This is a translation of our German privacy policy, provided for convenience. In case of any discrepancy the German version at yekta-it.de/datenschutz prevails.

We are glad you are visiting our website and thank you for your interest in it. Below we set out how Yekta IT GmbH, Ruhrallee 9, 44139 Dortmund, Germany (hereinafter: "we") processes personal data and what happens to it, which data protection rights you have, and how you can contact us about them and about data protection generally.

The protection of your personal data matters a great deal to Yekta IT GmbH. Your personal data is treated confidentially and in accordance with the statutory data protection provisions and with this privacy policy.

Personal data is any data by which a person can be identified.

This privacy policy sets out which data is collected and for what purpose it is used.

Data processing on this website

1. Controller

The controller within the meaning of Article 4(7) GDPR is:

Yekta IT GmbH

Ruhrallee 9

44139 Dortmund, Germany

Telephone: +49 231 39814905 (Monday to Friday, 9am to 5pm CET)

E-mail: info@yekta-it.de

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (for example names, e-mail addresses, IP addresses).

Data processing on this website is carried out by the operator of the website.

2. Collection of data when you visit our website

Either you give us your data yourself, for instance by using our contact form, calling us or writing to us by e-mail.

Or your data is recorded by our IT systems when you visit our website. That can happen automatically or after you have given your consent.

3. Which personal data is always collected when our website is opened?

When you visit our website, your browser automatically transmits information to us. It is passed from your browser to the server (known as server log files). The following data is recorded every time:

• the time and date of access,
• the IP address of your device,
• the name of your internet provider,
• information about the browser and operating system you use,
• the name and address of the file requested,
• the volume of data transferred, and
• a message stating whether the request was successful.

Processing this data is necessary in order to make use of the website possible and to make it easier.

The processing takes place under Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The personal data is not passed on or used for other purposes. We reserve the right to review the server log files named above afterwards, where there are concrete indications of unlawful use.

The retention period for this processing is as a rule 14 days from collection. In exceptional cases it can be extended until a suspected case of unlawful use has been clarified.

4. SSL and TLS encryption

For security reasons and in order to protect the transmission of personal data, our website uses SSL and TLS encryption. You can recognise this encrypted connection by the address beginning with "https://" and by a padlock symbol. It means that when SSL or TLS encryption is active, the data you transmit to us cannot be read by third parties.

5. What do we use your personal data for?

The processing takes place on the one hand in order to provide the website without faults, and on the other in order to analyse how it is used.

6. Which data protection rights do you have in respect of the processing of your personal data?

If your personal data has been processed, you are a data subject. Under the General Data Protection Regulation, data subjects have the following rights:

• the right of access (Article 15 GDPR)
• the right to rectification (Article 16 GDPR)
• the right to erasure (Article 17 GDPR)
• the right to restriction of processing (Article 18 GDPR)
• the right to data portability (Article 20 GDPR)
• the right to lodge a complaint with a supervisory authority (Article 77 GDPR)

As a data subject you have the right at any time to obtain free information about the origin, the recipients and the purpose of your stored personal data.

Where you have given consent to processing, you may withdraw that consent at any time with effect for the future (Article 21 GDPR), where we carry out processing under Article 6(1)(e) and (f) GDPR. You can address your objection to us by e-mail at datenschutz@yekta-it.de.

You also have the right in certain circumstances to request the restriction of the processing of your personal data. Furthermore you have the right to lodge a complaint with the competent supervisory authority.

7. Right to lodge a complaint with the competent supervisory authority

If there has been an infringement of the General Data Protection Regulation, you as a data subject have the right to lodge a complaint with a supervisory authority. That right applies without prejudice to any other administrative or judicial remedy.

8. Hosting

We host our website and its content with an external provider:

Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen, Germany

The personal data processed when you visit our website is stored on the host's servers (for example metadata and communication data, contact details, names, IP addresses, page views and other data that a website can generate).

