To help you keep an overview

In this privacy notice, we set out how we handle your personal data and explain your rights under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Unless otherwise stated below, the data controller is ORCA van Loon Communications GmbH (hereinafter referred to as ‘we’ or ‘us’).

Our privacy notice consists of two parts. In Part A, you will find general information on data protection at ORCA van Loon Communications GmbH and learn, amongst other things, what rights you have and where you can exercise them. Part B focuses on the various groups of data subjects and explains in detail what data we collect and process about you. In doing so, we address you in your role as:

a. Visitors to our websites;

b. Contact persons at service providers, suppliers and business partners;

c. Applicants;

d. Social media users.

A. General information

1. Our contact data

If you have any questions or suggestions regarding this information, or if you wish to exercise your rights, please direct your enquiry to

ORCA van Loon Communications GmbH

Steinhöft 5-7

20459 Hamburg

info@orcavanloon.de

+49 (0) 40 6963855 -0

2. On what basis do we process your data?

The data protection term ‘personal data’ refers to any information relating to an identified or identifiable individual. We process personal data in accordance with the relevant data protection regulations, in particular the GDPR and the BDSG. We only process data on the basis of a legal authorisation. We process personal data only with your consent (Article 6(1)(a) of the GDPR), to fulfil a contract to which you are a party, or in response to your request to take pre-contractual measures (Article 6(1)(b) of the GDPR), to comply with a legal obligation (Article 6(1)(c) of the GDPR) or where processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, provided that your interests or fundamental rights and freedoms requiring the protection of personal data do not override those interests (Article 6(1)(f) of the GDPR).

If you apply for a vacancy within our company, we will also process your personal data for the purpose of deciding whether to enter into an employment relationship (Section 26(1), first sentence, of the German Federal Data Protection Act (BDSG) or Article 6(1)(b) of the General Data Protection Regulation (GDPR)).

3. Your rights

You are in control of your data! As a data subject, you therefore have the right to exercise your data subject rights with us. Under the data protection laws applicable to you, you have the following rights:

• In accordance with Art. 15 GDPR and § 34 BDSG, you have the right to request information about whether and, if so, to what extent we process personal data about you or not.
• You have the right to request that we correct your data in accordance with Art. 16 GDPR.
• You have the right, in accordance with Art. 17 GDPR and § 35 BDSG, to request that we delete your personal data.
• You have the right, in accordance with Art. 18 GDPR, to have the processing of your personal data restricted.
• You have the right, in accordance with Art. 20 GDPR, to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.
• If you have given us a separate consent to the data processing, you can revoke this consent at any time in accordance with Art. 7 (3) GDPR. Such a revocation does not affect the lawfulness of the processing that has taken place up to the point of revocation on the basis of the consent.
• If you believe that the processing of personal data concerning you is in breach of the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.

In accordance with Art. 21 (1) GDPR, you have the right to object to processing based on the legal basis of Art. 6 (1) (e) or (f) GDPR for reasons arising from your particular situation. If we process personal data about you for the purpose of direct marketing, you can object to this processing in accordance with Art. 21 (2) and (3) GDPR.

If you exercise your rights under Articles 15 to 22 GDPR, we process the personal data transmitted for the purpose of implementing these rights and to be able to provide proof of this. We will only process data stored for the purpose of providing and preparing information for this purpose and for the purpose of data protection control and will otherwise restrict processing in accordance with Article 18 GDPR.

These processing operations are based on the legal basis of Article 6(1)(c) GDPR in conjunction with Articles 15 to 22 GDPR and Section 34(2) BDSG.

4. Where do we process your data?

As a general rule, we process your data on European servers that meet the highest security standards. In providing our services, we are supported by external service providers to whom we send your data. Some data processing operations may involve the transfer of certain personal data to third countries, i.e. countries where the GDPR is not applicable. Such a transfer is permitted if the European Commission has determined that an adequate level of data protection is provided in that third country. This applies to all transfers to countries on this list: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

In the absence of such an adequacy decision by the European Commission, personal data may only be transferred to a third country where appropriate safeguards are in place in accordance with Article 46 of the GDPR, or where one of the conditions set out in Article 49 of the GDPR is met.

In the absence of an adequacy decision and unless otherwise stated below, we use the EU Standard Data Protection Clauses as appropriate safeguards for the transfer of personal data falling within the scope of the GDPR to third countries. You have the option of receiving a copy of these EU Standard Data Protection Clauses or viewing them. To do so, please contact us at the address given under ‘Contact’.

If you consent to the transfer of personal data to third countries, the transfer will be carried out on the legal basis of Article 49(1)(a) of the GDPR.

5. To whom do we disclose your personal data, and why?

In order to provide our services and operate as a business, we engage various external organisations to which we may, in some cases, transfer personal data. Where there are further specific recipients of personal data relating to certain categories of data subjects, we will provide details of this in Part B.

• Hosting providers: We engage service providers to host our data, all of whom meet the highest security standards.
• IT service providers and SaaS providers: We use the services of various service providers who support us as data processors and help to streamline and optimise our processes.
• Advertising and marketing providers: We use advertising and marketing providers to boost our brand awareness and increase customer loyalty. To this end, campaigns are planned and rolled out, and their success is measured and analysed. These providers are generally also data processors.
• Regulatory authorities: Further disclosures may be made in order to comply with legal requirements or to respond to court orders or other similar requests from regulatory authorities.
• Other service providers: In addition, we may transfer your personal data to organisations such as postal and courier services, your bank, tax consultancy and audit firms, solicitors, debt collection agencies, and data and document destruction service providers.

