Thank you for your interest in our website. Protecting your privacy is a priority for us. Below, we provide detailed information about how we handle your data.

I. Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection provisions is:

Progiton GmbH
Schulenburger Landstr. 126 a
30165 Hannover, Germany
Phone: +49 511 8745 8825
Email: info@progiton.com
Website: www.progiton.com
Represented by: Artur Ribka

II. General Information on Data Processing

II.1. Scope of the Processing of Personal Data

We process personal data of our users only to the extent necessary to provide a functioning website as well as our content and services. The processing of our users' personal data generally takes place only with the user's consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by legal provisions.

II.2. Legal Basis for the Processing of Personal Data

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for carrying out pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.

If the vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of our company or a third party, and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.

II.3. Data Erasure and Storage Period

The personal data of the data subject will be erased or blocked as soon as the purpose of storage no longer applies. Storage may continue to take place if provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or erased if a storage period prescribed by the aforementioned standards expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

III. Provision of the Website and Creation of Log Files

III.1. Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected in this process:

1. Information about the browser type and version used
2. The user's operating system
3. The user's internet service provider
4. The user's IP address
5. Date and time of access
6. Websites from which the user's system accessed our website
7. Websites accessed by the user's system through our website

This data is also stored in the log files of our system. This data is not stored together with other personal data of the user.

III.2. Legal Basis for Data Processing

The legal basis for the temporary storage of the data and log files is Art. 6(1)(f) GDPR.

III.3 Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this, the user's IP address must remain stored for the duration of the session.

Storage in log files is carried out to ensure the functionality of the website. In addition, we use the data to optimise the website and to ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context.

These purposes also constitute our legitimate interest in data processing under Art. 6(1)(f) GDPR.

III.4. Storage Period

The data is erased as soon as it is no longer required for the purpose for which it was collected. In the case of data collected for the provision of the website, this is the case when the respective session has ended.

In the case of data stored in log files, this is the case after seven days at the latest. Further storage is possible; in this case, the users' IP addresses are erased or anonymised so that it is no longer possible to identify the accessing client.

III.5. Right to Object and Removal

The collection of data for the provision of the website and the storage of data in log files is mandatory for the operation of the website. Consequently, users have no option to object.

III.6 Hosting

Our website is hosted by 1&1 Internet SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (https://unternehmen.1und1.de/impressum/). The privacy policy of 1&1 Internet SE can be found at: https://hosting.1und1.de/terms-gtc/terms-privacy/

The legal basis for this processing is Art. 6(1)(f) GDPR, based on our legitimate interest in the use of a secure and efficient server and software infrastructure. 1&1 Internet SE processes user data solely for the purpose of providing this online offering and maintaining its security.

IV. Use of Cookies

a) Description and Scope of Data Processing

Our website uses cookies. Cookies are text files that are stored on the user's computer system in or by the internet browser. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is visited again.

We use cookies to make our website more user-friendly. Some elements of our website require the accessing browser to be identifiable even after a page change. The following data is stored and transmitted in the cookies:

• Language settings
• Log-in information

b) Legal Basis for Data Processing

The legal basis for the processing of personal data using cookies is Art. 6(1)(f) GDPR.

c) Purpose of Data Processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary for the browser to be recognised again after a page change. User data collected through technically necessary cookies is not used to create user profiles.

These purposes also constitute our legitimate interest in the processing of personal data under Art. 6(1)(f) GDPR.

d) Storage Period, Right to Object and Removal

Cookies are stored on the user's computer and transmitted from it to our site. As a user, you therefore have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time; this can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use all functions of the website to their full extent.

V. Contact Form and Email Contact

V.1. Description and Scope of Data Processing

Our website features a contact form that can be used to contact us electronically. If a user makes use of this option, the data entered in the input form will be transmitted to us and stored.

The following data is also stored at the time the message is sent:

1. Reason for contact
2. Date of contact
3. Name of the sender
4. Email address of the sender
5. Phone number of the sender
6. Content of the message

Your consent is obtained for the processing of this data during the sending process, and reference is made to this privacy policy.

Alternatively, contact can be made via the email address provided (see legal notice). In this case, the user's personal data transmitted with the email will be stored.

The data will not be passed on to third parties in this context. The data is used exclusively for processing the conversation.

V.2. Legal Basis for Data Processing

Where the user's consent has been obtained, the legal basis for the processing of the data is Art. 6(1)(a) GDPR.

The legal basis for the processing of data transmitted in the course of sending an email is Art. 6(1)(f) GDPR. If the email contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR.

V.3. Purpose of Data Processing

The processing of personal data from the input form serves solely to process the contact request. In the case of contact by email, this also constitutes the necessary legitimate interest in the processing of the data.

V.4 Storage Period

The data is erased as soon as it is no longer required for the purpose for which it was collected. For personal data from the input form of the contact form and data sent by email, this is the case when the respective conversation with the user has ended. The conversation is deemed to have ended when the circumstances indicate that the matter in question has been conclusively resolved.

V.5. Right to Object and Removal

Users may withdraw their consent to the processing of personal data at any time. If a user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

Consent may be withdrawn and objection to storage may be made by phone or by letter. Please use the phone number or postal address provided for this purpose. An informal notice is sufficient.

All personal data stored in the course of establishing contact will be erased in this case.

VI. Application Process

We process applicant data in accordance with legal requirements and exclusively for the purpose of and within the scope of the application process. This processing takes place in order to fulfil our (pre-)contractual obligations within the meaning of Art. 6(1)(b) and (f) GDPR and Section 26 of the German Federal Data Protection Act (BDSG).