Our host will process your data only to the extent necessary to perform its obligations and in accordance with our instructions. We have concluded a data processing agreement with the host which ensures the protection of our visitors' data and prohibits unauthorised disclosure to third parties. That agreement is a contract required by data protection law and ensures that the personal data of our website visitors is processed only on our instructions and in compliance with the GDPR.

External hosting takes place for the performance of our contract with potential and existing clients, prospects and website visitors (Article 6(1)(b) GDPR) and in the interest of a secure, fast and effective provision of our website by a professional provider (Article 6(1)(f) GDPR).

9. Retention period

Your personal data is stored for as long as the purpose of the processing requires, unless statutory retention periods apply or a more specific retention period is set out in this privacy policy.

If you exercise your right to erasure under Article 17 GDPR or withdraw consent to processing, your personal data will be erased unless there are legal grounds for retaining it (for example retention periods under tax or commercial law). In the latter case, erasure follows once those grounds fall away.

10. On what legal bases does the processing on our website take place?

We process your personal data on several legal bases.

On the one hand on the basis of consent, which you must give us expressly when using our website (Article 6(1)(a) GDPR).

Where you have expressly consented to the processing, we process your personal data under Article 6(1)(a) GDPR. Where you have expressly consented to the transfer of personal data to third countries, the processing additionally takes place under Article 49(1)(a) GDPR.

Where you have consented to the storage of cookies, the processing additionally takes place under section 25(1) of the German Telecommunications Digital Services Data Protection Act (TTDSG).

Your consent can be withdrawn at any time.

On the other hand we process your personal data for the performance of a contract or for pre-contractual steps that are necessary under Article 6(1)(b) GDPR, or for compliance with a legal obligation under Article 6(1)(c) GDPR.

Processing may also take place on the basis of our legitimate interest under Article 6(1)(f) GDPR.

11. Transfer of data to third countries without an adequate level of protection, and to US companies

Our website contains tools from companies based in a third country without an adequate level of data protection.

Where those tools are active, your personal data can be transferred to and processed in those countries.

We point out that in third countries without an adequate level of data protection, a level of protection comparable to that of the EU cannot be guaranteed.

12. Who are the recipients of your personal data?

We pass your personal data to external parties only where

• this is necessary for the performance of a contract,
• on the basis of a legitimate interest,
• where we are legally obliged to do so,
• on the basis of your express consent, and
• where a data processing agreement is in place.

13. Cookies

We use cookies on our website. Cookies are small data files that are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies) when you use our website. Session cookies are deleted automatically at the end of your visit, whereas persistent cookies remain stored on your device. You can delete them yourself, or your browser can delete them automatically.

These cookies can come either from us or from a third party. They have different functions. Some of them are technically necessary, because necessary website functions would not work without them. Others can be used, for instance, to analyse user behaviour.

The technically necessary cookies are used under Article 6(1)(f) GDPR unless another legal basis is stated. As the operator of the website we have a legitimate interest in storing necessary cookies in order to provide our services without technical faults and in optimised form.

Cookies that are not technically necessary are stored on the basis of your express consent, so that the processing of your personal data in connection with those cookies takes place exclusively on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TTDSG. The consent you have given can be withdrawn at any time:

/en/cookies/documentation

You can configure your browser so that you are notified when cookies are set, or even so that cookies are refused in certain cases. Please note that disabling cookies can impair the functionality of a website, including ours.

Which cookies that are not technically necessary we use on our website is set out below:

• Google Analytics
• Google Tag Manager

13.1 Google Analytics

We use Google Analytics (with the anonymisation function) on our website.

The operator of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA.

Google Analytics is a web analytics service for collecting and evaluating data about the behaviour of website users such as yourself. It can collect data about, for instance, which website a user came from, which sub-pages the user accessed, and how often and for how long a sub-page was viewed. Web analytics is used, for example, to optimise a website and for cost-benefit analysis. Google Analytics does this by using cookies that make an analysis of your use of our website possible. That is, Google Analytics uses cookies to collect information about the use of the website (for example usage and user-related information such as IP address, place, time or frequency of visits to our site). That information is transmitted to a Google server in the USA and stored there. However, we use Google Analytics with the anonymisation function "_gat._anonymizeIp". Through it, the IP address of the data subject's internet connection is truncated and anonymised by Google where access to our website comes from a member state of the European Union or from another state party to the Agreement on the European Economic Area.

