Privacy Notes

VIDA.place GmbH

Privacy Notes according to Art. 13, 14 GDPR

Data protection is paramount to all VIDA.place activities. A transparent process is very important to us when it comes to the way we process personal data. With the following privacy notes, we would like to inform you about how we handle your personal data in detail. For better legibility, we try not to use specific genders. Therefore, please note that the words they/them are intended to mean all genders.

A description of our data processing regarding the provision of our website and the creation of logfiles is available here.

General Information

1. Identity and contact details of the data controller

The following party is responsible for all data processing described here:

Vida.place GmbH
Franz-Joseph-Straße 10
80801 Munich, Germany
contact@vida.place
https://vida.place

2. Contact details of the data protection officer

You can reach our data protection officer as follows:

DataCo GmbH
Nymphenburger Str. 86
80636 Munich, Germany
datenschutz@dataguard.de

Rights of the data subject

Right to obtain information
If your personal data is processed, you have the right to obtain information from the controller about the data stored about you (Art. 15 GDPR).

Right to rectification
You have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning you and the right to have incomplete personal data completed (Art. 16 GDPR).

Right to erasure
If the legal requirements are met, you can request the immediate deletion of your personal data or restriction of processing (Art. 17 and 18 GDPR).

Right to information
If you have asserted your right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right vis-à-vis the controller to be informed about these recipients (right to information, Art. 19 GDPR).

Right to data portability
If you have consented to data processing or if there is a contract for data processing and the data processing is carried out using automated procedures, you may have a right to data portability (Art. 20 GDPR). In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, insofar as this is technically feasible. The freedoms and rights of other persons must not be adversely affected by this.

Right to object
You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you, which is based on Art. 6 para. 1 sentence 1 lit. e or f GDPR ; this also applies to profiling based on these provisions. The controller shall no longer process the personal data concerning you unless he can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims (Art. 21 (1) GDPR).

Right to object to the processing of personal data for the purpose of advertising
If the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is related to such direct marketing (Art. 21 (2) GDPR). If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

Right to revoke your declaration of consent
You have the right to revoke your declaration of consent under data protection law at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation (Art. 7 (3) GDPR).

Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. In this case, if the legal requirements are met, you have the right to obtain human intervention on the part of the controller, to express your own point of view and to contest the decision (Art. 22 GDPR).

Right to lodge a complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you infringes the GDPR (Art. 77 GDPR). The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR.

For customers and interested parties

We appreciate your interest in our company, our products and our services. As a data privacy company, we want you to feel comfortable interacting with us and our employees regarding the protection of your personal data. We take the protection of your personal data very seriously. Compliance with German and European data protection regulations is a matter of course for us. As a result, the protection of your personal data has top priority for us. With the following information, we would like to inform you about how we handle your personal data in detail:

1. Processing of your personal data

a. Your personal data processed by us

Within the framework of the existing customer relationship as well as the contract initiation, we process the following personal data:

  • First name
  • Last name
  • Salutation
  • Title and academic degree
  • Company Name
  • Position within the company
  • Business address
  • Bank details
  • Tax ID
  • Customer number
  • Your e-mail address
  • Your mobile phone number
  • Your landline number
  • Your fax number
  • Role assigned within the platform and the according authorisations
  • All personal data that are provided to us during communication with clients

VIDA.place GmbH collects data from interested parties and customers in the following manners:

  • Requests via the contact form on the VIDA website
  • Requests sent via messages to VIDA employees, e.g. via email, LinkedIn messages and other communication channels
  • Requests at trade fairs or other events where data are passed on to VIDA employees with the aim of establishing contact
  • Individual research about potential interested parties in business directories, contact information on websites, and professional networks
  • Individual booking of an appointment by an interested party
  • Querying of the personal data after concluding a contract with VIDA from the persons themselves, or receipt of personal data via an employee of the client company. This could also concern employees of service providers used by a client’s company.

b. Purpose of processing:

