Privacy

1. Who is responsible for data processing and who can I contact?

Libergy GmbH
Kurfürstendamm 26A
10719 Berlin
Germany
info@libergy.eu

2. Which sources and data do we use?

We process personal data that we receive from you in the course of your use of our Website and, where applicable, our business relationship.

If you use the Website for information only — i.e. if you do not register or otherwise send us information — we collect only the personal data that your browser transmits to our servers. When you access our Website we collect the following access data, which we need for technical reasons in order to display the Website and to ensure its stability and security. Access data include IP address, date and time of the request, time-zone difference from Greenwich Mean Time (GMT), content of the request (i.e. the name of the specific page accessed), access status/HTTP status code, amount of data transferred, referrer URL (previously visited page), operating system and its interface, language and version as well as the type of browser software, and a message about successful access.

If you contact us via a contact form or email, we also receive your personal data. Personal data here include, for example, name, address, email address and, where applicable, the text you send us as a message (hereinafter “contact data”).

In addition, customers may enter and submit business data when using the tools on our Website. This business data may include fleet details such as the number of vehicles, vehicle types, fuel types, average mileage and other relevant information required to provide the respective service or calculation (hereinafter “customer data”). These data may be transmitted to us in order to provide the requested information or services.

3. For what purposes do we process your data and on what legal basis?

We process personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) for the following purposes and on the following legal bases:

4. Who receives my data?

Within our company, those departments that need your data to fulfil our contractual and legal obligations have access to them. We disclose user data to third parties only where this is necessary, for example on the basis of Art. 6(1) lit. f GDPR for contractual purposes, in order to ensure economic and effective operation of our business. To handle your enquiry, data may therefore be passed on to our affiliated companies insofar as this is necessary to answer your request. In the case of purely informational use of the Website we generally do not disclose data to third parties. Processors engaged by us (Art. 28 GDPR) may also receive data for the purposes stated above. These are companies in the categories of IT services, hosting providers, logistics, printing services, consulting and sales and marketing. Where we disclose data to our service providers, they may use the data solely to perform their tasks. The service providers have been carefully selected and commissioned by us. They are contractually bound to our instructions, have appropriate technical and organisational measures to safeguard the rights of data subjects, ensure an adequate level of data protection and are carefully monitored by us.

5. How long are my data stored?

Log-file information is stored for security reasons (e.g. to investigate abuse or fraud) for a maximum of 60 days and then deleted (see section 2 above). Data whose further retention is required for evidential purposes are exempt from deletion until the incident in question has been finally clarified. Where necessary, we process and store your personal data for the duration of our business relationship, which also includes the initiation of a contract via the contact form or by email. In the event of a rejection, applicant data are deleted after 6 months. If you have consented to further storage of your personal data, we include your data in our applicant pool. There the data are deleted when you withdraw your consent or after 5 years at the latest. If we fill the advertised position with you, your data are stored in our HR administration system. In addition we are subject to various retention and documentation obligations arising, among other things, from the German Commercial Code (HGB) and the Fiscal Code (AO). The retention or documentation periods specified there are two to ten years. Finally, the storage period is also determined by the statutory limitation periods, which under §§ 195 et seq. of the German Civil Code (BGB) are generally 3 years, but in certain cases can be up to thirty years, the regular limitation period being three years. If you exercise your data-subject rights, we store the information provided to you in that regard until the statutory limitation period expires pursuant to § 31(2) no. 1 OWiG, § 41(1) BDSG, Art. 83(5) lit. b GDPR, for 3 years. This period may be extended if the statutory limitation period is interrupted (e.g. in the context of enquiries by supervisory authorities). Customer data entered into our tools are stored for as long as is necessary to provide the requested services and to improve our offerings. As a rule these data are stored for a period of up to 2 years after the last interaction, unless further storage is required by law or for evidential purposes. Once the purpose of the processing has been fulfilled, the customer data are deleted unless further storage is required by law or for evidential purposes.

6. Are data transferred to a third country or an international organisation?

The data provided are processed within the European Union and in the USA. For countries without an adequacy decision of the Commission under Article 45 GDPR, as is the case for the USA, we generally agree EU standard contractual clauses with the recipients of your data or obtain your consent for the transfer. Note: The protection of personal data in the USA does not correspond to the level of data protection required in the EU. In particular, there is a lack of enforceable rights that ensure the protection of your data against access by public authorities. There is therefore a risk that these public authorities may access the personal data without the data exporter or the recipient being able to effectively prevent this.

