Privacy Policy for Website Operators in Accordance with the Ecclesiastical Data Protection Provision of the Congregation of Papal Law (KDR-OG)

Primus Service GmbH and Primus Malteser GmbH (hereinafter referred to as “Primus”) would like to thank you for visiting our website. We take data protection and data security during the use of our website very seriously. We would therefore like to take this opportunity to tell you which of your personal data we collect when you visit our website and the purposes for which it is used.

As changes to the law or our internal company processes may make it necessary to amend this Privacy Policy, we ask that you read this Privacy Policy regularly. The Privacy Policy can be accessed, saved, and printed under Privacy Policy at any time.

1. Controller and Scope of Application

The controller for the purposes of the Ecclesiastical Data Protection Provision of the Congregation of Papal Law (KDR-OG) and other provisions relevant to data protection is:

Primus Service GmbH
Unnauer Weg 5—7
50767 Cologne
Germany

Phone: +49-221-977-070
Email: kommunikation@primus-service.de
Website: www.primus-service.de

Primus, which can be accessed at www.daily-box.de and various subdomains (hereinafter referred to as “Our Website”).
You can find the text of the KDR-OG here.

2. Data Protection Officer

Dr. Karsten C. Ronnenberg
SoCura GmbH
Kaltenbornweg 3
50679 Cologne
Germany

datenschutzbeauftragter@malteser.org

3. Principles of Data Processing

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, information such as your name, your age, your address, your telephone number, your date of birth, your email address, your IP address, or your user behavior. Information that does not enable us to trace your identity (or would only enable us to do so with disproportionate effort), such as anonymized information, is not personal data. Personal data may only be processed (e.g. collected, accessed, used, stored, or transmitted) on the basis of legislation or your consent. Processed personal data will be deleted as soon as the purpose of the processing has been achieved and no further retention obligations prescribed by law apply.

If we process your personal data to provide certain services, we shall subsequently notify you about the specific processes, the scope, and the purpose of the data processing, the legal basis for processing, and the respective storage period.

4. Individual Processing Operations

1. Provision and Use of the Website

a. Nature and Scope of the Data Processing

When you access and use Our Website, we collect the personal data that your browser automatically transfers to our server. This information is temporarily stored in a log file. When you use Our Website, we collect the following data, which we need for technical reasons to display Our Website to you and to guarantee its stability and security:

IP address of the computer making the request,
Date and time of the access,
Name and URL of the file retrieved,
Content of the request (specific page),
Data quantity transferred each time,
Referrer URL,
Language and version of the browser software and, where relevant, your computer’s operating system and the name of your access provider

b. Legal Basis

Art. 6(1)(g) KDR-OG is the legal basis for processing the specified data. The specified data needs to be processed to display a website and this processing is therefore in our company’s legitimate interest.

c. Storage Period

The specified data is deleted as soon as it is no longer needed to display the website. Collecting data to display the website and storing data in log files is essential for operation of the website. The user cannot therefore opt out. Data may be stored for a longer period in specific cases if prescribed by law.

2. Contact Form

a. Type and Scope of the Data Processing

On Our Website we provide a form that enables you to contact us. When you submit your query via the contact form, you are referred to this Privacy Policy. If you make use of the contact form, the following personal data concerning you will be processed:

– Email address

You are asked to provide your email address to enable your query to be assigned and answered. Your personal data is not shared with third parties when you use the contact form.

b. Legal Basis

Art. 6(1)(g) KDR-OG shall serve as the legal basis for the data processing described previously (cf. Art. 4[5][a]). The data needs to be processed for the purpose of the communication you initiated with Primus and this processing is thus in our company’s legitimate interest. If you transfer specific categories of personal data (e.g. health data) to us in this manner, this will be processed on the basis of Art. 11(2)(e) KDR-OG because you are patently disclosing this data to Primus.

c. Storage Period

As soon as the query submitted by you has been completed and the matter in question has been conclusively dealt with, your personal data that was processed via the contact form will be deleted. Data may be stored for a longer period in specific cases if prescribed by law.