The ongoing application process requires applicants to provide data. Data required for an application via an online form is specifically marked as such and otherwise apparent from the job description. Data generally required includes personal details, contact addresses and application documents such as cover letters, CVs and relevant references. Applicants may provide additional information voluntarily.

By submitting their application data, applicants consent to the processing of their data for the purpose of the application process. The nature and scope of the data processing are set out in this privacy policy.

If applicants voluntarily submit special categories of personal data within the meaning of Art. 9(1) GDPR, we additionally process this data under Art. 9(2)(b) GDPR. Examples include health-related data such as severe disability status or the ethnic origin of applicants. Where special categories of personal data within the meaning of Art. 9(1) GDPR are required for the application process, we additionally process this data under Art. 9(2)(a) GDPR. Examples include health-related data required for the performance of the respective role.

Where available, applicants may submit their data to us via an online form on our website. Transmission takes place in accordance with the state of the art.

Applications may also be submitted by email. However, please note that emails are generally not encrypted during transmission, and applicants are therefore responsible for encryption themselves. We cannot accept responsibility for the transmission path between sender and our server. We therefore recommend using an online form or postal mail. We continue to offer applicants this latter option as well.

In the event of a successful application, data provided by applicants may be further processed by us for the purpose of the employment relationship. If no employment relationship is established, or if applicants withdraw their application, we erase applicant data after six months. This period serves to clarify any follow-up questions regarding the application and to enable us to comply with our documentation obligations under the German Equal Treatment Act. Excluded from this are any travel expense reimbursements, which we archive in accordance with tax law requirements.

Applicants have the option, subject to explicit consent within the meaning of Art. 6(1)(b) and Art. 7 GDPR, to have their data included in our "talent pool" for a period of two years. Application documents held in the talent pool are processed in connection with future job postings and erased at the latest upon expiry of this period. We inform applicants that inclusion in the talent pool is voluntary and has no bearing on the current application process. We further inform applicants that this voluntary consent can be withdrawn at any time, i.e. an objection within the meaning of Art. 21 GDPR may be declared.

VII. Rights of Data Subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights against the controller:

VII.1. Right of Access

You may request confirmation from the controller as to whether personal data concerning you is being processed by us.

If such processing is taking place, you may request the following information from the controller:

1. the purposes for which the personal data is processed;
2. the categories of personal data being processed;
3. the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
4. the envisaged period for which the personal data concerning you will be stored, or, if specific details are not possible, the criteria used to determine that period;
5. the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;
6. the existence of a right to lodge a complaint with a supervisory authority;
7. all available information on the origin of the data, if the personal data was not collected from the data subject;
8. the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

You have the right to request information as to whether personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

VII.2. Right to Rectification

You have the right to rectification and/or completion against the controller if the personal data concerning you that is processed is inaccurate or incomplete. The controller must carry out the rectification without undue delay.

VII.3. Right to Restriction of Processing

Under the following conditions, you may request the restriction of the processing of personal data concerning you:

1. if you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data;
2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
3. the controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims; or
4. you have objected to processing pursuant to Art. 21(1) GDPR and it is not yet clear whether the controller's legitimate grounds override your grounds.

Where processing of personal data concerning you has been restricted, such data may, with the exception of its storage, only be processed with your consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a member state.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

VII.4. Right to Erasure

a) Obligation to Erase

You may request the controller to erase personal data concerning you without undue delay, and the controller is obliged to erase such data without undue delay where one of the following grounds applies:

1. The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
2. You withdraw the consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.
3. You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
4. The personal data concerning you has been processed unlawfully.
5. The erasure of the personal data concerning you is necessary to comply with a legal obligation under Union or member state law to which the controller is subject.
6. The personal data concerning you was collected in relation to information society services offered pursuant to Art. 8(1) GDPR.

b) Information to Third Parties

If the controller has made the personal data concerning you public and is obliged pursuant to Art. 17(1) GDPR to erase it, the controller shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers processing the personal data that you, as the data subject, have requested the erasure of any links to, or copies or replications of, that personal data.

c) Exceptions

The right to erasure does not apply insofar as processing is necessary

1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation requiring processing under Union or member state law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
3. for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) as well as Art. 9(3) GDPR;
4. for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to under a) is likely to render impossible or seriously impair the achievement of the objectives of such processing; or
5. for the establishment, exercise or defence of legal claims.

VII.5. Right to Notification

If you have exercised your right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you has been disclosed of this rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort.

You have the right to be informed by the controller about these recipients.

VII.6. Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the data was provided, provided that

1. the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, or on a contract pursuant to Art. 6(1)(b) GDPR, and
2. the processing is carried out using automated means.

In exercising this right, you further have the right to have the personal data concerning you transmitted directly from one controller to another, insofar as this is technically feasible. This must not adversely affect the freedoms and rights of other persons.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

VII.7. Right to Object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions.

The controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you have the option to exercise your right to object by automated means using technical specifications.

VII.8. Right to Withdraw Consent under Data Protection Law

You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal.

VII.9 Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

1. is necessary for entering into, or the performance of, a contract between you and the controller,
2. is authorised by Union or member state law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and your legitimate interests, or
3. is based on your explicit consent.

However, such decisions must not be based on special categories of personal data under Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) GDPR applies and suitable measures have been taken to protect your rights and freedoms and your legitimate interests.

In the cases referred to in (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

VIII. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.