Privacy Policy
1. Privacy at a Glance
General Information
The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data refers to any data that can be used to personally identify you. Detailed information about the processing of your personal data can be found in the following sections of this Privacy Policy.
Data Collection on This Website
Who is responsible for data collection on this website?
marcapo GmbH is responsible for data processing on this website. You can find the contact information in the section “Information on the Data Controller.”
How do we collect your data?
Some data is collected when you provide it to us, for example, through a contact or registration form. Other data—in particular technical data such as browser type, operating system, time of page view, and IP address—is automatically processed when you use the website, to the extent necessary for the technical operation and security of the website.
To this end, we may use cookies that are technically necessary, for example, to protect our forms and to save your privacy settings.
Analytics and marketing services such as Google Analytics 4, Google Ads, and the Meta Pixel are only activated once you have given your consent through our consent management system. Details regarding the cookies used, their purposes, providers, and retention periods can be found in the privacy settings and in the respective sections of this Privacy Policy.
What do we use your data for?
We process your data, in particular, to ensure the website operates without technical errors and securely, to handle your inquiries, and—provided you have given your consent—to analyze website usage and measure the effectiveness of marketing activities.
What are your rights?
Subject to the applicable legal requirements, you have the right, in particular, to access, rectify, erase, restrict the processing of, and request the portability of your data, as well as to object to certain processing activities. You may revoke any consent you have given at any time, effective for the future. You also have the right to file a complaint with a data protection supervisory authority.
2. Hosting
We host our website's content with this provider:
Mittwald
The provider is Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp (hereinafter “Mittwald”). For details, please refer to Mittwald’s Privacy Policy:https://www.mittwald.de/datenschutz.
The use of Mittwald is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the reliable and secure provision of our website.
Data Storage in Connection with Hosting Services
Server log files are processed as part of the hosting service. These files contain, in particular, the IP address, the date and time of access, the pages accessed, the status code, the amount of data transferred, the referrer, the user agent, and the hostname.
Mittwald specifies a retention period of 60 days for access logs. According to the provider, the logs are stored in an anonymized form. Error logs may also contain the IP address of the user accessing the site and the webpage visited, and are deleted after seven days.
Data processing and backups take place in Espelkamp. Personal data is not transferred to third countries, nor is it accessed from third countries.
Order Processing
We have entered into a data processing agreement with Mittwald in accordance with Article 28 of the GDPR.
Cloudflare – Content Delivery und Websicherheit
Für die technische Bereitstellung, Performance-Optimierung und Absicherung unserer Website werden Dienste der Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA („Cloudflare“) eingesetzt.
Cloudflare stellt unter anderem ein weltweit verteiltes Content Delivery Network (CDN) sowie DNS- und Sicherheitsfunktionen bereit. Der Datenverkehr zwischen Ihrem Browser und unserer Website wird dabei über die Infrastruktur von Cloudflare geleitet. Dadurch kann Cloudflare den Datenverkehr technisch analysieren und als Schutzschicht zwischen unserer Website und potenziell schädlichem oder missbräuchlichem Datenverkehr dienen. Dies dient insbesondere der schnellen und zuverlässigen Bereitstellung unserer Website sowie dem Schutz vor DDoS-Angriffen, missbräuchlichen Zugriffen und sonstigen sicherheitsrelevanten Bedrohungen.
Hierbei können insbesondere IP-Adressen, technische Verbindungs- und Zugriffsdaten, Request- und Header-Daten, Informationen zum verwendeten Browser und Endgerät sowie Sicherheits- und Protokolldaten verarbeitet werden.
Auch die über unsere Kontakt-, Demo- und Newsletterformulare übermittelten Daten können im Rahmen der technischen Übertragung über die Infrastruktur von Cloudflare verarbeitet werden. Art und Umfang einer darüber hinausgehenden Verarbeitung richten sich nach den eingesetzten Cloudflare-Diensten und deren Konfiguration.
Je nach eingesetzten Sicherheits- und Netzwerkfunktionen kann Cloudflare technisch erforderliche Cookies oder vergleichbare Technologien einsetzen.
Die Verarbeitung erfolgt auf Grundlage von Art. 6 Abs. 1 lit. f DSGVO. Unser berechtigtes Interesse besteht in der sicheren, stabilen und leistungsfähigen Bereitstellung unserer Website sowie im Schutz unserer Systeme vor Angriffen und missbräuchlicher Nutzung.
Cloudflare wird im Rahmen der technischen Bereitstellung unserer Website als weiterer Auftragsverarbeiter eingesetzt.
Eine Verarbeitung personenbezogener Daten kann auch außerhalb der Europäischen Union beziehungsweise des Europäischen Wirtschaftsraums, insbesondere in den USA, erfolgen. Cloudflare ist nach dem EU-U.S. Data Privacy Framework zertifiziert. Darüber hinaus sieht Cloudflare in seinem Data Processing Addendum für internationale Datenübermittlungen die Standardvertragsklauseln der Europäischen Kommission sowie gegebenenfalls weitere geeignete Garantien vor.