3. Job Applications

3.1 Online Applications

a. Type and Scope of the Data Processing

Application documents contain sensitive personal data. For that reason, Primus uses the “Prescreen” e-recruitment tool which avoids the security risks of email communication and ensures that your data is processed in accordance with data protection legislation. When you submit an application to us, you will be guided to an input form at the jobbase.io domain, which is operated by our processor Prescreen International GmbH, Mariahilfer Straße 17, 1060 Vienna, Austria (hereinafter referred to as “Prescreen”). Prescreen provides Primus with the personal data that you transfer to us in connection with your application (master data, CV, references, etc.).

b. Legal Basis

Art. 6(1)(c) KDR-OG serves as the legal basis for processing personal data that is required to perform precontractual measures at your request. This also applies to processing operations that are required for the performance of a contract to which you are a party.

If you specify that your personal data should be stored for a longer period of time even in the event of rejection, the legal basis is consent granted pursuant to Art. 6(1)(b) KDR-OG.

c. Storage Period

Should you be appointed, your data will be transferred to your personnel file at Primus. Data from rejected applicants will be stored for a maximum period of six months (or 24 months with consent), starting with the day on which the application was rejected. If you would like your data to be stored for a longer period, for instance to be considered for any subsequent job vacancies, please select the corresponding option on the application form. On expiry of the storage period, your data will be deleted by Prescreen automatically unless it needs to be processed to comply with a legal obligation or on other grounds pursuant to Art. 19(3) KDR-OG.

If you have consented to a longer storage period for your data, you may revoke this consent at any time with future effect. To do so, please email Primus at datenschutzbeauftragter@malteser.org.

3.2 Application by Email

a. Type and Scope of the Data Processing

You can also apply for various job vacancies at Primus by email via Our Website. In the course of your application, we collect your title, forename(s), surname, address, telephone number, email address, religion, CV, and data about your education and qualifications. Any additional information is optional. We store this data for a period of six months in the event of a rejection.

If you have provided us with separate consent, we will also store your data for 24 months so that your application can be considered for further vacancies. You can revoke your consent at any time with future effect by sending an informal email to our data protection officer at datenschutzbeauftragter@malteser.org.

b. Legal Basis

Art. 6(1)(g) KDR-OG is the legal basis for processing the specified data. The specified data needs to be processed to recruit new staff and such processing is therefore in our company’s legitimate interest. If you have provided your consent, the data processing is based on the declaration of consent voluntarily provided by you in accordance with Art. 6(1)(b) KDR-OG.

c. Storage Period

We will only store your data to the extent specified above. Data may be stored for a longer period in specific cases if prescribed by law.
We store your data until the abovementioned purposes have been satisfied and then delete it in a manner compliant with data protection legislation, provided the deletion is not precluded by any statutory retention obligations.

4. Participation in Satisfaction Surveys

a. Type and Scope of the Data Processing

To enable continual improvement of our offering, we occasionally give our customers the opportunity to provide feedback. If you take part in one of our online satisfaction surveys, you can provide your responses without submitting any personal data.

b. Legal Basis

If you provide us with personal data, we will process your data on the basis of our legitimate interest in using your feedback to improve our offerings pursuant to Art. 6(1)(g) KDR-OG. In this case you have the right to object to the processing at any time on grounds relating to your specific situation.

The online satisfaction surveys are provided by our processor qnips GmbH, Alexanderstraße 3, 30159 Hanover, Germany, with whom we have entered into an agreement for data processing in accordance with Art. 29 KDR-OG. You can obtain information about the processing of your data by qnips here: https://qnips.io/de/data-protection

c. Storage Period

We store your data until the abovementioned purposes have been satisfied and then delete it in a manner compliant with data protection legislation, provided the deletion is not precluded by any statutory retention obligations.

5. Sharing Data

We will only share your personal data with third parties if:
you have provided your express consent pursuant to Art. 6(1)(b) KDR-OG,
there is a statutory obligation to share the data under Art. 6(1)(d) KDR-OG,
this is permissible by law and is required under Art. 6(1)(c) KDR-OG to fulfil a contractual relationship with you,
sharing the data is necessary to preserve the controller’s legitimate interest pursuant to Art. 6(1)(g) KDR-OG, and there are no grounds to suspect that you have an overriding interest in your data not being shared.

