Legal Information

Privacy

Introduction

Whether you are a customer, a prospective customer, or a visitor to our website, we protect your privacy—it is a top priority for us when processing your data. That is why we act in accordance with the provisions of the General Data Protection Regulation (GDPR).

In the following Privacy Policy, we explain what data is processed. It applies to ITM Beratungsgesellschaft mbH—hereinafter referred to as ITM.

In addition, you will receive information about the processing of your data in accordance with applicable legal standards (Art. 13 et seq. of the GDPR). You can quickly and easily get an overview of what personal data we collect from you and how we use it. We also inform you of your rights under applicable data protection law and tell you who to contact if you have any questions.

Person responsible for data processing

ITM Beratungsgesellschaft mbH
Meitnerstraße 8
70563 Stuttgart
Phone: +49 711 45129-0
Email: info[at]itm.net

Contact details of the data protection officer

You can contact our Data Protection Officer at:
Phone: +49 711 45129-15
Email: compliance+dsb[at]itm.net

Purposes and legal bases of data processing

We process your personal data exclusively in accordance with the statutory data protection regulations, in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). This privacy policy explains what personal data we collect, how we use it and what rights you have.

Collection and storage of personal data and type and purpose of use

When visiting the website

When you visit our website, the browser used on your device automatically sends information to the server of our website. This information is temporarily stored in a so-called log file. The following information is recorded and stored until it is automatically deleted:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the retrieved file
• Website from which the access is made (referrer URL)
• Browser used and, if applicable, the operating system of your computer

We process the aforementioned data for the following purposes:

• Ensuring a smooth connection to the website
• Ensuring a comfortable use of our website
• Evaluation of system security and stability

We cannot assign this data to specific persons. This data is not merged with other data sources. The legal basis for data processing is Art. 6 para. 1 lit. f GDPR.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential information that you send to us as the website operator, our website uses SSL or TLS encryption. This ensures that data you transmit via this website cannot be read by third parties. You can recognize an encrypted connection by the “https://” in your browser’s address bar and by the padlock icon in the browser bar.

Website Hosting and Deployment

Our website is hosted by Amazon Web Services (AWS). The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. The pages are delivered via the Amazon CloudFront content delivery network; the access data mentioned above is processed by AWS in this process.

Since CloudFront uses a global network of delivery locations, processing outside the EU—particularly in the United States—cannot be ruled out. AWS is certified under the EU-U.S. Data Privacy Framework (Art. 45 of the GDPR); in addition, the EU Standard Contractual Clauses apply (Art. 46(2)(c) of the GDPR). The legal basis is Article 6(1)(f) of the GDPR; our legitimate interest lies in the secure, fast, and reliable provision of the website. For more information, see the AWS Privacy Notice.

Use of cookies and tracking technologies

Our website uses cookies, small text files that your web browser stores on your end device to make your visit to our website more convenient and to enable the use of certain functions. You have the option of preventing the storage of cookies on your computer by making the appropriate settings in your browser. However, this may limit the functionality of our website for you.

You can adjust or revoke your consent to the use of unnecessary cookies at any time via our cookie consent tool on the website. To do this, you can click on the corresponding icon at the bottom left of the website or call up the settings in the cookie banner. Alternatively, you can delete or block stored cookies in the browser settings.

The processing is based on your consent (Art. 6 para. 1 lit. a GDPR) or our legitimate interest (Art. 6 para. 1 lit. f GDPR).

We use cookies and similar technologies sparingly. Without your consent, we use only technically necessary cookies and similar technologies (Section 25(2)(2) of the TDDDG):

• CookieConsent (cookie, duration: 12 months): stores your choice from the cookie banner so we don't have to ask you again every time you visit.
• itm-lang (Local Storage, no expiration): remembers the language you selected using the language switcher. The entry is created only when you actively change the language, and it does not leave your browser.

All other technologies will only be loaded with your consent (Art. 6(1)(a) of the GDPR, § 25(1) of the TDDDG).

Cookiebot (Consent Management)

To obtain and document your consent, we use the Cookiebot consent management platform. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. When you visit our website, the provider’s script is loaded; the following data is processed in the process:

• Your consent(s) or the revocation thereof, including the date, time, and version of the consent
• a randomly generated consent ID
• the address of the page being viewed, the previously visited page, language settings, and approximate geographic information
• Your IP address, as well as information about your browser, operating system, and device

Cookiebot stores your selection in the CookieConsent cookie in your browser and maintains a consent log so that we can verify that consent has been given. End-user data is automatically deleted twelve months after registration.

The processing serves to fulfill our legal obligation to obtain and document consent (Art. 6(1)(c) in conjunction with Art. 7(1) of the GDPR), as well as our legitimate interest in managing consent in a legally compliant manner (Art. 6(1)(f) of the GDPR). The storage of the technically necessary CookieConsent cookie is based on Section 25(2)(2) of the TDDDG. For more information: https://www.cookiebot.com/de/privacy-policy/.