On our behalf, Google will use this information in order to evaluate your use of the website and to compile reports on website activity. The reports provided by Google Analytics serve to analyse the performance of our website.

The recipient of the data is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as processor. We have concluded a data processing agreement with Google for this purpose. Google LLC, based in California, USA, and where applicable US authorities, may access the data stored at Google.

A transfer of data to the USA cannot be ruled out.

The data we send that is linked to cookies is deleted automatically after 26 months. Data whose retention period has been reached is deleted automatically once a month.

Where you have expressly consented to the use of the Google Analytics cookies, you have thereby given us the ability to analyse the use of our website. On every page view on our website, Google Analytics causes your browser to transmit data to Google. Google thereby obtains knowledge of your personal data, such as your IP address.

Further information and Google's applicable data protection provisions can be found at https://www.google.de/intl/de/policies/privacy and at https://www.google.com/analytics/terms/de.html. Google Analytics is explained in more detail at https://www.google.com/intl/de_de/analytics/.

13.2 Google Tag Manager

We also use the Tag Manager of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

Tags are identifiers for data elements. The Tag Manager tool itself (which only implements the tags) is a domain without cookies and collects no personal data. The tool can trigger other tags which may in turn collect data. Google Tag Manager has no access to that data. Further information is available here: https://www.google.com/intl/de/tagmanager/faq.html and https://www.google.com/intl/de/policies/privacy.

13.3 Hotjar

We use Hotjar in order to understand the needs of our users better and to improve what this website offers and how it feels to use. With Hotjar's technology we gain a better understanding of our users' experience (for example how much time users spend on which pages, which links they click, what they like and what they do not) and that helps us to align what we offer with our users' feedback. Hotjar works with cookies and other technologies in order to collect data about our users' behaviour and their devices, in particular the IP address of the device (collected and stored only in anonymised form during your use of the site), screen size, device type (unique device identifiers), information about the browser in use, location (country only), and the preferred language for displaying our website. Hotjar stores this information on our behalf in a pseudonymised user profile. Hotjar is contractually prohibited from selling the data collected on our behalf.

Further information can be found under the section "About Hotjar" on Hotjar's help page.

13.4 Outgrow

We use Outgrow, 401 Park Ave, 10th Floor, New York 10016 (hereinafter Outgrow).

Outgrow allows us to create online forms in order to capture messages, enquiries and other input from our website visitors. All input you make is processed on Outgrow's servers.

Outgrow is used on the basis of our legitimate interest in establishing your request in the most user-friendly way (Article 6(1)(f) GDPR). Where corresponding consent has been requested, the processing takes place exclusively on the basis of Article 6(1)(a) GDPR and section 25(1) TTDSG, where the consent covers the storage of cookies or access to information on the user's device (for example device fingerprinting) within the meaning of the TTDSG. The consent can be withdrawn at any time.

The data you enter in the form remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing it falls away (for example once your enquiry has been dealt with). Mandatory statutory provisions, in particular retention periods, remain unaffected.

The transfer of data to the USA is safeguarded by EU standard contractual clauses which we have concluded with Outgrow. Details can be found here: https://outgrow.co/EU-GDPR/.

13.5 Leadfeeder

We use Leadfeeder, a tool of Liidio Oy/Leadfeeder, Mikonkatu 17 C, Helsinki, Finland. Leadfeeder identifies companies by their business IP addresses. Leadfeeder establishes no reference to an individual. The information collected by the tracking code is deleted after two years. Earlier deletion of the data can be requested at support@leadfeeder.com. Leadfeeder's privacy policy can be found at https://www.leadfeeder.com/privacy, and information on Leadfeeder and compliance with the General Data Protection Regulation at https://www.leadfeeder.com/leadfeeder-and-gdpr/.

