1. Data Protection, Controller and Data Protection Officer

The following information explains how personal data is collected when you use our website. Personal data is any information that can be linked to you personally, such as your name, address, email addresses or user behaviour.

The controller responsible for processing your personal data through this website is:

BAGSIDE (hiframes® GmbH)
Romaneystr. 18
D-51063 Cologne
Email: support[at]bagside.de

You can contact our Data Protection Officer at hello[at]hiframes.de or at our postal address, marked “Data Protection Officer”.

2. Cookies

We use functional cookies to make our website easier to use and to measure its reach. These cookies store information such as your language preferences. The use of these functional cookies serves our legitimate interests. The legal basis is Article 6(1)(f) GDPR.

Cookies are small text files stored on your hard drive and automatically deleted according to your browser settings or after a specified period. Cookies cannot run programs or transmit viruses to your computer. They help make our website more user-friendly and efficient.

You can configure your browser at any time to allow or block cookies, require your confirmation before cookies are used, and delete cookies automatically at the end of a session. If you do not allow cookies, some website functions may no longer be available.

Information on tracking cookies can be found in section 5 below.

3. Notice Regarding Data Transfers to the USA

Our website includes tools provided by companies based in the USA. When these tools are active, your personal data may be transferred to the US servers of the respective companies. Please note that the USA is not a safe third country within the meaning of EU data protection law. US companies are obliged to disclose personal data to security authorities without you, as the data subject, being able to take legal action against this. It therefore cannot be ruled out that US authorities, such as intelligence agencies, may process, analyse and permanently store your data held on US servers for surveillance purposes. We have no influence over these processing activities.

4. Personal Data

(1) When you use the website purely for information, without registering or otherwise providing information to us, we collect only the personal data transmitted by your browser to our server. When you visit our website, we collect the following data, which is technically necessary to display the website and ensure its stability and security. The legal basis is Article 6(1), first sentence, point (f) GDPR:

• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred
• Website from which the request originates
• Browser
• Operating system and its interface
• Language and version of the browser software

Log file information is stored for security purposes, such as investigating misuse or fraud, for a maximum of seven days and then deleted. Data that must be retained as evidence is exempt from deletion until the relevant incident has been fully resolved. The legal basis is Article 6(1)(f) GDPR.

(2) We otherwise collect personal data only if, and to the extent that, you voluntarily provide it to us, for example when contacting us or submitting a job application. We treat this data confidentially and use it only for the original purpose for which it was provided, generally to process and handle your enquiry. As a rule, data is not disclosed to third parties unless this is legally required or permitted, you have given your consent, or an official order requires disclosure. If your enquiry concerns one of our group companies, we will forward it to that company. If you contact us by email, your email is stored in our email system. We may store your enquiry and related data in our CRM system. The contents of emails are not encrypted in storage. Our contact form uses SSL/TLS encryption during transmission, as indicated by “https” before the URL. Our mail server also supports commonly used transport encryption protocols. The legal basis is Article 6(1)(b) GDPR.

5. Data Protection for Job Applications

(1) If you apply for a position, we process the data you voluntarily provide for the purpose of conducting and administering the recruitment process. The data is received exclusively by the members of our Human Resources department involved in the recruitment process. They may forward your application to other group companies if you have applied directly to those companies or if we believe your application may be of interest to one of them. The legal basis is Article 6(1)(b) GDPR.

(2) If your application is unsuccessful, we retain your data for six months after the recruitment process has ended. This period reflects the possibility of claims under the German General Equal Treatment Act (AGG) and our legitimate interest in defending ourselves against such claims. The legal basis is Article 6(1)(f) GDPR.

(3) If you have voluntarily consented to inclusion in our applicant pool, we may agree on a different retention period with your consent. You may withdraw this consent at any time with effect for the future. The legal basis is Article 6(1)(a) GDPR.

6. Google Analytics

This website uses functions of the Google Analytics web analysis service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse visitor behaviour. The operator receives usage data such as page views, time spent on the website, operating systems used and users’ origins. Google may combine this data in a profile assigned to the respective user or device. Google Analytics uses technologies that recognise users to analyse their behaviour, such as cookies or device fingerprinting. Information collected by Google about your use of this website is generally transferred to and stored on a Google server in the USA.

This analysis tool is used on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in analysing user behaviour to optimise both the website and advertising. Where the relevant consent has been requested, such as consent to store cookies, processing is based exclusively on Article 6(1)(a) GDPR. Consent may be withdrawn at any time.

Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses. Details are available at: https://privacy.google.com/businesses/controllerterms/mccs/.