Within the framework of the existing customer relationship as well as the contract initiation, your personal data will be processed by us for the following purposes:

  • To process your request as an interested party. For this purpose, we use your contact details to be able to answer your request.
  • To prepare and carry out pre-contractual measures – this includes, for example, the preparation and sending of an individual offer or individual agreement and transmission of contractual condictions with the aim of concluding the contract.
  • To include your contact details in our customer and contact database.
  • Contact (e-mail, telephone, LinkedIn)
  • Establishment, execution and termination of the contractual relationship
  • Customer management and customer service – esp. the processing of customer inquiries
  • To inform you optimally about our products and services. This also includes sending (direct) advertising by e-mail or telephone.
  • In order to optimally serve you as our customer. This includes, in particular, communication with you by e-mail, mobile phone, landline number or fax.
  • To ensure smooth billing of the services provided. For this purpose, your personal data will be processed in order to be able to issue invoices.
  • To comply with our legal obligations. This includes, for example, the transmission of your personal data to the tax office.
  • For the purpose of carrying out marketing initiatives such as: newsletter dispatch, product updates, invitations to events and webinars
  • To fulfil post-contractual measures.
  • To assert, exercise or defend legal claims.
  • To carry out product testing phases
  • To query your satisfaction with our products and services

c. Legal basis of data processing

  • Processing of your personal data on the basis of consent: Insofar as we obtain your consent for the processing of your personal data, the processing of your personal data is based on Art. 6 (1) (1) (a) GDPR in conjunction with. Art. 5, 7 GDPR.
  • Processing for the purpose of implementing the contract with you: Insofar as we process your personal data for the purpose of fulfilling a contract, Art. 6 (1) (1) (b) GDPR serves as our legal basis. This also applies to processing operations that are necessary for the implementation of pre- and post-contractual measures.
  • Processing for the fulfilment of a legal obligation: Insofar as the processing of your personal data is necessary for the fulfilment of a legal obligation to which our company is subject, Art. 6 (1) (1) (c) GDPR serves as our legal basis. Our legal obligation to process data results e.g. from tax law and/or commercial law retention obligations.
  • Processing on the basis of legitimate interest: Legal basis for the purpose of direct advertising may be Art. 6 (1) (1) (f) GDPR if our legitimate interests are present, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail. The legitimate interests pursued by us in this regard – in addition to the purposes listed under 1.2 – include:
    • To be able to inform you optimally about our products, offers and services by means of direct marketing.
    • In communicating with you, in particular to be able to answer your inquiries by e-mail, telephone and/or fax.
    • In order to be able to carry out a due diligence with our potential business partner.
    • We carry out credit checks on our potential business customers. Our legitimate interest lies in the avoidance of payment defaults.
    • To receive customer feedback to improve the customer experience, improve our products and services.
  • The legal basis for processing activities in connection with the assertion, exercise or defence of legal claims is also our legitimate interest pursuant to Art. 6 (1) (1) (f) GDPR.

2. Recipients or categories of recipients of personal data and third country transfer

When processing your personal data, we may disclose the personal data concerning you to the following recipients. We only transfer your personal data to external recipients if you have consented or if this is permitted by law.

External recipients of your personal data are in particular:

  • Authorities e.g.: tax offices, courts, trade supervisory office, Data protection supervisory authority, etc.
  • Financial Institutions
  • Tax consultants
  • external DPO (Data Co. GmbH)
  • Processors

Your personal data will be transmitted to the following service providers:

  • LinkedIn Ireland Unlimited Company, Wilton Place 2, Dublin, Ireland
  • Personio SE & Co. KG, Seidlstraße 3 80335, Munich, Germany

In addition, your personal data may be transferred to the following service providers located in a country outside the EU/EEA:

  • Google LLC, 1600 Amphitheatre Parkway in Mountain View, California, U.S.
  • HubSpot Inc., Cambridge, 2 Canal Park, Massachusetts, U.S.
  • Intuit Inc., 2700 Coast Ave in Mountain View, California, U.S.
  • Amplemarket, 2443 Fillmore St 380-3880, San Francisco, CA 94115