13.6 Use of Pipedrive CRM

For managing sales leads and clients we use the CRM system Pipedrive. This is an external service that processes personal data on our behalf. Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia, acts as processor under Article 28 GDPR.

Purposes of the processing

Personal data is processed in the CRM for the purpose of:

• recording and managing enquiries and leads,
• documenting the course of contact,
• carrying out sales and communication processes.

Categories of data processed

Typically processed are:

name, e-mail address, telephone number, company details, the content of communications, and other information transmitted in the course of the client relationship.

Legal bases

The processing takes place on the basis of:

• Article 6(1)(b) GDPR (pre-contractual steps and performance of a contract),
• Article 6(1)(f) GDPR (legitimate interest in efficient client management).

Processing on our behalf and sub-processors

A data processing addendum is in place with Pipedrive. Pipedrive may use sub-processors. A current list of sub-processors (for example hosting providers such as AWS, or CDN services) is available on the Pipedrive website.

Retention period

Chat and CRM records are stored for as long as they are necessary for dealing with enquiries, for initiating a contract or for client communication, and for as long as no statutory retention periods conflict with deletion. Once the purpose has been achieved, the data is deleted or anonymised.

13.7 Live chat (Pipedrive LeadBooster)

We embed a live chat widget from Pipedrive (LeadBooster) on our website, through which visitors can contact us directly. Technically, the live chat loads before a cookie consent is given. In that case certain data is already processed when the page loads, in order to provide the chat function.

Data processed in the live chat

In the course of using the live chat, the following may be processed:

• the content of the chat and any contact details entered,
• IP address, time and duration of the chat,
• technical information about the device and browser.

Legal basis

For the chat communication itself, the following usually applies:

• Article 6(1)(b) GDPR (where it relates to an enquiry or a contract),
• Article 6(1)(f) GDPR (legitimate interest in providing a means of support and contact).

Cookies and tracking

The live chat may use cookies and similar technologies that process personal data. Under the law as it stands, those cookies may only be set after express consent. Since the chat widget loads before consent is given, we process data here only to the extent necessary for the functioning of the chat. Any processing beyond that, for example analytics or tracking cookies, is activated only after explicit consent.

Recipients and transfers to third countries

The data is processed primarily on servers within the European Union. In the course of support and maintenance, Pipedrive may use sub-processors for whom access from third countries cannot be ruled out. In those cases the transfer takes place on the basis of appropriate safeguards under Article 46 GDPR, in particular standard contractual clauses.

14. Processing of personal data through the contact form, e-mail or telephone

If you write to us through our contact form or by e-mail, or call us, all the details you provide are stored with us for the purpose of dealing with your enquiry.

The processing takes place under Article 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary for pre-contractual steps. In all other cases the processing takes place on the basis of our legitimate interest in dealing with the enquiries addressed to us under Article 6(1)(f) GDPR, or on the basis of your express consent under Article 6(1)(a) GDPR, where that consent was requested beforehand and you gave it. Your consent can be withdrawn at any time.

The data you enter or provide through the contact form, by e-mail or by telephone is stored with us. It is not passed on to third parties unless you give us your consent.

This data is deleted as soon as you ask for it, as soon as you withdraw your consent to its storage, or as soon as the purpose of the processing falls away. Excepted are cases in which statutory provisions impose mandatory retention periods.

15. Applicant data

You can apply to us by e-mail or by post, either for an advertised position or on your own initiative.

When we receive your application, we process the personal data it contains to the extent that your application is of interest to us and that this is necessary for deciding whether to enter into an employment relationship.

This takes place under section 26 of the German Federal Data Protection Act (BDSG) and Article 6(1)(b) GDPR, or, where you have given your consent, under Article 6(1)(a) GDPR. Your consent can be withdrawn at any time.

Within our company, your personal data is passed only to those people involved in handling your application.

If the application is successful, the data you submitted is stored in our data processing systems (for example in a personnel file) on the basis of section 26 BDSG and Article 6(1)(b) GDPR for the purpose of carrying out the employment relationship, for as long as the employment relationship lasts or until statutory retention periods have expired.

