help section of Google Analytics, available here.
7.8. Google AdWords conversion tracking
Our website uses Google Conversion Tracking, operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”), to record the use of our website for statistical reasons and evaluate it for the purpose of optimising our products and services for you. Google AdWords sets a cookie on your computer if you are directed to our website via a Google ad.
These cookies cease to be valid after 30 days. If a user visits specific pages of the AdWords customer’s website and the cookie remains active, the cookie allows Google and the customer to recognise that the user clicked on the advertisement and was directed to this website.
The information generated by cookies about your use of this website is transferred to a Google server in the US and stored there. Google complies with the data protection provisions of the EU-US Privacy Shield and is registered with the US Department of Commerce’s Privacy Shield programme. In addition, we have concluded a data processing agreement with Google for the use of Google AdWords. This agreement serves to ensure that Google processes the data in compliance with the EU General Data Protection Regulation and to guarantee the rights of data subjects.
Each AdWords customer receives a different cookie. This means that AdWords customers’ websites cannot be used to track cookies. The information collected using the conversion cookie serves to create conversion statistics for AdWords customers that have opted to use conversion tracking. This enables us to determine the total number of users who have clicked on the ad and were directed to a website equipped with a conversion tracking tag. However, no information is received that can be used to personally identify users.
If you prefer to opt out tracking, you can simply reject the cookie required for this purpose, for example by adjusting your browser settings to disable cookies from being set automatically. You can also disable cookies for conversion tracking by visiting the website to disable Google ads.
7.9. Use of Facebook remarketing
This website uses the Custom Audiences remarketing feature offered by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). This feature allows the provider to direct targeted advertising at website visitors by placing personalised, interest-based Facebook ads tailored to visitors of the website when they visit the Facebook social network. The Facebook remarketing tag is embedded in the provider’s website to facilitate this feature.
The tag establishes a direct connection to the Facebook servers when visiting the website. In this way, information about which of our web pages you have visited is passed on to Facebook. Facebook can attribute this information to your personal Facebook user account. More detailed information about how Facebook collects and uses the data, as well as information about your rights in this regard and how you can protect your privacy can be found on Facebook’s privacy pages.
Due to the marketing tools used, your browser automatically establishes a direct connection with the Google server. We have no influence on the scope and further use of the data collected by Google by our use of this tool. As of the date this Privacy Notice was published, our knowledge is as follows: Embedding DoubleClick allows Google to receive the information you have accessed the relevant part of our website or clicked on one of our ads. If you are registered with a service hosted by Google, Google can attribute your visit to your account. Even if you are not registered with Google or are not logged in, it is possible for the provider to find out your IP address and store it.
You can prevent participation in this tracking in several ways:
- a) by adjusting your browser settings accordingly. In particular, suppressing third-party cookies means that you will not be shown any ads from third-party providers;
- b) by disabling the cookies for conversion tracking by adjusting your browser settings to block cookies from the domain “googleadservices.com”, https://adssettings.google.com. These settings are reset when you erase your cookies;
- c) by disabling interest-based ads from providers that are part of the self-governing About Ads campaign via the link https://optout.aboutads.info/. These settings are reset when you erase your cookies;
- d) by permanently disabling ad personalization when using the Firefox, Internet Explorer or Google Chrome browsers, available via the link https://support.google.com/ads/answer/7395996. However, we would point out that, in this case, you may not be able to access the full functionality of this website.
7.11. Use of social media plugins
We currently use the following social media plugins: Facebook, Google+, Twitter, Xing and WhatsApp. We use the Shariff tool developed by c’t. This means that when you visit our site, no personal data is initially disclosed to the plugin providers. Communication with social networks is done by a script stored on the server, which acts as an intermediary between the social network and the user. Users are only directly connected to Facebook, Google or Twitter when they become active. Social networks cannot collect data about users before they are active. The plugin provider is recognizable by the logo or initial shown in the box. You can communicate directly with the plugin provider by clicking the button. Only by clicking the marked field – thereby activating it – will the plugin provider receive the information that you have accessed the relevant website. In the case of Facebook, the IP address is anonymized immediately after it has been collected according to the respective providers in Germany. By activating the plugin, your personal data is transmitted to the plugin provider in question and stored there (in the case of US providers, in the US). Since the plugin provider collects data, in particular, using cookies, we recommend that you adjust your browser’s security settings to erase all cookies before clicking on the greyed-out box.
