Data protection – SSF Ingenieure AG

Privacy policy in accordance with the General Data Protection Regulation (GDPR)


Privacy Policy \| SSF Ingenieure AG As of 15 June 2026 1. Who we are The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is: SSF Ingenieure AG Domagkstr. 1a 80807 Munich Germany +49 (0) 89 360 40 100 datenschutz@ssf-ing.de www.ssf-ing.de 2. Contacting the Data Protection Officer The data protection officer of the controller is: DataCo GmbH Sandstraße 33 80335 Munich Germany +49 89 7400 45840 www.dataguard.de On this page, we provide information about the processing of your personal data on the website (https://www.ssf-ing.de/) or on our social media profiles on LinkedIn, XING, Instagram, Facebook or YouTube. This privacy policy also applies if you contact us by email, telephone or post. Further information on data protection can be found via the links below: Privacy notice for applicants (German only): https://karriere.ssf-ing.de/datenschutz-karriere.html How we collect and use your personal data depends on how you interact with us or which services you use. We only collect, use or share your personal data if we have a legitimate purpose and a legal basis for doing so. 3. What do we mean by legal basis? Consent (Art. 6 I lit a GDPR) – You have given us your consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. Further information on how to withdraw your consent can be found in the sub-sections entitled “Exercising your rights” in the following sections of this privacy policy. Contract (Art. 6(1)(b) GDPR) – We need to use your data to fulfil a contract you have with us. Alternatively, it is necessary to use your data because we have asked you to do so or because you have taken certain steps yourself prior to entering into this contract. Legal obligation (Art. 6(1)(c) GDPR) – We need to use your data to comply with the law. Vital interests (Art. 6(1)(d) GDPR) – The processing of your data is necessary to protect your vital interests or those of another person. For example, to protect you from serious physical harm. Public task (Art. 6(1)(e) GDPR) – The processing of your data is necessary for the performance of a task carried out in the public interest or because it is covered by a statutory duty, e.g. for a statutory function. Legitimate interests (Art. 6(1)(f) GDPR) – The processing of your data is necessary to support a legitimate interest that we or another party have, provided that your own interests do not override this. Please note that we may not be able to provide you with our website services if your data is processed to fulfil a contract or a legal obligation and you do not provide the requested data. 4. Data sharing and international transfers As explained in this privacy policy, we use various service providers who help us to provide our services and ensure the security of your data. When we use these service providers, it is necessary for us to share your personal data with them. We have entered into agreements with all service providers to whom we disclose your data, obliging them to protect your data. If your personal data is transferred outside the EU, we ensure that your personal data receives an equivalent level of protection , either because the country to which your data is transferred has an ‘adequate’ data protection standard in accordance with the European Commission, or by applying another safeguard, such as an enhanced contractual arrangement, i.e. the Standard Contractual Clauses (SCCs) adopted by the European Commission. For example, when we use US service providers, we rely either on the SCCs or the EU-US Data Privacy Framework, depending on the provider. You may request a copy of the SCCs we have entered into with our service providers by sending an email to the email address provided in this Privacy Policy. 5. Your rights If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller: The right of access (Art. 15 GDPR) You have the right to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have the right to access this data and to the following information: Purposes of processing Categories of personal data Recipients or categories of recipients Planned storage period or the criteria for determining this period the existence of the rights to rectification, erasure, restriction or objection Right to lodge a complaint with the competent supervisory authority Where applicable, the origin of the data (if collected from a third party) Where applicable, the existence of automated decision-making, including profiling, with meaningful information about the logic involved, the scope and the expected consequences Where applicable, transfer of personal data to a third country or international organisation 5.2. Right to rectification (Art. 16 GDPR) If your personal data is inaccurate or incomplete, you have the right to request that the personal data be rectified or completed without undue delay. 5.3. Right to restriction of processing (Art. 18 GDPR) Provided that one of the following conditions is met, you have the right to request a restriction on the processing of your personal data: You contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data. In the context of unlawful processing, you object to the erasure of the personal data and instead request the restriction of the use of the personal data. We no longer require your personal data for the purposes of processing, but you require your personal data to establish, exercise or defend your legal claims, or after you have objected to the processing, for the duration of the assessment of whether our legitimate grounds override your interests. 