7. What data-protection rights do I have?

Every data subject has the right to

• Access pursuant to Art. 15 GDPR.
• Rectification pursuant to Art. 16 GDPR (i.e. if your personal data are inaccurate or incomplete, you may request that they be corrected),
• Erasure pursuant to Art. 17 GDPR, and restriction of processing pursuant to Art. 18 GDPR (i.e. you may have the right to request erasure or restriction of the processing of your personal data if, for example, there is no longer a legitimate business purpose for such processing and statutory retention obligations do not require further storage),
• Data portability pursuant to Art. 20 GDPR (i.e. you may have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance).

You may also withdraw consents at any time — in principle with effect for the future.

In addition there is a right to lodge a complaint with a data-protection supervisory authority (Article 77 GDPR in conjunction with § 19 BDSG). You can find the supervisory authority responsible for you under this link.

We also draw your attention to your right to object under Art. 21 GDPR: You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Article 6(1) sentence 1 lit. e) GDPR (processing in the public interest) and Article 6(1) sentence 1 lit. f) GDPR (processing on the basis of a balancing of interests); this also applies to profiling based on those provisions within the meaning of Article 4 no. 4 GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. In individual cases we process your personal data in order to conduct direct marketing. You have the right to object at any time to processing of personal data concerning you for the purpose of such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct-marketing purposes, we will no longer process your personal data for these purposes. The objection can be made informally and incurs no costs other than the transmission costs at basic rates. If you wish to exercise your right to object, an informal notice, for example to the contact details stated above, is sufficient. — Information on your right to object under Art. 21 GDPR

8. To what extent is there automated decision-making in individual cases, including profiling?

When you visit our Website or contact us by form or email we generally do not use fully automated decision-making pursuant to Article 22 GDPR. Should we use these procedures in individual cases, we will inform you of this separately insofar as this is required by law. We do not process your data automatically with the aim of evaluating certain personal aspects (profiling).

9. Am I obliged to provide data?

In the context of our Website you must provide those personal data that are required for technical or IT-security reasons in order to use the Website. If you do not provide these data, you cannot use our Website. When contacting us by form or email you need only provide those personal data that are required to handle your request. Otherwise we cannot process your request.

10. Application management

We process the data you send us in connection with your application in order to assess your suitability for the position or, where applicable, other open positions in our company and to conduct the application process. In the course of your application you need only provide those personal data that are required for an application (cover letter, CV, certificates, etc.). If you do not provide us with these data, we cannot process your application. The legal basis for processing your personal data in this application process is § 26 BDSG. Accordingly, processing of the data required in connection with the decision on whether to establish an employment relationship is permitted. Should the data be required after the application process has ended for the purpose of pursuing legal claims, processing may take place on the basis of Art. 6 GDPR, in particular to protect legitimate interests pursuant to Art. 6(1) lit. f GDPR. Our interest then consists in the assertion or defence of claims. After receipt, your application data are reviewed by HR. Suitable applications are then forwarded internally to the specialist department responsible for the respective vacancy. That department then decides on the next steps. In principle, only those persons in the company who need the data for the proper conduct of our application process have access to your data.

11. Cookies

We may use cookies on our Website. Cookies are small text files, usually consisting of letters and numbers, that are stored on the user’s computer when certain websites are visited. Some of these cookies are essential for the functioning of our Website, while other cookies help us improve our Website by providing insights into how you use it. By default we use only necessary cookies. Necessary cookies enable the core functionality of our Website. Without these cookies the Website cannot be displayed correctly and individual areas may not work properly. Necessary cookies can only be prevented through the corresponding settings in your browser. Cookies that are not required for the functioning of the Website (“non-essential cookies”) are used only if you have given your consent via our cookie banner. You can return to our privacy notice at any time and withdraw your consent or make changes. Alternatively you can individually prohibit the storage of cookies via your browser settings (you can find out how to configure cookie handling on the browser’s help page). Help on cookie management in the most common browsers can be found at the following addresses:

• Mozilla Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox
• Internet Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies
• Google Chrome: https://support.google.com/accounts/answer/61416
• Opera: https://help.opera.com/en/latest/web-preferences/
• Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac

