1. Name and contact details of the data controller
Responsible: Arete AG, Tuxer Steig 8, 12209 Berlin, Germany
Phone +49 30 220139360
2. Collection and storage of personal data as well as the type and purpose of their use
a) When visiting the website
When you visit our website, the browser used on your terminal device automatically sends information to our website server. This information is stored for 30 days. The following information is collected without your intervention and stored until automated deletion:
- Name of the retrieved resource
- Date and time of the retrieval
- Amount of data transferred
- Message as to whether the retrieval was successful
- Description of the type of web browser used
- Operating system used
- Previously visited page (referrer)
- Your IP address
The above data is processed by us for the following purposes:
- Ensuring a smooth connection set-up of the website,
- Ensuring a comfortable use of our website,
- evaluation of system security and stability.
The legal basis for the data processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest follows from the purposes for data collection listed above.
b) Contact (email, telephone or letter)
An e-mail address is available on the website, firstname.lastname@example.org, which can be used for electronic contact. If you send us an enquiry in this way, the user’s personal data transmitted with the email will be stored; in the case of contact by letter or telephone, the user data communicated will also be stored accordingly.
The data will be stored and used exclusively for the purpose for which you have provided us with this data (e.g. processing of funding applications, maintenance of business relationships, supplier management, etc.).
The legal basis for the processing of the personal data necessary for handling the contact requests is Art. 6 para.1 p.1 lit. f GDPR (legitimate interest). The legitimate interest results from the fact that we can only carry out the action desired by the user (e.g. answering enquiries) by processing the user’s data accordingly. If the contact is aimed at concluding a contract on applying for funding, the additional legal basis for the processing is Art. 6 (1) lit. b GDPR.
If you wish to apply to us, you can send us your application by email to email@example.com. The following data may be processed in the process: Name, e-mail address, application documents (e.g. cover letter, CV, certificates).
If you apply to us via the platform of a third-party provider (third-party applicant portals), only the information you provide there will be transmitted to us. For further information, please refer to the respective data protection declarations.
If you apply to Arete, your data will be collected and processed exclusively for the purpose of your application.
The data collected from you is processed for the purpose of establishing an employment relationship (carrying out the application process, initiating an employment relationship). The legal basis for this is Art. 88 Para. 1 GDPR in conjunction with §26 Para. 1, Para. 8 S. 2 BDSG.
In the event that you have given us a declaration of consent to process your data, a further legal basis is Art. 88 para. 1 GDPR in conjunction with §26 para. 2, para. 8 p. 2 BDSG (Bundesdatenschutzgesetz).
We store your data as long as you are actively seeking a position with us, but no longer than six months after the application process has been completed. After that, we delete your data unless you have given us your consent to continue storing your data.
If your application could potentially be considered for a position with us that may arise at a later date, we will send you an email asking you to give your consent for your application data to be stored for a further six months. The data will then be stored, processed and used for the purpose of contacting you in the event of a suitable position for you. If there is still a need after the expiration of a storage period extended by your consent, we will ask you again for consent to extend the storage, processing and use. After the storage period covered by your consent has expired, your data will be deleted.
In the event of a successful application, we will retain your data for the duration of the employment relationship and delete your data after its termination and expiry of the legally prescribed retention periods. The legal basis for this is Art. 6 para. 1 lit. c GDPR.
d) Use of Matomo
e) Consent Management Tool
We use Borlabs, Rübenkamp 32, 22305 Hamburg, Germany, as our Consent Management Tool (CMT). The CMT stores the settings of the visitors selected in the CMT Borlabs in a cookie. The legal basis is, according to Art. 6 para. 1 lit. c GDPR, our legal obligation to manage the cookie settings of the users.
g) Initial assessment
If you submit your funding idea to us under “Check my idea now” for an initial assessment of eligibility, your data will be stored on European servers. If you would like the information to be deleted after 4 weeks, please let us know at firstname.lastname@example.org. The legal basis for the processing of this data is Art. 6 para. 1 lit. b GDPR.