Weitere Informationen zur Verarbeitung personenbezogener Daten durch Cloudflare finden Sie in den Datenschutzinformationen von Cloudflare https://www.cloudflare.com/privacypolicy/
3. General Information and Mandatory Disclosures
Privacy Policy
The protection of your personal data is important to us. In this Privacy Policy, we explain what personal data we process when you use our website, for what purposes this is done, on what legal basis the processing takes place, and what rights you have.
Personal data is any data that can be used to identify you directly or indirectly. Detailed information about the individual processing activities and your rights as a data subject can be found in the following sections of this Privacy Policy.
To the extent that we process your data based on your consent, you may withdraw that consent at any time with future effect. The lawfulness of the processing carried out prior to the withdrawal remains unaffected. You also have the right to file a complaint with a data protection supervisory authority.
Note Regarding the Responsible Party
The entity responsible for data processing on this website is:
marcapo GmbH
4 Bahnhofstraße
96106 Ebern
Represented by: Marc-Stephan Vogt, Thomas Ötinger, Christian Schwarzenberger
Phone: +49 9531 92200
Email:kontakt@marcapo.com
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g., names, email addresses, etc.).
Retention period
Unless a more specific retention period is stated in this Privacy Policy, we will retain your personal data until the purpose for which it was collected no longer applies. If you submit a valid request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible grounds for storing your personal data (e.g., retention periods under tax or commercial law); in the latter case, the data will be deleted once these grounds no longer apply.
General Information on the Legal Basis for Data Processing on This Website
If you have consented to the processing of your data, we process your personal data on the basis of Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, provided that special categories of data as defined in Article 9(1) of the GDPR are being processed. In the event of explicit consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Article 49(1)(a) of the GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g., via device fingerprinting), data processing is additionally based on Section 25(1) of the German Telemedia Act (TDDDG). You may withdraw your consent at any time. If your data is necessary for the performance of a contract or for the implementation of pre-contractual measures, we process your data based on Article 6(1)(b) of the GDPR. Furthermore, we process your data, to the extent that it is necessary to comply with a legal obligation, based on Article 6(1)(c) of the GDPR. Data processing may also be based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR. The applicable legal bases in each individual case are described in the following sections of this Privacy Policy.
Data Protection Officer
We have appointed a data protection officer.
THALES Attorneys at Law. Privacy Policy
Dr. Christian Szidzek & Partners
38 Kantstraße
97074 Würzburg
Phone: 0931-46599018
Email: info@thales-datenschutz.de
Data Transfer to Third Countries
Among other things, we use tools from companies based in third countries that do not provide an adequate level of data protection, as well as U.S. tools whose providers are not certified under the EU-U.S. Data Privacy Framework (DPF). When these tools are active, your personal data may be transferred to these countries and processed there. Please note that in third countries that do not provide an adequate level of data protection, a level of data protection comparable to that of the EU cannot be guaranteed. For data transfers to the U.S., the European Commission has issued an adequacy decision for U.S. companies certified under the EU-U.S. Data Privacy Framework (DPF). Personal data may be transferred to these companies based on this adequacy decision. For data transfers to recipients not certified under the DPF, the transfer is based on other appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses, provided that the relevant requirements are met. Information regarding transfers to third countries, including the data recipients, can be found in this Privacy Policy.
Recipients of Personal Data
As part of our business operations, we collaborate with various external parties. In some cases, this requires the transfer of personal data to these external parties. We only disclose personal data to external parties if this is necessary for the performance of a contract, if we are legally obligated to do so (e.g., disclosure of data to tax authorities), if we have a legitimate interest in the disclosure pursuant to Article 6(1)(f) of the GDPR, or if another legal basis permits the disclosure of data. When using data processors, we disclose personal data only on the basis of a valid data processing agreement. In the case of joint controllership, an agreement pursuant to Article 26 of the GDPR is concluded to the extent required by law.
Withdrawal of Your Consent to Data Processing
Many data processing operations are only possible with your explicit consent. You may revoke any consent you have already given at any time. The lawfulness of the data processing carried out prior to the revocation remains unaffected by the revocation.
Right to object to data collection in specific cases and to direct marketing (Art. 21 GDPR)
IF DATA PROCESSING IS BASED ON ART. 6(1)( E OR F OF THE GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR REASONS RELATING TO YOUR SPECIFIC SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. YOU CAN FIND THE SPECIFIC LEGAL BASIS ON WHICH PROCESSING IS BASED IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, assert, exercise, or defend legal claims (objection under Art. 21(1) of the GDPR).
IF YOUR PERSONAL DATA IS BEING PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING PURPOSES; THIS ALSO APPLIES TO PROFILING, TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ART. 21, PAR. 2 OF THE GDPR).