6. How long do we keep your data?

Unless otherwise stated in the following information, we will only retain data for as long as is necessary to fulfil the purpose of processing or to meet our contractual or legal obligations. Such statutory retention obligations may arise, in particular, from commercial or tax law provisions. From the end of the calendar year in which the data was collected, we will retain personal data contained in our accounting records for eight or ten years, and personal data contained in commercial correspondence and contracts for six years. Furthermore, we will retain data relating to consents for which proof is required, as well as to complaints and claims, for the duration of the statutory limitation periods. We will delete data stored for marketing purposes if you object to its processing for this purpose.

7. How do we use ‘cookies’ and other tracking technologies?

We use cookies and similar technologies on our websites. We have provided further information on how we use these technologies in our cookie banners. The banners can be accessed via a cookie icon at the edge of the screen. There you will also find a list of other companies that place cookies on our websites and process data on the basis of your consent in accordance with Article 6(1)(a) of the GDPR, a list of cookies that we place, and an explanation of how you can opt out of certain types of cookies.

8. How can you contact our Data Protection Officer?

You can contact our Data Protection Officer using the following contact details:

Email datenschutzbeauftragter@orcavanloon.de

Herting Oberbeck Datenschutz GmbH

B. Specific section – How and why we process your data

a. Visitors to our websites

1. We process pseudonymous information about the device and browser you are using, server log files, your network connection and your IP address for the following purposes: Purposes:
   – Ensuring the security, operability and stability of our websites, including defending against attacks.

Legal basis: Legitimate interest under Article 6(1)(f) of the GDPR in ensuring the website functions properly and remains stable.

2) We process information about your behaviour on the website. This includes your IP address and user IDs, some of which are assigned by third-party providers, and is carried out for the following Purposes:

• Measuring reach and analysing visitor behaviour to optimise our websites, improve customer satisfaction and analyse errors;
• Integration of third-party content.

Legal basis: Consent pursuant to Article 6(1)(a) of the GDPR, which we obtain via the consent banners on our websites and which you can withdraw or amend at any time via the cookie icon at the edge of the screen.

b. Contact persons at service providers, suppliers and business partners

We process the data you provide to us about yourself and the company you work for, such as your name, email address and telephone number, for the following purposes:

• To fulfil the contract with the company you work for (this includes contract management, documentation relating to ongoing collaboration, invoicing and communication).

Legal basis: Legitimate interest pursuant to Article 6(1)(f) of the GDPR in the performance of the contract between the company you work for and us.

c. Applicants

Data that you provide to us as part of your application, or that a recruitment agency passes on to us on your behalf. This includes details from your CV, your career history to date, and other data that we use for the following Purposes purposes:

• Determining whether employment is a possibility;
• Initiation of an employment relationship.

Legal basis: Pre-contractual processing pursuant to Article 6(1)(b) of the GDPR and Section 26(1), first sentence, of the BDSG.

• To comply with statutory retention obligations or to defend against legal claims.

Legal basis: Compliance with legal obligations under Article 6(1)(c) of the GDPR.

• Inclusion in our talent pool so that we can contact you again at a later date if no employment relationship is established for the time being.

Legal basis: Consent pursuant to Article 6(1)(a) of the GDPR, which you may withdraw at any time by contacting us using the contact details provided above.

Should we be unable to offer you a position, we will retain the application documents you have submitted for up to six months following any rejection, for the purpose of answering any queries relating to your application and the rejection. This does not apply if statutory provisions prevent deletion, if further storage is necessary for the purposes of providing evidence, or if you have expressly consented to longer-term storage.

d. Social media users

1) Liability of social media providers

When you visit our social media pages (Instagram, LinkedIn, XING), where we showcase our company, certain information about you as a visitor is processed.

Further information:

Instagram:

• Privacy Policyof Meta Platforms Ireland Limited
• Opt-out option

LinkedIn: Privacy Policy by LinkedIn Ireland Unlimited Company

XING: Privacy Policy by New Work SE

2) Joint responsibility of the social media providers and ORCA van Loon Communications GmbH (joint controllers)

Social media providers collect and process event data and send us anonymised statistics and data for our pages, which help us to gain insights into the various activities that visitors carry out on our site (known as ‘Page Insights’). These Page Insights are generated on the basis of certain information about people who have visited our site(s).

Further information:

Instagram:

• Joint Controller Agreement
• Data subjects may also assert their rights against Meta. Further information on this can be found in the Privacy Policy.

LinkedIn:

• Joint Controller Agreement
• Data subjects can exercise their rights via this Contact formform on LinkedIn can be used to submit a request. You can contact LinkedIn’s Data Protection Officer via this link
• LinkedIn and we have agreed that the Irish Data Protection Commission is the competent supervisory authority responsible for overseeing the processing of Page Insights. You may lodge your complaint with the Irish Data Protection Commission (see data protection.ie)or submit it to another supervisory authority.

XING:

• Joint Controller Agreement
• You can find information on how to exercise your data subject rights with New Work SE here.

3) Under the responsibility of ORCA van Loon Communications GmbH

We process information that you have provided to us via our social media channels on the relevant social media platform. This information may include the name you use, your contact details or a message you have sent to us.

Legal basis: Legitimate interest under Article 6(1)(f) of the GDPR in communicating with prospective customers and followers.