Privacy Policy

EBK Urban Production GmbH — As of August 2024

1. Data protection information for our website

We are pleased that you are visiting our website and would like to inform you as comprehensively as possible about the associated processing of your data. When you visit our websites, personal data about you is collected. This is data that is necessary for you to use our websites or that enables us to take your settings into account. It may also include information that you provide to us yourself via the contact options offered on these pages.

We use this data to ensure the proper operation and full functionality of our website and to respond to your inquiries. Below we inform you about which data is collected on our website and for what purposes it is processed. In addition, you will receive information about your rights as well as contact details for us and our data protection officer.

2. Controller and data protection officer

This privacy policy applies to the website of:
EBK Urban Production GmbH, Groß-Berliner Damm 99, 12487 Berlin.
You can reach our data protection officer as follows: LOROP GmbH, Landgrafenstraße 16, 10787 Berlin, Jörg Hoffmann, Germany, email: datenschutz@ebk-gruppe.com.
You have the right at any time to contact our data protection officer free of charge and, if desired, confidentially, to support you in enforcing your data protection rights.

3. Purposes and legal bases of data processing, processors, transfer to third parties in third countries

We use the personal data you provide to us only for the purposes for which it is intended. The legal basis for processing your data may in particular be: your consent pursuant to Art. 6 (1) (a) GDPR, for example when you consent to the use of cookies or web analytics; the initiation and performance of a contract pursuant to Art. 6 (1) (b) GDPR, for example when you contact us via the form; or our legitimate interest pursuant to Art. 6 (1) (f) GDPR, for example in the context of public relations, securing the necessary website functionalities, IT and internet security, quality assurance, fraud prevention and the prosecution of criminal offenses.
Insofar as you have given us purpose-bound consent, you can revoke it at any time without any formal requirements. Personal data is transferred to state institutions and authorities only on the basis of mandatory national legal provisions. The persons we commission to process the data are obliged to maintain confidentiality and to process the data lawfully. In the event that your personal data is processed further for a purpose other than the original one, we will provide a corresponding notification.

For certain technical processes relating to data analysis, processing and/or storage, we use the support of external service providers (processors). Both we and the processor are obliged to comply with the technical and organizational measures pursuant to Art. 32 GDPR, and the external service provider is also obliged to maintain confidentiality. Processing is carried out exclusively on our behalf and on our instructions. Any processing of your personal data beyond this commissioned data processing is carried out only with your explicit consent or in cases ordered by law or by an authority or court. Data is transferred to third countries (countries outside the European Economic Area – EEA) only insofar as this is necessary for contract performance, required by law, you have given your consent to the data processing, or it is necessary to ensure various website functionalities. We will inform you separately about details where required by law.

4. Duration of data storage

In connection with the purely informational use of our website, we store the data that your browser transmits to our server for the period necessary to remedy malfunctions or error messages. Deletion generally takes place within 7 days of the end of the internet connection. Further deletion periods result depending on your use of the website.

If you contact us with a request via our contact options, we store the personal data collected from the time of collection. The data collected in this way is stored by us for the duration of our business relationship, which also includes the initiation and execution of a contract. In addition, we are subject to various retention and documentation obligations arising, among other things, from the German Commercial Code (HGB), the Fiscal Code (AO) or other tax law. The retention periods prescribed there are up to ten years after the end of the year in which the contractual relationship ended. Finally, the storage period is also assessed with regard to the possibility of defending against legal claims and proving compliance with data protection obligations, in accordance with the statutory limitation periods, which under Sections 195 ff. of the German Civil Code (BGB) are generally 3 years from the end of the year of origin. In the case of further deletion periods, you will be informed in the further course of this privacy policy.

5. Further data protection information

Please also note our special data protection information for applicants. Data subject rights (information for data subjects under Chapter 3 GDPR): You have the following rights — the right to information pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR, the right to data portability pursuant to Art. 20 GDPR, and the right to object to the processing of personal data pursuant to Art. 21 GDPR.
In addition, pursuant to Art. 77 GDPR, there is a right to lodge a complaint with a data protection authority. The complaint can be lodged with the data protection authority of the state in which you reside or work or in which the alleged infringement occurred. The supervisory authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

6. Functionality and presentation of the website

6.1 Cookies.

 

We use cookies. Cookies are text files that are stored on a computer system via an internet browser. Cookies contain a so-called cookie ID, a unique identifier consisting of a character string by which websites and servers can be assigned to the specific browser in which the cookie was stored. This enables the visited websites and servers to distinguish your individual browser from other browsers.

By using cookies, we can provide users of this website with more user-friendly services. A distinction must be made regarding the various purposes of cookies. Insofar as these small files are strictly necessary to display the website correctly, their use is not voluntary; the legal basis in this case is Art. 6 (1) (f) GDPR. In addition, cookies are also used on the website for the purpose of analyzing user behavior or for marketing purposes. This use only takes place if you have given us your consent in accordance with Art. 6 (1) (a) GDPR when you first access the website. You can prevent the setting of cookies at any time by means of an appropriate setting in your browser and thus permanently object to the setting of cookies. Cookies already set can be deleted at any time. If the setting of cookies is deactivated in the browser used, not all functions of our website may be fully usable.