We have no influence on the data collected and any data processing procedures, nor are we aware of the full extent of data collection, the purposes of processing, or the retention periods. Furthermore, we do not have any information about the erasure of the data collected by the plugin provider.
The plugin provider stores the data collected about you as user profiles and uses them for the purposes of advertising, market research and/or to tailor the design of its website. In particular, this kind of analysis is conducted (including for users who are not logged in) for the purpose of tailoring advertising to the needs of users and to inform other social network users about your activity on our website. You have a right to object to the creation of these user profiles. To exercise this right, please contact the plugin provider in question. The plugins allow us to offer you the option to interact with social networks and other users to help us optimize our website and tailor it to the interests of our users. The legal basis for the use of these plugins is Article 6 Paragraph 1 Sentence 1(f) GDPR. The purposes mentioned above are considered legitimate as defined by this provision.
The data is disclosed regardless of whether you have an account with the plugin provider and are logged in there. If you are logged in with the plugin provider, your data we collect is directly linked to your existing account with the plugin provider. For example, if you press the activated button and link to the website, the plugin provider also stores this information in your user account and publicly shares it with your contacts. We recommend regularly logging out after using a social network. However, this is particularly recommended before activating a button since this prevents the information from being linked to your profile with the plugin provider.
More information on the purpose and extent of data collection and processing by these plugin providers is available in each plugin provider’s privacy notice as listed below. The links below also provide additional information about your rights in this regard, as well as options for adjusting your settings to protect your privacy.
Plugin provider addresses and URLs for their privacy notices:
- Facebook Inc., 1601 S California Ave, Palo Alto, California 94304, USA;
more information on data collection:
Facebook is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
- Google Inc., 1600 Amphitheater Parkway, Mountainview, California 94043, USA; https://policies.google.com/technologies/partner-sites. Google is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
- Twitter, Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA; https://twitter.com/privacy. Twitter is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
7.13. Facebook Connect
We give you the option to register and log in using your Facebook account. If you register via Facebook, Facebook will request your consent for certain data in your Facebook account to be released to us. This may include your first name, surname and email address to verify your identity and gender, as well as your general location, a link to your Facebook profile, your time zone, your date of birth, your profile picture, your “Like” details and your friends list.
Facebook collects this data and sends it to us in compliance with Facebook’s Data Policy. You can control the information we receive from Facebook by adjusting the privacy settings in your Facebook account.
This data is used to set up, provide and personalize your account. The legal basis for processing is Article 6 Paragraph 1(a), (b) and (f) GDPR.
If you register with us via Facebook, your account is automatically linked to your Facebook account and, where applicable, information relating to your activities on our websites is shared on Facebook, published on your timeline and notified to your friends.
7.14. LinkedIn Insights
Our website uses the LinkedIn Insights tag, operated by LinkedIn Co., 2029 Stierlin Court, Mountain View, CA 94943, USA (“LinkedIn”). The LinkedIn Insights tag allows us to collect information, including personal data, about visitors to our website. This enables us to track advertising effectiveness and display interest-based ads. The data collected includes the following: URL, referrer URL, IP address, device and browser properties (user agent) and a timestamp. IP addresses are stored or hosted only in an abbreviated form. If you are logged in to LinkedIn during your visit to our website, this information is also collected. The data collected is pseudonymized within seven (7) days, i.e. all personal identifiers are removed. These pseudonymized data remaining is then be erased within 180 days. In connection with the use of the LinkedIn Insights tag, data is transmitted to servers in the US. The guarantees required under the GDPR are ensured by the fact that LinkedIn has undergone Privacy Shield certification. Details about the Privacy Shield are available here: https://www.privacyshield.gov/list. The legal basis for processing is Article 6 Paragraph 1(f) GDPR. Our legitimate interest is in tailoring the design of our website to users’ needs and the opportunity to offer interest-based ads. The interests of the website visitors are sufficiently taken into account through the measures envisaged by LinkedIn, in particular prompt pseudonymization. We therefore do not assume any overriding interest that precludes our legitimate interest. You may object to your data being processed in connection with the LinkedIn Insights tag. To do so, please follow this link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out?trk=microsites-frontend_legal_cookie-policy.