The following service providers in the USA have joined the Trans-Atlantic Data Privacy Framework (TDPF; data protection agreement between the EU and the USA), so that an appropriate level of data protection is guaranteed for data processing:

  • Google LLC, 1600 Amphitheatre Parkway in Mountain View, California, U.S.
  • HubSpot Inc., Cambridge, 2 Canal Park, Massachusetts, U.S.
  • Intuit Inc., 2700 Coast Ave in Mountain View, California, U.S
  • Amplemarket, 2443 Fillmore St 380-3880, San Francisco, CA 94115

3. Duration of storage of personal data

We do not store your personal data longer than is necessary for the purpose for which it was collected. This means that data in our systems will be destroyed or deleted as soon as it is no longer needed. Reasonable measures are taken by us to ensure that your personal data is only processed under the following conditions:

  • For the duration that the data is used to provide you with a service
  • As required by applicable law, contract, or in light of our legal obligations
  • Only as long as necessary for the purpose for which the data was collected, or longer if required by contract, applicable law, using appropriate safeguards.

A requirement may exist in particular if the data is still needed in order to fulfill contractual services, to check and grant or ward off warranty and, if applicable, guarantee claims. If the data is no longer required for the fulfillment of contractual or legal obligations, it is regularly deleted, unless its – temporary – retention is still necessary, in particular for the fulfillment of legal retention periods of up to ten years (including from the German Commercial Code, the German Fiscal Code and the German Money Laundering Act). In the case of statutory retention obligations, deletion is only considered after the expiry of the respective retention obligation.

4. Obligation to provide data

For a (planned) conclusion as well as the execution of the contract with you, you must provide those personal data which are necessary for the establishment and execution of the contractual relationship and the fulfillment of the associated contractual obligations or which we are legally obliged to collect. This obligation also arises from the law, e.g. § 14 UstG. Without this data, we will generally not be able to conclude and execute the contract with you.

For service providers and suppliers

1. Processing of your personal data

a. Your personal data processed by us

VIDA.place GmbH processes personal data from suppliers and service providers. This is necessary for business operations. The following data is processed in this context:

  • First name
  • Last name
  • Business address
  • Company name
  • Bank details
  • Your e-mail address,
  • Your mobile phone number
  • Your landline number
  • Your fax number
  • Title and academic degree
  • Position within the company
  • All personal data that are provided to us during communication

VIDA.place GmbH collects data from people in the following manners:

  • Receipt of personal data directly from the data subject via establishment of contact by suppliers / service provider
  • Receipt of personal data directly from the data subject via establishment of contact by VIDA
  • Research in business directories or on websites

b. Purpose of processing:

We will process your data for the following purposes:

  • Initiation, execution and termination of a contractual relationship
  • Performance of orders
  • Review and optimisation of processes for needs assessment
  • Assertion, exercise or defence of legal claims
  • Measures for business management and further development of our products

b. Legal basis of data processing

  • Processing of your personal data on the basis of consent: Insofar as we obtain your consent for the processing of your personal data, the processing of your personal data is based on Art. 6 (1) (1) (a) GDPR in conjunction with. Art. 5, 7 GDPR.
  • Processing for the purpose of implementing the contract with you: Insofar as we process your personal data for the purpose of fulfilling a contract, Art. 6 (1) (1) (b) GDPR serves as our legal basis. This also applies to processing operations that are necessary for the implementation of pre- and post-contractual measures.
  • Processing for the fulfilment of a legal obligation: Insofar as the processing of your personal data is necessary for the fulfilment of a legal obligation to which our company is subject, Art. 6 (1) (1) (c) GDPR serves as our legal basis. Our legal obligation to process data results e.g. from tax law and/or commercial law retention obligations.
  • Processing on the basis of legitimate interest: Legal basis for the purpose of direct advertising may be Art. 6 (1) (1) (f) GDPR if our legitimate interests are present, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail. The legitimate interests pursued by us in this regard – in addition to the purposes listed under 1.2 – include:
    • To be able to inform you optimally about our products, offers and services by means of direct marketing.
    • In communicating with you, in particular to be able to answer your inquiries by e-mail, telephone and/or fax.
    • In order to be able to carry out a due diligence with our potential business partner.
  • The legal basis for processing activities in connection with the assertion, exercise or defence of legal claims is also our legitimate interest pursuant to Art. 6 (1) (1) (f) GDPR.