6.2 Server log files.

 

The provider of our website automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. The following may be recorded: the browser types and versions used, the operating system used by the accessing system, the website from which an accessing system reaches our website (referrer), sub-pages accessed, the date and time of access, an IP address, the internet service provider of the accessing system, and other data and information used to avert danger in the event of attacks on our IT systems. When using this general data, we do not draw any conclusions about you. The processing is carried out within the scope of our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The anonymous server log file data is stored separately from all personal data you provide.

7. Communication

7.1 Online application form.

 

We have provided the option of online applications on the website. Data can be entered actively by the applicant into the integrated application form; documents can also be uploaded. We collect and process applicants' personal data for the purpose of processing the application procedure and for contract initiation pursuant to Art. 6 (1) (b) GDPR in conjunction with Section 26 BDSG. If an employment contract is concluded, the transmitted data is stored for the purpose of processing the employment relationship in compliance with statutory regulations. If no employment contract is concluded, the application documents are automatically deleted six months after notification of the rejection decision, unless other legitimate interests prevent deletion (for example a burden of proof in proceedings under the General Equal Treatment Act, AGG). We use an external service provider (processor) for this technical process.

7.2 Data protection information for applicants.

 

If you are interested in employment with our company, you can apply to us by email, post or via our social media channels. During the application process, you may share very personal information about yourself. We process the data you provide in your application. We process your data where this is necessary for carrying out a pre-contractual measure for the purpose of processing the application procedure pursuant to Art. 6 (1) (b) GDPR in conjunction with Section 26 BDSG. For these purposes we regularly process the following personal data: salutation/gender, address data, personal data (name, date of birth), place of residence, professional activities/current job, nationality, professional qualifications/experience, references, start/end of an employment relationship.

The data is required for the proper conduct of the selection process. If you do not provide the information, we may not be able to consider your application. There is no legal obligation to provide the data. We additionally process your data if you have given us consent pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR — for example for obtaining references from previous employers and for longer storage of your application in an applicant pool. You can revoke any consent given at any time with effect for the future. In a life-threatening emergency, we base the processing of your data on Art. 6 (1) (d) GDPR to protect your vital interests. No automated evaluation systems are used. The data we collect may also be transmitted to other recipients (internal: management and department heads; external: data processors for data-protection-compliant file destruction, IT service providers, our own legal representatives in the event of a dispute, the tax authority, tax advisors).

8. Contact and contact form

Our website contains information that enables quick electronic contact with our company as well as direct communication with us, including a general email address. We have also integrated a contact form. You may optionally provide salutation, first name, surname and telephone number. To communicate with us, it is mandatory that you provide your email address and your specific request in the message. If you contact us by email or via the contact form, the personal data you transmit is automatically stored. Such voluntarily transmitted personal data is stored for the purpose of processing or contacting you. This personal data is not passed on to third parties. The data transmission via the contact form is voluntary and takes place pursuant to Art. 6 (1) (a) GDPR. Where processing is necessary for the performance of a contract or within the scope of a pre-contractual measure, data processing takes place pursuant to Art. 6 (1) (b) GDPR. We use an external service provider (processor) for this technical process.

9. Social media (LinkedIn)

9.1 Use of social media plugins.

 

The website also integrates the social media platform LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). This platform may contain buttons and plugins that transmit data to the operator of the respective network platform as soon as the page loads, i.e. without further activity by the user. The Conference of Independent Data Protection Authorities (DSK) has pointed out that LinkedIn is obliged to obtain effective consent for data use from all visitors to the LinkedIn page. When you visit our LinkedIn page, LinkedIn collects users' personal data within the scope of its responsibility. Such data collection by LinkedIn can also occur for visitors who are not logged in or registered. Information about data collection and further processing by LinkedIn can be found in LinkedIn's privacy notices.

We assume no responsibility for the processing of personal data by LinkedIn or its transfer outside the European Union. We have no influence on the scope of, and no full access to, the data collected or your profile data. We receive anonymous statistics from LinkedIn regarding the use of the fan page (so-called Insight data), for example: followers (number of people following our page, including growth over a defined period), reach (number of people who see a specific post and number of interactions), advertisement performance (number of people who saw an ad), and demographics (average age of visitors, gender, place of residence, language). We use these statistics, from which we cannot draw conclusions about individual users, to continuously improve our online presence. We have concluded a joint controller agreement with LinkedIn pursuant to Art. 26 GDPR; accordingly, LinkedIn is the sole controller with regard to the processing of Insight data.

9.2 YouTube.

 

Our site uses the provider YouTube LLC (901 Cherry Avenue, San Bruno, CA 94066, USA, represented by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) for embedding videos. We have embedded our YouTube videos using the extended data protection mode. As a result, YouTube no longer stores information about visitors unless they watch the video. If you click on the video, your IP address is transmitted to YouTube and YouTube learns that you have watched the video. If you are logged in to YouTube, this information is also assigned to your user account (you can prevent this by logging out of YouTube before accessing the video). We have no knowledge of, and no influence on, any subsequent collection and use of your data by YouTube. Further information can be found in YouTube's privacy policy.