Right to File a Complaint with the Competent Regulatory Authority
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the location of the alleged violation. The right to lodge a complaint is without prejudice to any other administrative or judicial remedies. The competent authority for marcapo GmbH is the Bavarian State Office for Data Protection Supervision (BayLDA),
Promenade 18, 91522 Ansbach.
Right to Data Portability
You have the right to have data that we process automatically—based on your consent or in fulfillment of a contract—provided to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another data controller, this will be done only to the extent that it is technically feasible.
Access, Correction, and Deletion
In accordance with applicable legal provisions, you have the right at any time to receive, free of charge, information about your stored personal data, its source and recipients, and the purpose of the data processing, as well as the right to have this data corrected or deleted, if applicable. You may contact us at any time regarding this matter or any other questions you may have about personal data.
Right to Restriction of Processing
You have the right to request that the processing of your personal data be restricted. You may contact us at any time to do so. The right to restrict processing applies in the following cases:
- If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification process, you have the right to request that the processing of your personal data be restricted.
- If the processing of your personal data was or is unlawful, you may request that the processing be restricted instead of having the data erased.
- If we no longer need your personal data, but you need it to exercise, defend, or assert legal claims, you have the right to request that the processing of your personal data be restricted instead of being erased.
- If you have filed an objection under Article 21(1) of the GDPR, a balancing of your interests against ours must be conducted. Until it is determined whose interests prevail, you have the right to request that the processing of your personal data be restricted.
If you have restricted the processing of your personal data, such data—apart from its storage—may be processed only with your consent, or for the purpose of asserting, exercising, or defending legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the European Union or a Member State.
SSL or TLS encryption
This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential information, such as inquiries you send to us as the site operator. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the padlock icon in your browser’s address bar. When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.
4. Data Collection on This Website
Cookies
Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device. They can be stored either for the duration of your visit (session cookies) or for a longer period of time. Session cookies are automatically deleted at the end of your visit. Other cookies remain stored until they expire or until you delete them.
We use technically necessary cookies that are required to provide certain features and manage your privacy settings. These include, in particular:
- the fe_typo_user cookie, which protects our forms from spam. This cookie is deleted at the end of the browser session;
- The "waconcookiemanagement" cookie, which stores your selections in the consent management system. This cookie expires after 365 days.
Analytics and marketing services are activated only after you provide your consent through our consent management system. Once you have given your consent, the following cookies, in particular, may be set:
- Google Analytics 4: _ga and _ga_*, with a duration of up to 24 months;
- Google Ads and Meta Pixel: _gcl_au, _fbp, and fr, with a duration of about three months.
Technically necessary cookies may be used without consent in accordance with Section 25(2)(2) of the TDDDG, provided they are strictly necessary to provide a digital service that you have expressly requested. To the extent that personal data is processed when these cookies are used, such processing is based on Article 6(1)(f) of the GDPR, unless another legal basis applies.
For cookies and similar technologies that are not technically necessary, we obtain your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. You may revoke your consent at any time with future effect via the privacy settings.
You can also configure your browser to accept cookies only on a case-by-case basis, to reject them, or to have them automatically deleted when you close your browser. This may limit the functionality of the website. For more information about the services and technologies used, please refer to the relevant sections of this Privacy Policy.
Server Log Files
The provider of this website automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These include:
- Browser Type and Browser Version
- Operating system used
- Referrer URL
- Hostname of the connecting computer
- Time of the server request
- IP address
This data is not combined with data from other sources.
This data is collected pursuant to Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in ensuring that its website functions properly and is optimized—to this end, server log files must be collected.
Contact Form
If you submit inquiries to us via the contact form, the information you provide in the inquiry form—including the contact information you provide there—will be processed to handle your inquiry and for any follow-up questions.
Your personal data will only be disclosed to the extent necessary to process your inquiry, where there is a legal obligation to do so, or where another legal basis permits it. To the extent that we engage data processors for this purpose, the processing is carried out on the basis of a contract in accordance with Article 28 of the GDPR.
Processing is based on Article 6(1)(b) of the GDPR, provided that your inquiry relates to the implementation of precontractual measures or the performance of a contract. In all other cases, processing is based on our legitimate interest in handling incoming inquiries in accordance with Article 6(1)(f) of the GDPR.
The information you provide in the contact form will be deleted as soon as it is no longer needed to process your inquiry. Statutory retention requirements remain unaffected.
Inquiries by email or phone
If you contact us by email or phone, your inquiry—including all personal data contained therein (name, inquiry)—will be stored and processed by us for the purpose of handling your request.
Personal data processed in connection with your inquiry will only be disclosed to the extent that it is necessary to handle your request or to carry out precontractual or contractual measures, where there is a legal obligation to do so, or where another legal basis permits it. To the extent that we use processors for this purpose, the processing is carried out on the basis of a contract in accordance with Article 28 of the GDPR.
