1. General Information

Protecting personal data is important to us. The following information explains which personal data we process when you use our website, contact us or apply for a position with our company.
Personal data means any information relating to an identified or identifiable natural person. This includes information such as a name, email address, telephone number, IP address or the content of communications.
 

2. Controller

The controller responsible for data processing on this website is:

conovum AG
Nymphenburger Straße 13
80335 Munich
Germany

Telephone: +49 89 5126629 0
Email: info@conovum.de

Data Protection Officer:
Dr. Sebastian Kraska
IITR Datenschutz GmbH
Email: email@iitr.de

3. Website Hosting

When you visit our website, our hosting provider automatically processes certain information transmitted by your browser to the server. This may include:
Your IP address, the date and time of access, the page or file requested, the referring URL, your browser type and version, your operating system, the volume of data transferred, the HTTP status code and the hostname of the accessing device.
We process this information to make the website available, maintain its stability and security, and investigate technical issues or potential misuse.
The legal basis for this processing is Article 6(1)(f) GDPR. We have a legitimate interest in providing a secure, stable and fully functioning website. Where technically necessary cookies or similar technologies are used for this purpose, they are used on the basis of Section 25(2) of the German Telecommunications Digital Services Data Protection Act, or TDDDG.
Server log files are normally deleted after 30 days. We may retain them for longer where this is necessary to investigate a security incident or to establish, exercise or defend legal claims.
Our hosting provider processes personal data on our behalf. We have entered into a data processing agreement with the provider in accordance with Article 28 GDPR.

Our hosting provider is:
united-domains GmbH
Gautinger Straße 10
82319 Starnberg
Germany

4. Contacting Us by Email or Telephone

If you contact us by email, telephone or another communication channel, we process the information you provide. This generally includes your name, contact details, the content of your enquiry and any other information you choose to share with us. We use this information to respond to your enquiry and communicate with you.
Where your enquiry relates to entering into or performing a contract, the legal basis for processing is Article 6(1)(b) GDPR. In all other cases, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to respond to enquiries appropriately and efficiently.
We delete this information once your enquiry has been fully resolved, unless we are required to retain it by law or have a legitimate interest in continuing to store it.

5. Job Applications

If you apply for a position with us, particularly by email, we process the information contained in your application. This may include your contact details, CV, certificates, qualifications, professional experience, cover letter and any other information you provide during the recruitment process.
We process this information to manage your application and decide whether to offer you employment. The legal basis is Section 26 of the German Federal Data Protection Act, or BDSG, in conjunction with Article 6(1)(b) GDPR.
If your application is unsuccessful, we will delete your application documents no later than six months after the recruitment process has ended. We may retain them for longer where this is necessary to establish, exercise or defend legal claims. We will only retain your application in a candidate pool with your express consent under Article 6(1)(a) GDPR. You may withdraw this consent at any time with effect for the future.

6. Cookies and Similar Technologies

Our website may use cookies and similar technologies. Cookies are small text files stored on your device. Similar technologies may include local storage, pixels and scripts.
We use technically necessary cookies and similar technologies to provide essential website functions, including navigation, security and language settings. These technologies are used on the basis of Section 25(2) TDDDG. Where they involve the processing of personal data, the additional legal basis is Article 6(1)(f) GDPR.
We will only use cookies or similar technologies that are not technically necessary with your consent. The legal basis is Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

7. External Media and Embedded Content

Our website may contain embedded videos or other content provided by external services. When external content is loaded, personal data may be transmitted to the relevant provider. This may include your IP address, browser information and information about how you use the content.
Where external media is not technically necessary, it will only be loaded after you have given your consent. The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG.

8. Links to External Websites and Social Media Profiles

Our website contains links to external websites and social media profiles, particularly LinkedIn. If you select one of these links, you will leave our website. Any subsequent processing of your personal data is the responsibility of the relevant external provider.
Simply visiting our website does not generally result in personal data being transferred through these links. Data is only transmitted when you actively select an external link.

9. Newsletter

If you subscribe to our newsletter, we process your email address and any additional information you choose to provide. We use a double opt in process. After registering, you will receive an email asking you to confirm your subscription.
The legal basis for processing is your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, for example by using the unsubscribe link included in every newsletter.
We will delete your information when you unsubscribe, unless we are legally required to retain it.

10. Recipients of Personal Data

Within conovum AG, access to personal data is limited to the departments and individuals who need it for the purposes described in this Privacy Policy.
We may also engage service providers to support us with services such as hosting, IT operations, maintenance, email communications and recruitment management. These service providers generally process personal data on our behalf and under a data processing agreement concluded in accordance with Article 28 GDPR.
These service providers generally process personal data on our behalf and under a data processing agreement concluded in accordance with Article 28 GDPR.

11. Transfers to Countries Outside the EEA

We only transfer personal data to countries outside the European Union or the European Economic Area where there is a valid legal basis for doing so. Depending on the circumstances, the transfer may be based on an adequacy decision issued by the European Commission, certification under the EU U.S. Data Privacy Framework, Standard Contractual Clauses approved by the European Commission or your express consent.

12. How Long We Retain Your Data

We retain personal data only for as long as necessary for the purpose for which it was collected. We may keep certain information for longer where statutory retention periods apply or where continued storage is necessary to establish, exercise or defend legal claims. Once the relevant purpose no longer applies and there are no legal obligations or legitimate interests requiring us to retain the information, it will be deleted.

13. Your Data Protection Rights

Subject to the applicable legal requirements, you have the following rights:
The right to obtain information about your personal data under Article 15 GDPR. The right to have inaccurate personal data corrected under Article 16 GDPR. The right to request the deletion of your personal data under Article 17 GDPR. The right to request the restriction of processing under Article 18 GDPR. The right to data portability under Article 20 GDPR. The right to object to certain types of processing under Article 21 GDPR.
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. Withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal.
To exercise any of these rights, please contact us at: info@conovum.de.

14. Right to Object Under Article 21 GDPR

Where we process your personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation.
If you object, we will no longer process the relevant personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing is necessary to establish, exercise or defend legal claims.

15. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

The supervisory authority expected to be responsible for conovum AG is:
Bayerisches Landesamt für Datenschutzaufsicht
Promenade 18
91522 Ansbach
Germany

16. Data Security

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and disclosure. Our website uses HTTPS encryption to protect data transmitted between your device and our website.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our website, the services we use, our technical processes or applicable legal requirements.