7.15. Google web fonts
7.16. Call tracking
Our website uses the Corazon powered by questFon call tracking service (“Corazon”). The processing company is telequest & Internet Solutions GmbH, Liebenauer Hauptstrasse 2–6, 8041 Graz, Austria (“Telequest”).
Corazon incorporates telephone numbers on our website that enable us to further analyse the telephone behaviour of visitors to our website We retain full control over the data collected.
Provided a call is made to us, the following data is collected
- the caller’s telephone number (if displayed);
- the telephone number dialled;
- the date;
- the time;
- the duration of the call;
- browser information;
- remote user agent;
- the referrer URL.
We also link this data with the corresponding address data record (hereinafter referred to as “telephone tracking”) if possible based on the available customer data. The data collected is erased no more than six (6) months after it is collected.
We base the use of Corazon on your consent pursuant to Article 6 Paragraph 1 Sentence 1(a) GDPR.
Telequest processes the data on our behalf. We have concluded a data processing agreement with Telequest. This agreement serves to ensure that Telequest processes the data in compliance with the EU General Data Protection Regulation and to guarantee the rights of data subjects.More information is available in Telequest’s Data Protection Policy: https://www.telequest.com/datenschutz/
7.17. Twitter remarketing
This website uses the remarketing feature operated by Twitter Inc., 1355 Market St, San Francisco, California 94103, USA (“Twitter”) on the basis of your consent (Article 6 Paragraph 1(a) GDPR). Tags are used to compile pseudonymised user profiles when you visit our website. These profiles are used to display relevant ads on Twitter. Twitter receives information from your browser that our website has been accessed from your device. If you are registered with a service hosted by Twitter, Twitter can attribute your visit to your account. The information generated by the tags about your use of this website is transferred to a server in the US and stored there. Twitter has undergone Privacy Shield certification and therefore guarantees an adequate level of data protection, including in the US. Details are available here: https://www.privacyshield.gov/welcome.
More information about Twitter remarketing is available here: https://business.twitter.com/de/targeting/tailored-audiences.html.
8. Participation in competitions
WBS holds competitions from time to time. Details are available in the terms and conditions for participation for each competition. When you participate in one of our competitions, we process the data you provide. Generally, this involves an individual competition post (e.g. a comment or photo), your name and your contact details so we can hold the competition and notify you if you win. The legal basis for this is your consent pursuant to Article 6 Paragraph 1(a) GDPR. If you have separately granted us consent to do so, we will include your contact details in our newsletter mailing to keep you informed about current WBS offers and services. You may revoke your consent to your data being processed as described above at any time with future effect, free of charge, by sending a brief message to the contact details provided in Section 1. Revoking your consent does not affect the legality of the processing carried out before your consent was revoked. Beyond revocation, participant data is erased from our active systems once the competition has been completed. Winner data is archived on the basis of Article 6 Paragraph 1(c) GDPR for the duration of our legal retention obligations for reasons relating to commercial and tax law (generally ten (10) years).
9. Amendments to our Privacy Notice
WBS may need to amend this Privacy Notice from time to time. We therefore recommend that you read through this Privacy Notice at regular intervals. However, rest assured that amendments will not come into force with retroactive effect and that we will not change the way we handle data previously collected.
Updated on September 23, 2020