6. Use of Cookies

a. Type and Scope of the Data Processing

We use cookies on Our Website. Cookies are small files that we send to the browser on your device when you visit our website and are then stored there. Some features of our website cannot be offered without the use of technically necessary cookies. Other cookies, meanwhile, enable us to perform various analyses. For instance, cookies can recognize your browser next time you visit Our Website and can transfer various information to us. Cookies can help us to make Our Website more user-friendly and effective, for example by allowing us to understand how you use Our Website and identify your preferred settings (e.g. country and language settings). If third parties use cookies to process information, they collect this information directly via your browser. Cookies do not cause any damage to your device. They cannot execute any programs and do not contain viruses.

Different types of cookies are used on Our Website. These types of cookies and the way in which they work are described in further detail below.

Type 1: Session Cookies

Our Website uses session cookies that are automatically deleted as soon as you close your browser. This type of cookie enables your session ID to be recorded. This enables multiple requests from your browser to be allocated to a single session and enables us to recognize your device next time you visit the website.

Type 2: Persistent Cookies

Our Website uses persistent cookies. Persistent cookies are cookies that are stored on your browser for a longer period of time and send information to us. The storage period varies depending on the cookie. You can delete persistent cookies yourself via your browser settings.

Function 1: Essential Cookies

These cookies are required for technical reasons to enable you to visit Our Website and use the features we offer. These include the following applications, for example:

Cookie information banner
WordPress content management system

These cookies also help to ensure secure and compliant use of the website.

Function 2: Performance-Related Cookies

These cookies enable us to analyze website use and to improve the performance and functionality of Our Website. For example, information is recorded about how Our Website is used by users, which pages are accessed most frequently, or whether error messages are being displayed on certain pages.

An overview of the cookies used and corresponding explanations can be found in our information about cookies.

b. Legal Basis

Based on the described purposes of use (cf. section 6. a.), the legal basis for processing personal data where cookies are used is set out in Art. 6(1)(g) KDR-OG. If you have given us your consent to use cookies via one of the references contained on the website (cookie banner), the lawfulness of the use will also be based on Art. 6(1)(b) KDR-OG.

c. Storage Period

As soon as the data transferred to us via cookies is no longer required to achieve the objectives described above, this information is deleted. Data may be stored for a longer period in specific cases if prescribed by law.

d. Configuring Your Browser Settings

Most browsers are configured to accept cookies by default. However, you can set up your browser to accept just certain cookies or none at all. However, please be aware that you may not be able to use all the features of Our Website if you disable cookies on our website via your browser settings. You can also delete cookies stored in your browser via your browser settings. It is also possible to configure your browser to notify you before cookies are saved. As different browsers may vary in terms of the way they work, please also refer to the help menu in your browser for configuration options.

If you would like a comprehensive overview of all instances of third-party access to your Internet browser, we recommend you install plugins specially developed for this purpose.

7. Tracking and Analysis Tools

We use tracking and analysis tools to ensure that Our Website is constantly optimized and meets users’ needs. Tracking measures also enable us to capture statistics on visitors’ usage of Our Website and to further develop our online offering for you based on the insights gleaned. Based on these interests, the use of the tracking and analysis tools described below is justified pursuant to Art. 6(1)(g) KDR-OG. The following description of the tracking and analysis tools also includes the respective purposes of processing and the data that is processed.

1. Google Analytics

This website uses Google Analytics, a Web analysis service of Google Ireland Limited, Google Building, Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland (“Google”).
Google Analytics uses cookies, which are text files that are saved on your computer and enable your use of the website to be analyzed.

The information generated by the cookies, such as the time, place, and frequency of your website use, is usually transferred to one of Google’s servers in the USA and stored there. When using Google Analytics, it is possible that the cookies set by Google Analytics may record other personal data in addition to the IP address. Please note that Google may also transfer this information to third parties if this is required by law or where third parties process this data on Google’s behalf.

Google uses the information generated via cookies on behalf of the operator of this website to analyze your usage of the website, to compile reports on website activity, and to provide further services connected to the use of the website and Internet for the benefit of the website operator. Google states that it will not associate the IP address transmitted by your browser in connection with Google Analytics with any other data held by Google.