5.4. Right to erasure (right to be forgotten’) (Art. 17 GDPR) If any of the following reasons apply, you have the right to request the immediate erasure of your personal data: Your data is no longer necessary for the purposes for which it was originally collected. You have withdrawn your consent and there is no other legal basis for the processing. You object to the processing and there are no overriding legitimate grounds for the processing, or you object in accordance with Article 21(2) of the GDPR. Your personal data is being processed unlawfully. Erasure is necessary to comply with a legal obligation under Union law or the law of the Member State to which we are subject. The personal data was collected in relation to information society services offered in accordance with Article 8(1) of the GDPR. Please note that the above reasons do not apply where processing is necessary: To exercise the right to freedom of expression and information; To comply with a legal obligation or to perform a task carried out in the public interest to which we are subject; For reasons of public interest in the area of public health. For archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes. To establish, exercise or defend legal claims. 5.5. Right to data portability (Art. 20 GDPR) You have the right to receive your personal data in a structured, commonly used and machine-readable format or to request that it be transferred to another controller. 5.6. Right to Object to Certain Data Processing (Art. 21 GDPR) You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6(1)(a) or (f) of the GDPR. This also applies to profiling based on these provisions. If personal data relating to you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing; this also applies to profiling, insofar as it is related to such direct marketing. 5.7. Right to lodge a complaint with a supervisory authority Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR. The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR. A list of the supervisory authorities with local jurisdiction in Germany can be found on the website of the Federal Commissioner for Data Protection at the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html The supervisory authority responsible for SSF is the Bavarian State Office for Data Protection Supervision (BayLDA). You can contact them at: The Bavarian State Office for Data Protection Supervision (BayLDA) Promenade 18, 91522 Ansbach Postal address: PO Box 1349, 91504 Ansbach Telephone: 0981/ 180093-0 Fax: 0981/ 180093-800 Email: poststelle@lda.bayern.de Website: www.lda.bayern.de 6. How is your data processed? SSF collects and processes various categories of personal data, depending on the specific processing situation. We process your personal data exclusively in accordance with the provisions of the General Data Protection Regulation (“GDPR”) and the Federal Data Protection Act (“BDSG”). Below you will find a list of the personal data we process depending on the specific processing situation, the purposes for which this data is processed, and the legal basis on which we process the data. 6.1. Provision of the website and creation of log files 6.1.1. Description and scope of data processing Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected in this process: Information about the browser type and version used The user’s operating system The user’s internet service provider Date and time of access Websites from which the user’s system accesses our website Websites accessed by the user’s system via our website This data is stored in our system’s log files. This data is not stored together with other personal data relating to the user. 6.1.2. Purpose of data processing The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session. The data is stored in log files to ensure the website functions properly. The data also helps us to optimise the website and ensure the security of our IT systems. The data is not analysed for marketing purposes in this context. 6.1.3. Legal basis for data processing The legal basis for the temporary storage of data and log files is Article 6(1)(f) of the GDPR. 6.1.4. Duration of storage The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of data being collected for the provision of the website, this is the case once the respective session has ended. In the case of data stored in log files, this occurs after seven days at the latest. Storage beyond this period is possible. In this case, users’ IP addresses are deleted or anonymised so that the client making the request can no longer be identified. 6.1.5. Exercising your rights The collection of data for the provision of the website and the storage of data in log files is strictly necessary for the operation of the website. The user may object to this. Whether the objection is successful must be determined by weighing up the respective interests. 