This data is processed on the basis of Article 6(1)(b) of the GDPR, provided that your inquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of inquiries directed to us (Article 6(1)(b) of the GDPR for contractual/precontractual inquiries; otherwise, Article 6(1)(f) of the GDPR); consent may be revoked at any time.
The data you send us via contact requests will remain with us until you request that we delete it, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your request has been processed). Mandatory legal provisions—in particular, statutory retention periods—remain unaffected.
5. Analytics Tools and Advertising
Consent via the Consent Management System
The analytics and marketing services described below will not be activated on our website until you have first given your consent via our consent management system. Without your consent, these services will not be loaded.
The processing of personal data is based on your consent in accordance with Article 6(1)(a) of the GDPR. To the extent that consent is required for the storage of cookies or access to information on your device, this is additionally based on Section 25(1) of the TDDDG.
You may revoke your consent at any time, effective for the future, through the privacy settings. The lawfulness of the processing carried out prior to the revocation remains unaffected.
General Information on Third-Party Services and Transfers to Third Countries
When using the services described below, personal data may be transferred to the respective providers and processed there. In this context, a transfer to recipients in countries outside the European Union or the European Economic Area—in particular to the United States—cannot be ruled out.
Where applicable, providers base data transfers to the United States on certification under the EU-U.S. Data Privacy Framework. If such certification does not apply or is insufficient, appropriate safeguards—in particular, standard contractual clauses—may be used.
For more information on data processing and any transfers to third countries, please refer to the privacy policies of the respective providers.
Google Tag Manager
We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Tag Manager is used for the technical management and triggering of website tags. In particular, it allows analytics and marketing services to be integrated. Google Tag Manager itself does not create user profiles; rather, it supports the integration and control of other services.
The data will be used only in accordance with the applicable consents.
For more information about Google's privacy practices, visit:
https://policies.google.com/privacy?hl=de
Google Analytics 4
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics 4 allows us to statistically evaluate the use of our website and analyze its reach and user interactions. The service is activated only after you give your consent.
In particular, we may process information about your use of our website, the pages you visit, the technical characteristics of the device you are using, your browser, your approximate location, and your interactions with our website. For details on the cookies we use, their retention periods, and the providers, please see the privacy settings.
For more information about data protection in Google Analytics, visit:https://support.google.com/analytics/answer/6004245?hl=de
Google Ads and Conversion Tracking
We use Google Ads and the associated conversion tracking provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
With the help of Google Ads, we can place ads on Google Search or on third-party websites. Conversion tracking allows us to determine whether users arrived at our website via a Google ad and performed specific actions there. We will only use this feature after obtaining your consent.
In particular, we may process information regarding visits to our website, advertising interactions, interactions with our content, and technical data about the device used. Details regarding the cookies we use, their retention periods, and the providers can be found in the privacy settings.
For more information about Google's privacy practices, visit:
https://policies.google.com/privacy?hl=de
Meta-pixel
We use the Meta Pixel provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
The Meta Pixel allows us to analyze user interactions on our website and to measure and optimize our advertising campaigns on Facebook and Instagram. It is used only after you have given your consent.
In particular, we may process information about your visits to our website, your usage behavior, technical data about your device, and your interactions with our content. For details on the cookies we use, their retention periods, and the providers, please see the privacy settings.
For more information about data protection at Meta, visit:
https://www.facebook.com/privacy/policy/
6. Optional newsletter sign-up via forms
On our website, you have the option to subscribe to our newsletter through various forms. You will only be subscribed if you check the box provided for this purpose.
The processing of the personal data provided in the respective form for the purpose of handling your inquiry is governed by the information regarding the contact form in Section 4 of this Privacy Policy.
The following information in Section 7, “Newsletter,” applies to the processing of your data in connection with newsletter subscription, distribution via Mailjet, newsletter analysis, and the revocation of your consent.
7. Newsletter
Newsletter Information
To subscribe to our newsletter, we need your email address. Your subscription will be confirmed via a double opt-in process.
Mailjet
We use Mailjet to send out our newsletter. The provider and our contractual partner is Mailjet GmbH, Alt-Moabit 2, 10557 Berlin.
Registration and Newsletter Distribution
When you subscribe to our newsletter, we process the personal data you provide during the newsletter sign-up process. This includes title, first name, last name, industry, and email address; the email address is a required field.
Subscription to the newsletter is voluntary. After subscribing, you will receive an email asking you to confirm your subscription (double opt-in process). The subscription, the consent given, and its confirmation are documented in order to provide proof of consent.
Personalized Newsletter Analysis
With your consent, we use Mailjet to analyze how you interact with our newsletters. In particular, the following information is processed:
- Shipping or delivery status of the newsletter,
- whether the newsletter was opened,
- whether a link was clicked,
- Number of openings,
- Number of clicks,
- Unsubscribe from the newsletter,
- Mark as spam,
- The date or time of the respective event, as well as
- the corresponding message ID.