2. Recipients or categories of recipients of personal data and third country transfer

In the course of processing your personal data, we may disclose the personal data concerning you to the following recipients. We only transfer your personal data to external recipients if you have consented or if this is permitted by law.

External recipients of your personal data are in particular:

  • Authorities e.g.: tax offices, courts, trade supervisory office, Data protection supervisory authority, etc.
  • Financial Institutions
  • Tax consultants
  • Parcel service providers
  • Postal service
  • external DPO (Data Co. GmbH)
  • Processors

Your personal data will be transmitted to the following service providers:

  • easybill GmbH, Düsselstraße 21, 41564 Kaarst, Germany

In addition, your personal data may be transferred to the following service providers located in a country outside the EU/EEA:

  • Getmoss UK Ltd, 3rd Floor Waverley House, 7-12 Noel Street, London, W1F 8GQ United Kingdom

In order to make the third country transfer as data protection friendly as possible, standard contractual clauses have been concluded with providers in unsafe third countries in accordance with Art. 46 (2) (c) GDPR. A copy of the standard contractual clauses can be requested by sending an informal e-mail to contact@vida.place.

3. Duration of storage of personal data

We do not store your personal data longer than is necessary for the purpose for which it was collected. This means that data in our systems will be destroyed or deleted as soon as it is no longer needed. Reasonable measures are taken by us to ensure that your personal data is only processed under the following conditions:

  • As required by applicable law, contract, or in light of our legal obligations
  • Only as long as necessary for the purpose for which the data was collected, or longer if required by contract, applicable law, using appropriate safeguards.

A requirement may exist in particular if the data is still needed in order to fulfill contractual services, to check and grant or ward off warranty and, if applicable, guarantee claims. If the data is no longer required for the fulfillment of contractual or legal obligations, it is regularly deleted, unless its – temporary – retention is still necessary, in particular for the fulfillment of legal retention periods of up to ten years (including from the German Commercial Code, the German Fiscal Code and the German Money Laundering Act). In the case of statutory retention obligations, deletion is only considered after the expiry of the respective retention obligation.

4. Obligation to provide data

For a (planned) conclusion as well as the execution of the contract with you, you must provide those personal data which are necessary for the establishment and execution of the contractual relationship and the fulfillment of the associated contractual obligations or which we are legally obliged to collect. This obligation also arises from the law, e.g. § 14 UstG. Without this data, we will generally not be able to conclude and execute the contract with you.

For applicants

1. Processing of your personal data

As part of the application process, we collects the following personal data from you:

  • First name and surname
  • Email address
  • Phone / mobile number
  • Availability
  • Expected salary
  • All personal data contained in the application (curriculum vitae, cover letter, certificates, etc.)

VIDA collects personal data from applicants in the following manners:

  • Direct application via the VIDA careers page
  • Application via email, addressed directly to a VIDA employee
  • LinkedIn Easy Apply
  • Recruitment agencies
  • Candidates approached by VIDA on LinkedIn

2. Purposes of processing and their legal basis

Your personal data will be processed for the following purposes:

  • Implementation of the application procedure and decision on the establishment of the employment relationship
  • Communication (telephone, e-mail, video telephony)
  • Implementation of pre-contractual measures (initiation of the employment relationship)
  • Inclusion of applicant data in a talent pool
  • Assertion, exercise or defence of legal claims arising from the application process

Processing of special categories of personal data that have been made public – Art. 9 (2) (e) GDPR

If special categories of personal data are processed that you have obviously made public, your data will be processed in accordance with Art. 9 (2) (e) GDPR.