6.2. Use of cookies 6.2.1. Description and scope of data processing When you visit our website, we use technical tools for various functions, in particular cookies, which may be stored on your device. When you access our website and at any time thereafter, you have the choice of whether to allow cookies in general or which specific additional functions you wish to select. You can make changes in your browser settings or via our Consent Manager. Cookies are text files or information in a database that are stored on your hard drive and assigned to the browser you are using, so that certain information can be sent to the entity setting the cookie. Below, we describe the types of cookies we use: We use technically necessary cookies that are required for the technical structure of the website. Without these cookies, our website cannot be displayed (correctly), or the support functions will not work. The following data is stored and transmitted by the technically necessary cookies: Language settings Saving cookie consent We use cookies on our website that are not technically necessary. Text files that do not serve solely to ensure the functionality of the website, but also collect other data, are considered technically non-essential cookies. The following data is processed when technically non-essential cookies are set: IP address Location of the internet user Date and time of the website visit Tracking of browsing behaviour 6.2.2. Purpose of data processing The purpose of using technically necessary cookies is to ensure the functionality of our website. Some features of our website cannot be provided without the use of cookies. For these, it is necessary for the browser to be recognised even after a page change. We require technically necessary cookies for the following applications: Saving language settings Saving cookie consent Technically non-essential cookies are used to improve the quality of our website, its content and, consequently, our reach and cost-effectiveness. By setting these cookies, we learn how the website is used and can thus continuously optimise our offering. In particular, these cookies serve the following purposes: Non-essential cookies are used for statistical purposes. 6.2.3. Legal basis for data processing The provisions of the Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services (TDDDG) apply to the storage of information on the end user’s device and/or access to information already stored on the end user’s device. Where the setting and reading of cookies is technically necessary, this is done to ensure the functionality of our website. In this case, the storage of and access to cookies on your terminal equipment is based on Section 25(2)(2) of the TDDDG. This storage and access to the information on your terminal equipment serves to facilitate your use of our website and to enable us to offer you our services as you have requested. Some functions of our website also do not work without the use of these cookies and could therefore not be offered. Cookies are generally deleted at the end of the session (e.g. logging out or closing the browser) or after a specified period has elapsed. Information on different storage periods for cookies can be found in the following sections of this privacy policy. Where cookies are used that are not technically necessary, this is done on the basis of your explicit consent, which you can give via the cookie banner. In this case, the legal basis for the storage of and access to information is Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) and Article 7 of the GDPR. You may withdraw your consent at any time with future effect or subsequently grant it again by configuring your cookie settings accordingly. Alternatively, you can prevent the storage of cookies by adjusting the settings in your browser software. Please note that the browser settings you make only apply to the browser you are currently using. If personal data is processed following the storage of and access to the information on your device, the provisions of the GDPR apply. You can find further information on this in the following sections of this privacy policy. 6.2.4. Exercising your rights You may withdraw your consent to the use of cookies at any time and manage your consent preferences under the ‘Consent’ tab at the bottom of the website. 6.3. Contact by email, telephone or post 6.3.1. Description and scope of data processing You can contact us via the email address provided on our website. In this case, the user’s personal data transmitted with the email will be stored. When you contact us, we process the following personal data in particular: First name and surname, email address, Time of the enquiry, Telephone number (if contact is made by telephone) Information you provide when contacting us. The data is used exclusively for the purpose of processing the conversation. 6.3.2. Purpose of data processing In the case of contact via email, this also constitutes the necessary legitimate interest in the processing of the data. 6.3.3. Legal basis for data processing The legal basis for processing the data transmitted when sending an email is Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing the best possible response to your enquiry sent by email. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. 6.3.4. Duration of storage The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. For personal data sent by email, this is the case once the relevant conversation with the user has ended. The conversation is deemed to have ended when it is clear from the circumstances that the matter in question has been conclusively resolved. Any additional personal data collected during the sending process will be deleted after a period of seven days at the latest. 