If your application was not successful, if you decline an offer from us, or if you withdraw your application, we are entitled to retain the data you sent us on the basis of our legitimate interest under Article 6(1)(f) GDPR for up to six months from the end of the application process (rejection or withdrawal). After that your data is deleted and any physical application documents are destroyed. The purpose of retention is, for example, evidence in the event of a legal dispute. If the data is still needed after the six-month period, for instance because of a threatened or pending dispute, deletion follows only once the purpose of further retention falls away.

Longer retention can take place where you have given corresponding consent under Article 6(1)(a) GDPR, for example if you wish to be included in a talent pool for matching vacancies, or where statutory retention obligations prevent deletion. You can withdraw your consent at any time.

16. Google reCAPTCHA

On our website we use the CAPTCHA service of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

Data may also be transmitted to: Google LLC, USA.

In order to display the CAPTCHA window, the provider uses Google Fonts, that is, typefaces loaded from Google over the internet. No information is processed beyond that named above, which is already transmitted to Google through the functioning of reCAPTCHA.

Using Google reCAPTCHA helps us to establish whether an input was made by a natural person or abusively by automated processing, and blocks spam, denial of service attacks and similar automated abuse. In order to establish that an action is carried out by a person and not by an automated bot, the provider collects the IP address of the device used, identifying data about the type of browser and operating system in use, and the date and duration of the visit, and transmits these to the provider's servers for evaluation.

The legal basis is our legitimate interest in establishing individual responsibility on the internet and in preventing abuse and spam, under Article 6(1)(f) GDPR.

A data processing agreement is in place between the provider and us, which ensures the protection of your data as a visitor to our website and prohibits unauthorised disclosure to third parties.

For transfers of data to the USA, the provider has joined the EU-US Data Privacy Framework, which on the basis of an adequacy decision of the European Commission ensures compliance with the European level of data protection.

17. Privacy policy for our social media presence

This privacy policy also applies to our social media presence:

• https://de.linkedin.com/company/yekta-it

With our social media presence we want to offer our clients and prospects a comprehensive presence on the internet. We rely on a legitimate interest under Article 6(1)(f) GDPR.

The social media platform providers run analytics processes on their own sites. They rely on legal bases that differ from ours. For instance, processing there may take place on the basis of consent under Article 6(1)(a) GDPR.

In the context of our social media presence we are jointly responsible with the operator of the social media platform for the processing of your data, as so-called joint controllers.

For you that means you can in principle exercise your data protection rights, such as access, rectification, erasure, restriction of processing, data portability and complaint, both towards us and towards the operator of the respective social media platform.

Please bear in mind that as joint controllers we do not have full influence over the processing operations on the social media platform.

Where we collect data directly from you through the social media presence into our own systems, it is deleted as soon as you ask us to delete it, withdraw your consent to its storage, or the purpose for storing it falls away. Cookies that have been stored remain on your device until you delete them yourself. Here too, mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

Once your data is stored by the operator of the social media platform, we have no influence over the retention period. It is stored and processed for the operator's own purposes. For data protection questions about that, please write directly to the operator of the social media platform.

Here too you have the right at any time to obtain free information about the origin, the recipients and the purpose of your stored personal data. You also have a right to object, a right to data portability and a right to lodge a complaint with the competent supervisory authority. Furthermore you may request the rectification, blocking or erasure of your personal data and, in certain circumstances, the restriction of its processing.

18. LinkedIn profile

We have a profile on LinkedIn, a social media platform. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.

If you wish to disable LinkedIn's advertising cookies, please use the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Data is transferred to the USA on the basis of the European Commission's standard contractual clauses. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

Details of how LinkedIn handles your personal data can be found in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.

19. Changes to this privacy policy

The data protection information applies in the version in force at the time.

We reserve the right to amend and add to this data protection information. That may concern the whole of it or only particular parts.

The current version can be found at any time at /en/datenschutz.

Version: 10/2023