10. Analysis tools

Google Tag Manager. We have integrated the Google Tag Manager component on our pages, which manages website tags via an interface and triggers other tags. We point out that the triggered tags may themselves collect data, which is, however, not used by the Tag Manager. The data processing by Google takes place with your explicit consent pursuant to Art. 6 (1) (a) GDPR via the consent banner we use. The following data is processed: mouse movement, time, IP address, location, visitor behavior, browser, tracking media, website visited, time zone. The operating company is Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), represented in the EU by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). The data transfer to the USA is based on standard contractual clauses pursuant to Commission Implementing Decision (EU) 2021/914.

11. Online marketing

Google Ads conversion tracking. Our website uses Google conversion tracking for advertising via Google Ads. The data processing by Google takes place with your prior consent pursuant to Art. 6 (1) (a) GDPR; you can revoke your consent at any time. If you reach our website via a Google ad, a so-called conversion cookie is placed on your system. A conversion cookie expires after thirty days and is not used to identify you. Via the conversion cookie, it can be tracked whether certain sub-pages were accessed. Neither our company nor other Google Ads advertisers receive information that could be used to identify you. With each visit, personal data, including your IP address, is transmitted to Google and stored by Google. You can prevent the setting of cookies at any time via your browser settings or object to interest-based advertising via Google's ad settings.
Google Consent Mode v2 (CMv2), from 06.03.2024. CMv2 is a tool from Google that enables website operators to manage user consent for the use of cookies and other tracking technologies. The data processed under CMv2 is used to manage your consent decisions, provide a personalized user experience, and improve the performance of CMv2. The following data is processed: your IP address (to determine your approximate location and verify the validity of your consent), your browser type and operating system version, the URL of the website you visit, and your consent decisions. This data is stored for a period of 13 months. As the website operator, we are a customer of Google Ireland Limited; Google acts as our processor for Google Analytics. There are two integration options — Basic Mode and Advanced Mode. In Advanced Mode, so-called pings are used by Google even if all Google services are rejected in the consent banner, recording user activities (device type, user country, browser and conversion data). The legal basis is Section 25 (1) TTDDG, requiring consent for the access and transmission of this information, regardless of whether it constitutes personal data.

12. Content Management System (CMS)

We use the website builder Wix from the Israeli company Wix.com Ltd. (40 Hanamal Tel Aviv St., Tel Aviv 6350671, Israel), which also has offices in Berlin, Dublin, Vancouver and New York. By using Wix, your personal data may be collected, stored and processed. Wix offers an easy-to-use modular system that simplifies our work on the website. During your visit, various data is processed. Technical user information includes browser activity, clickstream activities, session heatmaps, and data on your device, operating system, browser, screen resolution, language and keyboard settings, internet provider and the date of the visit. In addition, personal data is collected — primarily contact data (email address or telephone number, if provided), IP address or your geographic location. Using tracking systems such as cookies, data on your behavior on our website is recorded (which sub-pages you prefer, how long you stay, when you leave, and which preferences such as language selection you have made). Wix.com may also pass on personal data to third parties (such as service providers).

Examples of cookies used by Wix include: XSRF-TOKEN (a security cookie that prevents cross-site request forgery; expires at the end of the session); _wixCIDX (enables login with corresponding data storage; expires after 3 months); AWSELB (used to distribute the load across multiple servers; expires after one hour); and AWSELBCORS (no detailed information available yet; expires after one hour). Please note that these cookies are examples and the list is not exhaustive. The data may be stored on various servers distributed worldwide, for example in the USA, Ireland, South Korea, Taiwan or Israel. Wix stores data only as long as it is necessary for the service provided. You have the right at any time to update, correct or delete your personal data, and can contact Wix's data protection department at privacy@wix.com.

13. Wix Multilingual

This website incorporates functions of the translation service Wix Multilingual. The provider is Wix.com Ltd., Yunitsman 5 St, Tel Aviv, Israel. Wix is loaded when the website is accessed, so that you can change the language from German to another language via the language icon in the header. This may establish a direct connection between your browser and the Wix server, giving Wix the information that you have visited this website with your IP address. The storage and analysis of the data is based on Art. 6 (1) (f) GDPR (legitimate interest in a multilingual presentation of the website). Further information can be found in Wix's privacy policy.

Legal basis. Our legitimate interest in using Wix is to operate a website and publish its content, and to optimize and present our online service. The corresponding legal basis is Art. 6 (1) (f) GDPR. As a further basis for data processing by recipients located in third countries (outside the EU, Iceland, Liechtenstein, Norway), or for a data transfer there, Wix uses standard contractual clauses approved by the EU Commission (Art. 46 (2) and (3) GDPR).

14. Continuous updating of our data protection information

With the entry into force of various legal changes, we hereby inform our customers, business partners, employees, applicants, website visitors and other communication partners that, in the case of a data transfer to US service providers such as Amazon, Asana, Google, Microsoft, YouTube, etc., an adequate level of data protection can now be assumed on the basis of company-specific certification and publication in the Data Privacy Framework List.