3. Transfer of data
We do not transfer your personal data to third parties for purposes other than those listed below.
We only pass on your personal data to third parties if:
- you have given your express consent in accordance with Art. 6 Para. 1 lit. a GDPR,
- the transfer is necessary according to Art. 6 Para. 1 lit. f GDPR and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data,
- in the event that a legal obligation exists for the disclosure in accordance with Art. 6 Para. 1 lit. c GDPR, as well as
- this being legally permissible and necessary for the processing of contractual relationships with you according to Art. 6 para. 1 lit. b GDPR.
4. Data subject rights
You are entitled to the following data subject rights:
a) Right to information
You have the right to request confirmation from us as to whether personal data relating to you is being processed by us.
If such processing is taking place, you may request information from us about the following:
- The purposes for which the personal data are processed;
- the categories of personal data which are processed;
- the recipients or categories of recipients to whom the personal data relating to you have been or will be disclosed;
- the planned duration of the storage of the personal data relating to you or, if specific information on this is not possible, criteria for determining the storage period;
- the existing rights to rectification or erasure of the personal data concerning you, a right to restriction of processing by us or a right to object to such processing;
- the existing right to lodge a complaint with a supervisory authority;
- any available information about the origin of the data if the personal data is not collected from you;
- You have the right to request information on whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
Arete does not carry out automated decision-making or profiling.
b) Right to rectification
You have a right to rectification and/or completion of personal data if the processed personal data concerning you are inaccurate or incomplete. We shall carry out the rectification without delay.
c) Right to deletion
You may ask us to delete the personal data concerning you without delay. Arete is obliged to delete this data immediately if one of the following reasons applies:
- The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
- You withdraw your consent on which the processing was based pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR and there is no other legal basis for the processing.
- You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR (direct marketing).
- The personal data concerning you have been processed unlawfully.
- The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
- The personal data concerning you has been collected in relation to information society services offered pursuant to Article 8(1) of the GDPR.
Right to be forgotten
If Arete has made the personal data concerning you public and Arete is obliged to erase it pursuant to Article 17(1) of the GDPR, Arete shall, taking into account the available technology and the cost of implementation, implement reasonable measures, including those of a technical nature, to inform data controllers which process the personal data that you, as the data subject, have requested that they erase all links to or copies or replications of such personal data.
The right to deletion does not apply if processing is necessary
- For the exercise of the right to freedom of expression and information;
- for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) GDPR;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing; or
- for the assertion, exercise or defence of legal claims.
d) Right to restriction of processing
You may request the restriction of the processing of personal data concerning you under the following conditions:
- if you contest the accuracy of the personal data concerning you for a period enabling Arete to verify the accuracy of the personal data;
- the processing is unlawful and you object to the erasure of the personal data and request instead the restriction of the use of the personal data;
- Arete no longer needs the personal data for the purposes of processing, but you need them for the assertion, exercise or defence of legal claims; or
- if you have objected to the processing pursuant to Article 21 (1) GDPR and it is not yet clear whether Arete’s legitimate grounds override your grounds.
If the processing of personal data relating to you has been restricted, such data may – apart from being stored – only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State. If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by us before the restriction is lifted.
e) Right of objection
If the processing of personal data concerning you is necessary for the performance of a task carried out in the public interest (Art. 6(1)(e) GDPR) or for the protection of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object.
The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.
If the personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing.
If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.
f) Right to revoke your declaration of consent under data protection law
You have the right to revoke your declaration of consent under data protection law at any time. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
g) Right of appeal
In accordance with Art. 77 GDPR, you have the right to complain to the supervisory authority if you believe that the processing of your personal data is not lawful. The address of the supervisory authority responsible for our company is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin, Tel.: 030/13889-0, e-mail: email@example.com.
Berlin, February 2021