Analysis tools and advertising

Google Tag Manager

This website uses Google Tag Manager. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is used to centrally manage and trigger website tags. It does not set any cookies itself and does not create its own user profiles. However, when the Tag Manager loads, a connection to Google is established, during which your IP address and technical connection data, in particular, are transmitted. According to Google, the resulting standard HTTP log data is deleted within 14 days; in addition, Google may process aggregated diagnostic data related to the triggering of tags.

Google Tag Manager and the analytics tags it manages are not loaded until you have given your consent in the “Analytics” category of the cookie banner. Without this consent, no connection to Google is established. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can revoke your consent at any time by clicking the cookie icon in the lower-left corner of the page. The specific data processed by the services integrated via Tag Manager is explained in the respective sections of this Privacy Policy.

Google Analytics 4

This website uses features of the web analytics service Google Analytics 4. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables the website operator to analyze the behavior of website visitors. In doing so, the website operator receives various usage data, such as page views, time spent on the site, operating systems used, and the user’s location.

According to Google, IP addresses of users from the European Union or other signatory states to the Agreement on the European Economic Area are neither logged nor stored. The IP address is used on servers in the EU solely to derive approximate location data and is subsequently discarded.

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide the website operator with other services related to website and Internet usage.

Google Analytics 4 is not loaded until you have consented to the “Statistics” category in the cookie banner. This sets the _ga and _ga_* cookies, which are valid for up to two years. The retention period for user- and event-related data is set to 14 months in our Google Analytics account. Processing is based solely on your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); you may revoke your consent at any time by clicking the cookie icon in the lower-left corner of the page.

Google may transfer the data to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework; the EU Standard Contractual Clauses also apply. For more information: https://policies.google.com/privacy.

Plugins and tools

YouTube

Our website uses YouTube plugins to integrate and display video content. The operator of these pages is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. We use YouTube in enhanced privacy mode. The videos are not loaded until you have consented to the corresponding category in the cookie banner or have explicitly enabled the specific video. No connection to YouTube is established before that.

As soon as you play a YouTube video on this website, a connection is established with YouTube’s servers. This allows YouTube to determine which of our pages you have visited. YouTube can associate your browsing activity directly with your personal profile if you are logged into your YouTube account. You can prevent this by logging out beforehand.

In addition, after a video is started, YouTube may store various cookies on your device or use similar tracking technologies (e.g., device fingerprinting). This allows YouTube to obtain information about visitors to this website. This information is used, among other things, to collect video statistics, improve the user experience, and prevent fraud.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You may revoke your consent at any time by clicking the cookie icon in the lower-left corner of the page. Google may transfer the data to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework; the EU Standard Contractual Clauses also apply. For details on how user data is handled, please see Google’s Privacy Policy: https://policies.google.com/privacy.

Google reCAPTCHA

Our primary goal is to make our website safe and user-friendly for both you and us. To prevent automated access (e.g., by bots) and protect ourselves from spam attacks, we use Google reCAPTCHA Enterprise. This service is provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of reCAPTCHA, we can distinguish whether an input is made by a human or abusively by automated, machine processing. Various data is collected and transmitted to Google, such as the IP address, mouse movements, length of visit, browser and device properties and any Google cookies already set. This data is used exclusively to protect our website.

reCAPTCHA is not loaded until you have given your consent, either through the “Preferences” category in the cookie banner or, for the specific request, by checking the designated box in the contact form. reCAPTCHA may set the _GRECAPTCHA cookie in the process. Processing in the U.S. cannot be ruled out; Google LLC is certified under the EU-U.S. Data Privacy Framework, and the EU Standard Contractual Clauses apply in addition.

We use Google reCAPTCHA to maintain the integrity of our website, protect ourselves against automated attacks, and ensure a positive user experience for genuine visitors. The legal basis for data processing is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without reCAPTCHA, the form cannot be submitted; in that case, you can reach us by email at info[at]itm.net or by phone. For more information, visit https://cloud.google.com/recaptcha/docs/faq.

Contact us by e-mail or contact form

If you send us inquiries via the contact form or e-mail, your details, including the contact data you provide, will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions. We will not pass on this data without your consent.

The following personal data may be processed:

• Name
• E-mail address
• Company (if specified)
• Telephone number (if provided)
• Content of the message

This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para. 1 lit. f GDPR).

Applications

When you apply to us, we process your personal data in order to carry out the application process. Your application documents will be treated confidentially and will only be used for the purpose of processing your application. The processed data includes

• Master data (e.g. name, address, contact details)
• Application documents (e.g. CV, certificates, qualifications)
• Other voluntary information that you provide to us as part of your application

Your data will only be used internally and will not be passed on to third parties.

The legal basis for the processing of your application data is § 26 BDSG in conjunction with Art. 6 para. 1 lit. b GDPR. If you are not hired, your application documents will be deleted no later than six months after completion of the application process, unless you have given your consent for longer storage.

Visitors and external companies

For visitors and employees of external companies who enter our premises, we collect personal data such as

• Name
• Contact details
• Company affiliation
• Time of visit

This data is used to ensure the safety and protection of our employees and to comply with legal regulations. The legal basis for this processing is Art. 6 para. 1 lit. c GDPR (legal obligation) and our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR.