We will only store your data collected via Google Analytics for such time as we require it for the purpose described above, up to a maximum of 26 months.

You can prevent cookies from being set by setting your browser software accordingly. However, please note that in this case you may not be able to use all the features of this website.

It is possible that the cookies set by Google Analytics may record other personal data in addition to the IP address. If you want to prevent information about your use of the website being collected by Google Analytics and transferred to Google Analytics, you can download and install a plugin for your browser by clicking on the following link: http://tools.google.com/dlpage/gaoptout?hl=de

This plugin prevents information about your visit to the website from being transmitted to Google Analytics. This plugin does not prevent any other type of analysis.

Please note that you cannot use the browser plugin described above when visiting Our Website via the browser on a mobile device (smartphone or tablet). When using a mobile device, you can prevent your usage data from being captured by Google Analytics by clicking on the following link: Disable Google Analytics.

Clicking on this link sets an opt-out cookie in your browser. This prevents information about your visit to the website from being transmitted to Google Analytics. Please note that the opt-out cookie is only valid for this browser and only for this domain. If you delete the cookies in this browser, the opt-out cookie will also be deleted. To prevent further data from being captured by Google Analytics, you need to click on the link again. The opt-out cookie can also be used as an alternative to the above plugin when using the browser on your computer.

To ensure the best possible protection of your personal data, Google Analytics has been enhanced with the code “anonymizeIp” on this website. The effect of this code is that the last 8 bits of the IP addresses are deleted and your IP address is therefore captured anonymously (known as IP masking). Your IP address is normally shortened and thus anonymized by Google within the Member States of the European Union or in other signatory states to the Agreement on the European Economic Area prior to being transferred. Only in exceptional cases will the full IP address be transferred to one of Google’s servers in the USA and shortened there.

2. Google AdWords

We use Google AdWords technology, specifically conversion tracking. Google Conversion Tracking is an analysis service of Google Ireland Limited, Google Building, Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland (“Google”). If you click on an ad placed by Google, a cookie for conversion tracking is stored on your PC. The cookies are valid for 30 days and cannot be used to identify individuals. If you visit certain pages on Our Website when the cookie has not yet expired, we and Google can tell that you have clicked on a certain advert and been forwarded to this page. Each Google AdWords customer receives a different cookie. This means that it is not possible to trace cookies across the websites of AdWords customers.

The purpose of the data obtained using the conversion cookie is to create conversion statistics for AdWords customers that use conversion tracking. The customers are provided with information about the number of users who have clicked on their advert and been forwarded to a page containing a conversion tracking tag. However, they do not receive any information allowing users to be personally identified.

You can opt out of conversion tracking via a corresponding setting on your browser, e.g. by preventing any cookies from being set. You can also disable cookies for conversion tracking by configuring your browser so that only cookies from the Web address “googleadservices.com” are blocked.

3. Google Remarketing

We use Google Remarketing technology provided by Google Ireland Limited, Google Building, Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland (“Google”). Google Remarketing displays adverts for users who have already visited Our Websites and online services and have shown interest in a specific offer. This enables targeted, interest-based adverts to be displayed on our page within the Google advertising network. Google Remarketing uses cookies for this analysis, which enables our users to be recognized as soon as they access websites within the Google advertising network. Within the Google advertising network, adverts can be displayed in a targeted and interest-based manner based on which other websites within the Google advertising network (that also use the Google Remarketing function) the user has previously visited.

If you do not want to see targeted, interest-based advertising, you can disable Google’s use of cookies for these purposes via the link: https://www.google.de/settings/ads.

4. MyFonts

We use fonts on Our Website which are provided by MyFonts Inc., 600 Unicorn Park Drive, Woburn, MA 01801, USA. Data from a MyFonts server is retrieved when the website is accessed and MyFonts is made aware of at least your IP address in order to improve usage of Our Website. MyFonts is also informed that you have retrieved the font via Our Website, and is further given some technical information about your browser, as almost every Web browser automatically sends this data to the server each time it is accessed. Some browsers permit the data sent to the server to be restricted or modified, although whether this is possible depends on the manufacturer of the browser. MyFonts states that it only needs the transferred information, in particular the IP address, to provide the retrieved content. Further information on data processing by MyFonts can be accessed via the following link: https://www.monotype.com/legal/privacy-policy/web-font-tracking-privacy-policy//.