IP Anonymisation

We have enabled IP anonymisation on this website. Google therefore truncates your IP address within EU member states or other states party to the Agreement on the European Economic Area before transferring it to the USA. Only in exceptional cases is the full IP address transferred to a Google server in the USA and truncated there. On behalf of this website’s operator, Google uses this information to evaluate your use of the website, compile reports on website activity and provide other services relating to website and internet use. The IP address transmitted by your browser through Google Analytics is not combined with other Google data.

Browser Plugin

You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available at: https://tools.google.com/dlpage/gaoptout?hl=de.

Further information about how Google Analytics handles user data is available in Google’s privacy information: https://support.google.com/analytics/answer/6004245?hl=de.

Data Processing on Our Behalf

We have entered into a data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Demographics in Google Analytics

This website uses the Google Analytics demographics feature to display relevant advertisements to website visitors within Google’s advertising network. This enables reports containing information about visitors’ ages, genders and interests. The data comes from Google’s interest-based advertising and visitor data supplied by third parties. It cannot be attributed to a specific individual. You may disable this feature at any time through the advertising settings in your Google account, or generally prevent Google Analytics from collecting your data as described under “Objecting to Data Collection”.

7. Hosting with Amazon Web Services (AWS)

We host our website with AWS. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg (hereinafter “AWS”).

When you visit our website, your personal data is processed on AWS servers. Personal data may also be transferred to AWS’s parent company in the USA. Transfers to the USA are based on the EU Standard Contractual Clauses. Details are available at: https://aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum/.

Further information is available in the AWS Privacy Notice: https://aws.amazon.com/de/privacy/?nc1=f_pr.

AWS is used on the basis of Article 6(1)(f) GDPR. We have a legitimate interest in providing our website as reliably as possible. Where the relevant consent has been requested, processing is based exclusively on Article 6(1)(a) GDPR. Consent may be withdrawn at any time.

Conclusion of a Data Processing Agreement

We have entered into a data processing agreement with AWS. This agreement is required under data protection law and ensures that AWS processes our website visitors’ personal data only according to our instructions and in compliance with the GDPR.

8. Vimeo without Tracking (Do Not Track)

This website uses plugins from the Vimeo video platform. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.

When you visit a page containing a Vimeo video, a connection is established to Vimeo’s servers. The Vimeo server is informed which of our pages you visited. Vimeo also receives your IP address. However, we have configured Vimeo so that it does not track your user activity or set cookies.

Vimeo is used in the interest of presenting our online content attractively. This constitutes a legitimate interest under Article 6(1)(f) GDPR. Where the relevant consent has been requested, processing is based exclusively on Article 6(1)(a) GDPR. Consent may be withdrawn at any time.

Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses and, according to Vimeo, on “legitimate business interests”. Details are available at: https://vimeo.com/privacy.

Further information about the handling of user data is available in Vimeo’s Privacy Policy: https://vimeo.com/privacy.

9. Facebook Fan Page

We operate the Facebook fan page https://www.facebook.com/hiframes to communicate with users who use Facebook. Facebook processes data generated through the use of this page outside the EU. Facebook compensates for the resulting shortcomings through Privacy Shield certification (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active), thereby committing to comply with EU data protection standards. Facebook regularly uses personal data generated through our fan page for its own advertising, analysis and market research purposes, for example to create profiles of your interests and behaviour and show you tailored advertisements. If you are registered with Facebook, Facebook can also link your activity on our fan page directly to you. Facebook additionally provides us with various aggregated data. As a rule, this does not allow us to identify individual people. We use these Insights data to make our content more relevant to you. The legal basis is Article 6(1)(f) GDPR. Targeted and therefore effective communication with our users is our legitimate interest.

10. Your Rights

(1) Under Article 15 GDPR, you have the right at any time to obtain information about whether we process personal data concerning you. If we do, we have further obligations to provide information.

(2) You also have the right to rectification under Article 16 GDPR, erasure under Article 17 GDPR and restriction of processing under Article 18 GDPR, provided no other statutory requirements prevent this.

(3) You may withdraw consent given under Article 6(1)(a) or Article 9(2)(a) GDPR to the processing of your data at any time, without giving reasons. This does not affect the lawfulness of processing carried out before withdrawal.

(4) You also have the right to data portability under Article 20 GDPR.

(5) In addition, under Article 21 GDPR, you have the right to object to processing, particularly where processing is based on Article 6(1)(e) or (f) GDPR. When exercising this right, please explain why we should not process your personal data in the manner described. If your objection is justified, we will review the circumstances and either stop or modify the processing, or demonstrate compelling legitimate grounds for continuing it.

(6) You also have the right to lodge a complaint with your competent supervisory authority, which you can identify here: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html