Processing for the purpose of asserting, exercising or defending legal claims or in the event of acts of the courts – Art. 6 (1) (1) (f) GDPR, Art. 9 (1) (f) GDPR

If necessary, your data will be processed for the purpose of asserting, exercising or defending legal claims or in the event of actions of the courts pursuant to Art. 6 (1) (1) (f) GDPR, Art. 9 (1) (f) GDPR

Processing on the basis of consent – Art. 6 (1) (1) (a) GDPR in conjunction with Art. 7 GDPR, Art. 88 (1) GDPR in conjunction with Art. 26 (2) BDSG (Federal Data Protection Act)

If you have given your consent to data processing, your data will be processed in accordance with Art. 6 (1) (1) (a) GDPR in conjunction with Art. 7 GDPR, Art. 88 (1) GDPR in conjunction with Art. 26 (2) BDSG.

Decision on the establishment of the employment relationship Art. 6 (1) (1) (b) GDPR, Art. 88 (1) GDPR in conjunction with § 26 (1) BDSG

We process your data in order to make a decision on the establishment of the employment relationship. In the case of employment in our company, your data will be processed for the purpose of carrying out and terminating the employment relationship. For this purpose, separate information about the processing of your personal data will be provided.

Processing on the basis of legitimate interest – Art. 6 (1) (1) (f) GDPR

Insofar as the processing is carried out to safeguard a legitimate interest of us or a third party and their interests or fundamental rights and freedoms do not outweigh the first-mentioned interest, Art. 6 (1) (1) (f) GDPR serves us as the legal basis for data processing. Our legitimate interest arises in particular from the following reasons:

The proper execution and optimization of the application process

Assertion, exercise or defence of legal claims

Processing of special categories of personal data – Art. 9 (2) (a) GDPR

If you have given your consent to the processing of special categories of personal data, such as health data, religious affiliation or nationality, your data will be processed in accordance with Art. 9 (2) (a) GDPR.

3. Recipients or categories of recipients of personal data and third country transfer

As part of the processing of your personal data, we may pass on the personal data concerning you to the following recipients:

  • Internally, only authorized employees are granted access to an applicant’s data via an authorization concept.
  • Processors

In addition, your personal data may be transferred to the following service providers located in a country outside the EU/EEA:

  • Personio SE & Co. KG, Seidlstraße 3 80335, Munich, Germany
  • DocuSign, Inc., San Francisco, US

In order to make the third country transfer as data protection-friendly as possible, standard contractual clauses have been concluded with providers in unsafe third countries in accordance with Art. 46 (2) (c) GDPR. A copy of the standard contractual clauses can be requested by sending an informal e-mail to contact@vida.place.

4. Duration of storage of personal data

We will delete your personal data as soon as the purposes for their storage mentioned under IV. no longer apply, or you object to the use of your personal data (in the case of processing on the basis of legitimate interests) or you revoke your previously given consent. However, your personal data may also be stored beyond this, in particular in the following cases:

  • if deletion conflicts with contractual, statutory (in particular from HGB (Commercial Code), StGB (Criminal Code) and AO (Tax code)) or statutory retention periods
  • to assert, exercise or defend legal claims
  • where required by European or national law to comply with a legal obligation to which we are subject.

Legal provisions result in the following storage periods for us in particular:

  • After decision on non-filling: 180 days retention period for application documents (§ 15 (4) General Equal Treatment Act (AGG), § 224 Code of Civil Procedure (ZPO)).

If the applicant has consented, the applicant documents will be included in the talent pool and stored there for a maximum of 1 year from the date of consent. They will be deleted with the loss of purpose or the revocation of consent by the applicant. In the case of employment in our company, your personal data will be deleted when the purpose ceases to apply, at the latest after termination of the employment relationship, unless there are any statutory retention periods to the contrary.