12. Processing of personal data when using external online services

Google Maps

On this Website we may use Google Maps from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The legal basis for the use of Google Maps is your consent pursuant to Art. 6(1) sentence 1 lit. a) and Art. 49(1) sentence 1 lit. a GDPR. This allows us to display interactive maps directly on the Website and enables you to use the map function conveniently. Google Maps is embedded in such a way that data about you as a user are transmitted to Google only when you activate Google Maps by clicking. We have no influence over the data transmission to Google that then takes place. By visiting the Website, Google receives the information that you have accessed the corresponding subpage of our Website as well as the date and time of the visit to the page in question and the IP address. This occurs regardless of whether you are logged in to Google. If you are logged in, however, your data are associated with your account. If you do not wish this association with your Google profile, you must log out before activating a map. If you are logged in to Google, Google may store your data as usage profiles and use them for the purposes of providing the services, maintaining and improving the services, measuring performance, developing new services and providing personalised services, including content and advertising. This processing then takes place on the basis of the terms of use concluded between you and Google in the context of your Google account. The data are also processed in the USA in the context of this service. The information generated by the cookies about your use of our Website is generally transmitted to a Google server in the USA and stored there. Processing your data in the USA involves corresponding risks. By giving your consent via our cookie banner you consent to the processing of your data in the USA despite possible access by US authorities, Art. 49(1) sentence 1 lit. a GDPR. Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in Google’s privacy notices. There you will also find further information on your rights in this regard and settings to protect your privacy: https://policies.google.com/technologies/partner-sites and an opt-out for personalised advertising is available at https://www.google.com/settings/ads/

Google Fonts

On this Website we may use Google Fonts, i.e. external fonts from Google Ireland Limited (register number: 368047), Gordon House, Barrow Street, Dublin 4, Ireland, https://www.google.com/fonts. The Google Fonts are installed locally. No connection to Google servers takes place. Google’s privacy notices can be found at https://policies.google.com/privacy.

13. Social media

You will find us with presences on social networks and platforms so that we can communicate with you there and inform you about our services. We point out that your data may be processed outside the European Union and that the data are generally processed for market-research and advertising purposes. Usage profiles can be created from users’ behaviour and the interests derived from it. These usage profiles can in turn be used to display advertisements within and outside the platforms that presumably correspond to the users’ interests. For this purpose cookies may be stored on users’ computers in which the usage behaviour and interests of the users are stored. Other data may also be stored in these usage profiles, in particular if the users are members of the respective platforms and are logged in to them. On our Website we merely link to our company profiles on the respective social networks. Please note, however, that when you click a link to the social networks, data are transmitted to their servers. If at that time you are logged in to the respective social network with your username and password, the information is transmitted that you have visited our company profile on the respective social network from our Website, and the respective provider can store this information in your user account. We generally have no significant influence over the data processing of the social networks. We do, however, receive statistics from the providers about the use and visits of our company profiles on the social networks (e.g. information about the number of views, interactions such as likes and comments, and aggregated demographic and other information or statistics). Further information on the data used by the providers can be found in the providers’ privacy notices linked below. If we receive your personal data in the context of our social-media presences (e.g. in the context of a message), you have the rights set out above in this privacy notice. You can address your enquiries regarding data processing in the context of our company profiles to us using the contact details stated above. If you also wish to assert rights vis-à-vis the provider of the social network, the simplest way is to contact the respective provider directly. The provider knows the details of the technical operation of the platform and the associated data processing as well as the specific purposes of the processing. You can find the contact details in the privacy notices linked below. We will also be happy to assist you in asserting your rights insofar as this is possible for us. Processing of users’ personal data generally takes place on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR. The legal basis is also Art. 6(1) lit. b) GDPR if we receive and process your data in the context of a contract-related enquiry via our social-media presence. The legal basis for connecting and operating our company profiles on social networks, including receiving statistics on the use of our company profiles, is Art. 6(1) lit. f) GDPR on the basis of our legitimate interest in our corporate communication on the respective social networks. For information on the respective processing and the respective options to object, we refer to the providers’ privacy notices linked below:

LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland), social network for maintaining existing and establishing new business contacts

• Privacy information: https://www.linkedin.com/legal/privacy-policy
• Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out