This information can be linked to the respective newsletter recipient. We use it to analyze the distribution and usage of our newsletters and to improve their content.
So-called tracking pixels are used to track newsletter opens. Clicks on links are tracked using the click tracking feature provided by Mailjet.
Legal Basis and Right of Withdrawal
The processing of your personal data for the purpose of sending the newsletter and for the personalized analysis of opens and clicks is based on your consent in accordance with Article 6(1)(a) of the GDPR.
To the extent that information is stored on your device or retrieved from your device through newsletter tracking, this is done based on your consent in accordance with § 25(1) of the TDDDG.
You may revoke your consent at any time with future effect. To do so, you can use the unsubscribe link at the bottom of each newsletter. Unsubscribing will stop both the delivery of the newsletter and the analysis of your opening and clicking behavior for personalized purposes.
The lawfulness of the processing carried out up to the time of revocation remains unaffected by this.
Storage and Order Processing
Mailjet processes personal data on our behalf. We have entered into a data processing agreement with Mailjet GmbH in accordance with Article 28 of the GDPR.
According to Mailjet, the data used for the Mailjet service is stored in data centers within the European Union. Mailjet specifies that these are Google Cloud Platform data centers in Frankfurt, Germany, and Saint-Ghislain, Belgium.
The data processed for the purpose of sending the newsletter is generally stored for as long as you subscribe to our newsletter. Once you unsubscribe, it will no longer be used to send you further newsletters or for personalized newsletter analysis.
Data necessary to verify the granting and revocation of your consent, as well as the double opt-in process, may also be stored for as long as necessary.
For more information about Mailjet's privacy policy, visit:https://www.mailjet.com/de/rechtliches/datenschutzerklaerung/
Information on security and data protection at Mailjet:https://www.mailjet.com/de/rechtliches/sicherheit-datenschutz/
8. Plugins and Tools
Google Maps
Subject to your consent, this website uses the Google Maps service to display interactive maps and provide directions. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
Google Maps will not be activated until you have given your consent via our consent management system. No connection to Google Maps is established prior to activation. After activation, your IP address, as well as technical information about your device, your browser, and the time of your visit, may be transmitted to Google and processed by Google. We have no control over Google’s further processing of this data.
Data processing is based on your consent in accordance with Article 6(1)(a) of the GDPR. To the extent that consent is required for the use of cookies or access to information on your device, this is additionally based on Section 25(1) of the TDDDG. You may revoke your consent at any time with future effect via the privacy settings.
When using Google Maps, it cannot be ruled out that personal data may be transferred to recipients in countries outside the European Union or the European Economic Area, particularly the United States. Where necessary, Google bases such transfers on appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses. For more information on this, please visit:
- https://privacy.google.com/businesses/gdprcontrollerterms/
- https://privacy.google.com/businesses/gdprcontrollerterms/sccs/
According to the provider, Google is certified under the EU-U.S. Data Privacy Framework. For more information, visit:https://www.dataprivacyframework.gov/participant/5780
For more information on how user data is handled, please see Google's Privacy Policy:https://policies.google.com/privacy?hl=de
Kununu Badge
A widget from kununu GmbH is embedded on our website. When you visit a page that contains the widget, your browser briefly connects to kununu’s servers to provide the widget’s functionality and the review information it contains.
According to kununu, no personal data is stored in connection with the widget’s activation. In particular, kununu does not store IP addresses. According to kununu, cookies are also not used to analyze your usage behavior in connection with the widget.
For more information about data processing by kununu, please visit:
https://www.kununu.com/de/info/datenschutz
YouTube with Enhanced Privacy
This website embeds videos from YouTube. The website is provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
YouTube content will not be loaded until you have given your consent via our consent management system. No connection to YouTube's servers will be established until you have given your consent.
Once the YouTube video is played, your IP address, as well as technical information about your device, browser, and the time of access, may be transmitted to Google and processed there. YouTube or Google may use cookies or similar technologies for this purpose. We have no control over Google’s further processing of this data.
We use YouTube in enhanced privacy mode. According to YouTube, videos and ads played in enhanced privacy mode are not used for personalization. However, information may be stored in the browser’s local storage and used for recognition purposes. For more information about enhanced privacy mode, visit:https://support.google.com/youtube/answer/171780.
Processing is based on your consent in accordance with Article 6(1)(a) of the GDPR. To the extent that consent is required for the storage of cookies or access to information on your device, processing is also based on Section 25(1) of the TDDDG. You may revoke your consent at any time with future effect through the privacy settings.
For more information about data protection on YouTube, please see their Privacy Policy at:https://policies.google.com/privacy?hl=de.
According to its own statements, Google is certified under the EU-U.S. Data Privacy Framework.
ProvenExpert
Our website incorporates review content from the ProvenExpert service. The provider is Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin, Germany.