5. Google Tag Manager

We use Google Tag Manager, which is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that we use to integrate tracking or statistical tools and other technologies into Our Website. Google Tag Manager itself does not create any user profiles, does not store any cookies, and does not perform any autonomous analyses. Its sole purpose is to maintain and deploy the tools which it is used to integrate. However, Google Tag Manager does collect your IP address, which may also be transferred to Google’s parent company in the United States.

Google Tag Manager is utilized on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the rapid, straightforward integration and management of various tools on its website. If corresponding consent has been requested, processing is performed exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) German Telecommunications and Telemedia Data Protection Act (TTDSG), where the consent relates to the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TTDSG. The consent may be revoked at any time.

8. Rights of Data Subjects

As a data subject whose personal data is processed, you have the following rights under KDR-OG:

Under Art. 17 KDR-OG you have a right to obtain information about the personal data concerning you that we process. In particular, you may obtain information about the purposes of processing, the categories of the personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of the right to rectification, erasure, restriction of processing, or objection, the existence of the right to lodge a complaint, the origin of your data if it was not collected by us, about a transfer to third countries or to international organizations, as well as the existence of automated decision-making including profiling, and if applicable meaningful information about the details.
Pursuant to Art. 18 KDR-OG, you can request the rectification of incorrect or the completion of incomplete personal data concerning you without undue delay.
Pursuant to Art. 19 KDR-OG, you may request the erasure of personal data concerning you which is stored by us, unless its processing is required to exercise the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defense of legal claims.
Pursuant to Art. 20 KDR-OG, you may request that the processing of your personal data be restricted if you dispute the accuracy of the data, if the processing is unlawful, or if we no longer require the data and you object to its erasure because you require it for the establishment, exercise, or defense of legal claims. You may also exercise the right under Art. 18 KDR-OG if you have lodged an objection to processing pursuant to Art. 23 KDR-OG.
Pursuant to Art. 22 KDR-OG, you may request a copy of the personal data concerning you that you have supplied to us in a structured, commonly used, and machine-readable format. Alternatively, you can request transmission of this data to another data processor.
Pursuant to Art. 8(6) KDR-OG, you can withdraw from us any consent granted at any time. The consequence of this is that we are not permitted to continue with any data processing based on this consent in the future.
To exercise your rights as a data subject, please contact: datenschutz@primus-service.de so that we can deal with your matter promptly.
Pursuant to Art. 48 KDR-OG, you have the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority at your regular place of residence, your place of work, or our registered office for this purpose. If you believe that your data has been unlawfully processed by the controller or that your rights as a data subject have been infringed, please contact the supervisory authority:
Data Protection Officer of the Order
Mr Dieter Fuchs (attorney)
Wittelsbacherring 9
53115 Bonn
Germany
Phone: +49-211-5160-6630
Email: fuchs@orden.de

9. Right to Object

Where your data is processed on the basis of legitimate interests pursuant to Art. 6(1)(g) KDR-OG, you have the right under Art. 23 KDR-OG to object to the processing of your personal data provided there are grounds for doing so based on your specific situation or the objection relates to direct advertising. In case of direct advertising, you have a general right to object which we will action without any information about your specific situation.

10. Data Privacy and Security Measures

We undertake to protect your privacy and to treat your personal data confidentially. To prevent manipulation, loss, or misuse of the data stored by us, we take extensive technical and organizational security precautions that are regularly reviewed and modified in line with technological progress. These include the use of recognized encryption processes (SSL or TLS). However, please note that, given the structure of the Internet, it is possible that data protection rules and the above security measures may not be observed by other individuals or institutions outside our sphere of responsibility. In particular, data that is disclosed without encryption—e.g. via email—may be intercepted by third parties. We have no technical means of influencing this. It is the user’s responsibility to protect data provided by him or her from misuse using encryption or other methods.