Storage period and deletion of data

Personal data is stored for as long as necessary for the respective processing purposes or as required by statutory retention obligations. Once the necessity no longer exists or the statutory retention periods have expired, the data is deleted.

Data processing for business partners, third-party companies and business contacts

What data do we process?

We collect the following personal data as part of our business relationships with customers, suppliers, service providers and other business partners:

• Surname, first name, title
• Company affiliation, position
• Business address
• Contact details (e-mail, telephone, fax)
• Contract and billing data
• Payment information (bank details, invoice details)
• Communication in the context of the business relationship (e.g. emails, inquiries, meetings, contracts)

Purpose of data processing

This data is processed for the following purposes:

• Initiation, implementation and handling of business relationships
• Processing of inquiries and contract negotiations
• Processing of orders and payments
• Compliance with legal requirements (e.g. tax retention obligations)
• Communication with business partners and third-party companies
• Improvement of our business processes

Legal basis of the processing

The processing of personal data of business partners is based on the following legal bases:

• Art. 6 para. 1 lit. b GDPR (contract initiation and fulfillment)
• Art. 6 para. 1 lit. c GDPR (legal obligations, e.g. tax retention obligations)
• Art. 6 para. 1 lit. f GDPR (legitimate interest in the maintenance of business relationships, quality assurance and security)

Storage period and deletion of business partner data

Contract-related data and personal data are stored for as long as is necessary for the respective business relationship or as long as statutory retention obligations exist. The data will be deleted once it is no longer required or statutory periods have expired.

Disclosure of business partner data

We only pass on personal data to third parties if this is necessary for the fulfillment of contractual or legal obligations or to protect legitimate interests. This includes e.g:

• Tax consultants, auditors and banks for processing payments
• Authorities and public bodies with statutory reporting obligations
• Insurance companies for liability issues

Data security for business partners

We use technical and organizational measures to protect personal data from unauthorized access, loss or misuse. This includes, among other things, access controls, encryption technologies and regular security checks. These include, among other things:

• Access restrictions and role-based authorizations
• Encryption of sensitive data
• Secure transmission technologies for electronic communication
• Regular security audits and data protection training

Your rights as a data subject

If your personal data is processed by us, you have the following rights under the GDPR:

Right to information pursuant to Art. 15 GDPR

You have the right to receive information about the personal data processed by us. This includes in particular

• Processing purposes
• Categories of data processed
• Recipients or categories of recipients to whom your data has been or will be disclosed
• Planned storage period or criteria for determining the storage period
• Your rights to rectification, erasure, restriction of processing or objection
• The existence of automated decision-making including profiling and, where applicable, meaningful information about its details
• Information on the possible transfer of personal data to third countries and the corresponding protective measures

Right to rectification pursuant to Art. 16 GDPR

If the personal data processed is incorrect or incomplete, you have the right to have your data rectified or completed without delay.

Right to erasure ("being forgotten") pursuant to Art. 17 GDPR

You can request the deletion of your personal data if:

• the data is no longer required for the original purposes,
• you have withdrawn your consent and there is no other legal basis,
• you object to the processing and there are no overriding legitimate grounds for the processing,
• the data has been processed unlawfully or
• the deletion is necessary to fulfill a legal obligation.

Right to restriction of processing pursuant to Art. 18 GDPR

You have the right to restrict the processing of your personal data if one of the following conditions is met:

• You dispute the accuracy of the data and we need time to check it.
• The processing is unlawful, but you oppose the erasure.
• We no longer need your data, but you need it to assert, exercise or defend legal claims.
• You have objected to the processing and it is not yet clear whether our legitimate interests prevail.

Right to object pursuant to Art. 21 GDPR

You have the right to object at any time to the processing of your personal data based on Art. 6 para. 1 lit. e or f GDPR, at any time. This applies in particular to direct advertising. In this case, your data will no longer be processed for these purposes.

Right to withdraw consent pursuant to Art. 7 (3) GDPR

You have the right to withdraw your consent at any time. The revocation does not affect the lawfulness of the processing prior to the revocation. You can withdraw your consent at any time by sending an e-mail to compliance+dsb[at]itm.net.

Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

In accordance with Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your place of residence, workplace or our company headquarters. The supervisory authority responsible for ITM Beratungsgesellschaft mbH is

The State Commissioner for Data Protection and Freedom of Information
P.O. Box 10 29 32
70025 Stuttgart
Phone: 0711/615541-0
Fax: 0711/615541-15
Email: Poststelle@lfdi.bwl.de

Contact Information & Compliance Inquiries

We have set up central contact points for inquiries about data protection, information security and security incidents. Please use the appropriate e-mail address to ensure faster processing.

Main contact

• Email: compliance[at]itm.net
• ITM Hotline: +49 711 45129-0
• Website & more information: www.itm.net

Further contacts:

Up-to-dateness of and changes to this privacy policy

This privacy policy is currently valid. It may become necessary to amend this privacy policy as a result of further development of our website or due to changes in legal requirements. The current privacy policy can be viewed at any time on our website.