ProvenExpert content will not be loaded until you have given your consent via our consent management system. No connection to ProvenExpert's servers will be established before you give your consent.
Once activated, your IP address, as well as technical information about your device, browser, and the time of your visit, may be transmitted to ProvenExpert and processed there. ProvenExpert may use cookies or similar technologies for this purpose. We have only limited control over ProvenExpert’s further processing of this data.
Data processing is based on your consent in accordance with Article 6(1)(a) of the GDPR. To the extent that consent is required for the storage of cookies or access to information on your device, this is additionally based on Section 25(1) of the TDDDG. You may revoke your consent at any time with future effect through the privacy settings.
For more information about data processing by ProvenExpert:https://www.provenexpert.com/de-de/datenschutzbestimmungen/
9. Our Social Media Presence
General Information
We maintain corporate profiles on social media to provide information about our company, our services, career opportunities, and current topics, as well as to communicate with users.
You can find our social media pages at:
- https://www.facebook.com/marcapogmbh
- https://www.instagram.com/marcapo_gmbh/
- https://www.xing.com/pages/marcapo
- https://www.linkedin.com/company/marcapo-gmbh
- https://www.youtube.com/c/marcapo
When you visit our social media pages, personal data may be processed both by us and by the respective platform provider. We have only limited control over the data processing carried out by the platform providers. This applies in particular to processing related to registration and use of the platform, the creation of user profiles, audience measurement, advertising, as well as cookies and similar technologies. You can find more information on this in the privacy policies of the respective platform providers.
Our Processing of Data
We process data that you provide to us through our social media accounts or that becomes visible to us as part of your interaction with our accounts. This includes, in particular:
- Comments and other posts,
- Direct messages,
- Feedback on our content, as well as
- Profile information visible to the public.
Your data is processed to handle your inquiry, to communicate with you, and for corporate and public relations purposes. The legal basis for this is our legitimate interest pursuant to Article 6(1)(f) of the GDPR. To the extent that your contact with us serves to initiate or fulfill a contract, the processing is based on Article 6(1)(b) of the GDPR.
We delete data that we process ourselves in connection with our social media presence as soon as it is no longer necessary for the respective purpose and there are no legal retention requirements that prevent us from doing so.
Statistics and Insights
Some platform providers provide us with statistical analyses of the usage and reach of our social media accounts. This information is generally provided to us in aggregated form.
When creating and providing Insights features for our Facebook, Instagram, and LinkedIn pages, we share responsibility with the respective platform provider for the relevant processing operations in accordance with Article 26 of the GDPR.
The respective platform providers provide agreements or information regarding joint responsibility and the allocation of data protection obligations.
Your Privacy Rights
To the extent that there is joint liability, you may generally exercise your data protection rights with respect to both us and the respective platform provider.
If personal data is processed exclusively by the respective platform provider and we do not have access to that data, you may need to contact the platform provider directly to have your request addressed.
In addition, the rights of data subjects described in this Privacy Policy apply.
Data Processing Outside the European Union
For some platform providers, the processing of personal data may also take place outside the European Union or the European Economic Area, particularly in the United States.
To the extent that personal data is transferred to appropriately certified companies in the United States, the transfer may be based on the EU-U.S. Data Privacy Framework. If this framework does not apply, the European Commission’s Standard Contractual Clauses, in particular, may be used as appropriate safeguards for the data transfer.
For more information on international data transfers, please refer to the privacy policies of the respective platform providers.
Facebook and Instagram
We maintain company profiles on Facebook and Instagram. The service provider for users within the European Union is: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
Meta provides us with statistical information about the use of our pages and profiles for our corporate online presence. With regard to the processing of personal data in connection with the Page Insights provided by Meta, we share joint responsibility with Meta Platforms Ireland Limited in accordance with Article 26 of the GDPR.
Meta provides a joint liability agreement for this purpose:https://www.facebook.com/legal/terms/page_controller_addendum
For more information about Meta's data processing practices, please visit:
- Facebook: https://www.facebook.com/privacy/policy/
- Instagram: https://privacycenter.instagram.com/policy/
For information on how to adjust your ad settings, visit:https://www.facebook.com/settings?tab=ads
According to Meta, the company is certified under the EU-U.S. Data Privacy Framework.
We maintain a company profile on LinkedIn. The provider for users within the European Union is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland
Through “Page Insights,” LinkedIn provides us with statistical information about the use of our company profile. With regard to the processing of personal data for the purpose of generating these Page Insights, we and LinkedIn share joint responsibility in accordance with Article 26 of the GDPR.
LinkedIn provides a joint liability agreement for this purpose.
For more information about LinkedIn's privacy policy, visit:https://www.linkedin.com/legal/privacy-policy
For information on joint responsibility for Page Insights, see:https://legal.linkedin.com/pages-joint-controller-addendum
You can adjust your interest-based advertising settings here, among other places:https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
According to its own statements, LinkedIn is certified under the EU-U.S. Data Privacy Framework.
We maintain a company profile on XING. The provider is: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany
For more information on XING's processing of personal data, please visit:https://privacy.xing.com/de/datenschutzerklaerung
YouTube
We maintain a corporate channel on YouTube. The service provider for users within the European Union is: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
When you use YouTube, Google may process your personal data. This may include, in particular, information about your use of YouTube, your device, your user account, and your interactions with our channel.
For more information about Google and YouTube's processing of personal data, please visit:https://policies.google.com/privacy?hl=de
According to its own statements, Google is certified under the EU-U.S. Data Privacy Framework.
10. Communication Tools
Aircall
When you contact us by phone, we use the Aircall service provided by Aircall SAS, 11–15 rue Saint-Georges, 75009 Paris, France.
Aircall helps our employees handle phone inquiries through AI-powered features, including voicebots, automatic call transcription, the creation of call summaries, and the preparation of internal follow-up tasks.
Phone calls are not recorded as audio files. However, the conversation is transcribed in real time for processing and follow-up. Transcripts are deleted as soon as they are no longer needed for processing and follow-up regarding the matter, provided there are no legal retention requirements or reasons to assert, exercise, or defend legal claims.
Data processing is based on Article 6(1)(b) of the GDPR to the extent that it serves the purpose of taking steps prior to entering into a contract or fulfilling a contract. In all other cases, it is based on our legitimate interest under Article 6(1)(f) of the GDPR in efficiently and effectively handling telephone inquiries.
The AI features are intended solely to support our employees. Decision-making based exclusively on automated processing, as defined in Article 22 of the GDPR, does not take place.
Aircall processes personal data on our behalf based on a contract in accordance with Article 28 of the GDPR. According to the provider, personal data is not used for training or fine-tuning AI models.
To the extent that personal data is transferred to countries outside the European Union or the European Economic Area, such transfers are made in accordance with the requirements of Articles 44 et seq. of the GDPR.
Microsoft Teams – Recording, Transcription, and Copilot
We use Microsoft Teams for meetings with internal and external participants. Features such as recording, transcription, and Microsoft Copilot can be used in individual meetings. In particular, this may involve the processing of audio and video data, conversation content, chat messages, screen shares, transcripts, automatically generated summaries, notes, and follow-up actions, as well as technical metadata.
The processing is used to document and follow up on meetings, as well as to create summaries, notes, and action items. These functions are used only if the participants were informed before processing began and have given their explicit consent. The legal basis is Article 6(1)(a) of the GDPR. Consent may be revoked at any time with future effect.
Data processing takes place within our Microsoft 365 environment. Access to recordings, transcripts, and content generated from them is limited to individuals who need this information to conduct or follow up on the meeting. Microsoft processes personal data as a service provider in connection with the provision of Microsoft Teams and Microsoft 365.
Recordings, transcripts, and summaries, notes, and follow-up steps generated by Copilot are generally deleted no later than 60 days after creation. Data is retained for a longer period only if it is necessary for a specific purpose and permitted under data protection laws, or if there are statutory retention requirements.
To the extent that personal data is transferred to countries outside the European Union or the European Economic Area in connection with the provision of Microsoft Teams and Microsoft 365, such transfers are made in accordance with the applicable data protection safeguards.
No decision-making based solely on automated processing, including profiling, takes place in connection with these functions. The general information in this Privacy Policy applies to the withdrawal of your consent and your other data protection rights.
11. Podcasts
On our website, you will find links to external podcast providers such as Apple Podcasts, Spotify, Deezer, and Podigee. A connection to a podcast provider is not established until you actively click on the respective link. Until that point, no content from the respective provider is loaded via the podcast links, and to the best of our knowledge, no data is transmitted to them.
When you visit a provider’s website, personal data—in particular your IP address, technical data about your device, and, where applicable, referrer information—may be transmitted to that provider and processed there. Once you click through, the provider’s privacy policy applies. We have no control over the data processing that takes place there.
For more information, please refer to the respective privacy policies:
Apple:https://www.apple.com/de/privacy/
Deezer:https://www.deezer.com/legal/personal-datas
Podigee:https://www.podigee.com/de/ueber-uns/datenschutz/
Spotify:https://www.spotify.com/de/legal/privacy-policy/
12. Application Process
Processing of Applicant Data
When you apply for a position with us, we process the personal data you provide for the purpose of conducting the application process. This may include, in particular, the following data:
- First and last name,
- Contact information, particularly email address and phone number,
- Information about your work history and qualifications,
- Application materials such as a resume, cover letter, and transcripts,
- Salary expectations,
- profiles voluntarily provided on professional networking sites, as well as
- Additional information that you provide to us as part of your application.
The processing is carried out for the purpose of deciding whether to establish an employment relationship, based on Section 26(1) of the German Federal Data Protection Act (BDSG). If you provide us with special categories of personal data as defined in Article 9 of the GDPR, such data will be processed only to the extent that the legal requirements for doing so are met.
Access to your application data is restricted to individuals who need it to carry out the application process, in particular Human Resources staff and the employees responsible for the respective position.
Retention period
If an employment relationship is not established, we generally retain your application data for up to 90 days after the application process is completed. To the extent necessary to assert, exercise, or defend legal claims, further retention is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Statutory retention requirements remain unaffected.
Talent Pool
Your application information will only be added to our talent pool if you have expressly consented to this. In this case, we will use the information to contact you regarding suitable job openings. The legal basis for this is Article 6(1)(a) of the GDPR. You may revoke your consent at any time, effective for the future.
The data stored in the talent pool will be deleted no later than 180 days after it is added, unless you have previously withdrawn your consent or agreed to its continued storage.
Applications via Personio
We use the recruiting platform provided by Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, to conduct our hiring processes.
Personio processes the personal data provided during the application process on our behalf for the technical implementation and administration of the application process. We have entered into a data processing agreement with Personio in accordance with Article 28 of the GDPR.
marcapo GmbH is responsible for processing your application data as part of the application process.
For more information on Personio's processing of technical data, please visit:https://www.personio.de/datenschutz/
Training Quiz / Perspective
We use Perspective Software GmbH, Müggelstraße 22, 10247 Berlin, to provide our training quiz.
When using the training quiz, the following data, in particular, may be processed:
- Date and time of access,
- Referrer information,
- Interactions and choices made,
- Information entered in form fields, as well as
- any files that have been uploaded.
Your data will be processed for the purpose of providing the training quiz and processing the information you have submitted.
To the extent that the processing is based on your consent, it is carried out pursuant to Article 6(1)(a) of the GDPR.
Data Retention Period – Information Provided by the Service Provider Perspective
- Website Use: Data is deleted as soon as it is no longer needed. Session data is removed once the session ends. IP addresses in log files are deleted no later than 7 days after they are recorded.
- Cookies / Analytics: Data collected via cookies or user IDs is automatically deleted after 14 months.
- Forms / Inquiries: Data is stored for as long as necessary for the purpose of processing or until consent is withdrawn.
Perspective generally processes personal data on servers located in Europe. If subcontractors based in countries outside the European Union or the European Economic Area are engaged, the transfer of data is carried out in accordance with the requirements of Articles 44 et seq. of the GDPR.
For more information, visit:https://www.perspective.co/de/datenschutzerklaerung
WhatsApp Contact in the Application Process
On our Careers page, we provide a phone number you can use to contact our HR team via WhatsApp. A connection to WhatsApp will not be established until you actively click on the corresponding link.
To the best of our knowledge, no data is transmitted to WhatsApp via this link until you click on it. When you access WhatsApp, personal data—in particular your IP address, technical data about your device, and, where applicable, referrer information—may be transmitted to WhatsApp Ireland Limited or other relevant WhatsApp companies and processed there.
If you contact us via WhatsApp, we will process the information you provide in order to handle your inquiry regarding career and job application matters. To the extent that the communication serves to initiate an employment relationship, the processing is based on Section 26(1) of the Federal Data Protection Act (BDSG).
We have no control over WhatsApp's further processing of data. WhatsApp's Privacy Policy applies:https://www.whatsapp.com/legal/privacy-policy
13. THALES Whistleblower System
We use the THALES whistleblowing system provided by the law firm THALES Rechtsanwälte. Privacy Policy. The whistleblower system enables the submission, receipt, and investigation of reports in order to prevent and detect violations of applicable laws or company policies and/or to take follow-up action.
In particular, the following personal data may be processed, provided that the report is not submitted anonymously:
- Information identifying the whistleblower, such as first and last name, address, phone number, and email address,
- Information regarding the employment relationship,
- Information about individuals mentioned in the report, such as first and last names, gender, address, phone number, and email address, as well as
- Information about potential violations that could be used to identify individuals.
The processing of personal data is carried out, to the extent necessary to fulfill the tasks of the reporting office, on the basis of Article 6(1)(c) of the GDPR in conjunction with the HinSchG. To the extent that the whistleblower system is made available for voluntary reports beyond statutory obligations, processing may be carried out on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR.
To the extent that special categories of personal data, as defined in Article 9 of the GDPR, are processed in connection with a report, such processing shall take place only to the extent necessary for the reporting office to perform its duties and provided that the legal requirements are met. The legal basis is § 10 of the HinSchG in conjunction with Article 9(2) of the GDPR.
Records of a report are generally deleted three years after the conclusion of the proceedings. Records are retained for a longer period only to the extent that this is necessary and proportionate to comply with legal requirements.
For more information on data processing within the THALES Whistleblower System, please visit:
https://thales-datenschutz.de/kontakt/datenschutzerklaerung/