6.3.5. Exercising your rights If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of the contact will be deleted in this case. 6.4. Job applications 6.4.1. Description and scope of data processing An application form is available on our website, which can be used for electronic applications. If an applicant makes use of this option, the data entered in the form will be transmitted to us and stored. This data includes: Title Surname First name Address Telephone/mobile number Email address Salary expectations CV References Photo (if provided voluntarily) Potential start date Once the application has been submitted, the applicant will receive confirmation from us that we have received their application documents. No data will be passed on to third parties. The data will be used exclusively for the processing of the application. 6.4.2. Purpose of data processing We process the personal data from the application form solely for the purpose of processing your application. The other personal data processed during the submission process is used to prevent misuse of the application form and to ensure the security of our IT systems. 6.4.3. Legal basis for data processing The legal basis for the processing of your data is the initiation of a contract, which takes place at the request of the data subject, Article 6(1)(b)(1) of the GDPR and Section 26(1)(1) of the BDSG. 6.4.4. Duration of storage Once the application process has been completed, the data will be stored for up to 6 months. Your data will be deleted no later than 6 months after this period. In the event of a legal obligation, the data will be stored in accordance with the applicable provisions. Any additional personal data collected during the submission process will be deleted no later than seven days after submission. Further information can be found in our “Data Protection Notice for Applicants ”. 6.5. Company websites 6.5.1. Integration of social media on our website On our website, we deliberately do not use the plugins offered by social media services, but merely provide links to LinkedIn, Facebook, Instagram and YouTube. Therefore, simply visiting our website does not result in any user data being transmitted to the servers of the social media providers. Only when you click on a social media button a connection will be established between your browser and the server of the respective social media service, and you will be redirected to the websites of these services. We do not collect any personal data via these buttons on our pages and therefore do not transmit any data to the social media providers. 6.5.2. Social media profiles 6.5.2.1. General information and joint responsibility with LinkedIn, Facebook and Instagram We maintain publicly accessible profiles on various social networks (LinkedIn, XING, Instagram, Facebook and YouTube) to report on the latest developments within our company and to connect with customers and other interested parties. We are currently active on the following social media platforms: Instagram: Instagram, part of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland You can find the privacy policy for our Instagram fan page via the following link (German only): https://www.ssf-ing.de/datenschutzerklaerung-instagram/ Facebook: Facebook, part of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland The privacy policy for our Facebook fan page can be found at the following link: https://www.ssf-ing.de/datenschutz-fb/ YouTube: YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, United States On our company page, we provide information and offer YouTube users the opportunity to communicate. If you carry out an action on our YouTube corporate page (e.g. comments, posts, likes, etc.), you may thereby make personal data (e.g. your real name or user profile photo) public. However, as we generally have little or no influence over the processing of your personal data by YouTube, we cannot make any binding statements regarding the purpose and scope of the processing of your data. We use our corporate presence on social networks for communication and the exchange of information with (potential) customers. In particular, we use our corporate presence for showcasing our projects, events, internal company events and job vacancies. In this way, we inform interested parties about our company and offer an opportunity for mutual exchange. In this context, posts on our corporate social media presence may contain the following content: Information about services Internal and external events Users are free to publish personal data through their activities. Where we process your personal data to analyse your online behaviour, offer you competitions or conduct lead generation campaigns, we do so on the basis of your explicit declaration of consent, Article 6(1)(a) and Article 7 of the GDPR. The legal basis for the processing of personal data for the purpose of communicating with customers and prospective customers is Article 6(1)(f) of the GDPR. Our legitimate interest in this regard is to respond to your enquiry in the best possible way and to be able to provide the requested information. If the purpose of contacting you is to conclude a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR. For the processing of your personal data in third countries, we have put in place appropriate safeguards in the form of standard contractual clauses in accordance with Article 46(2)(c) of the GDPR. A copy of the standard contractual clauses can be requested from us. You may object at any time to the processing of your personal data that we collect in connection with your use of our website and exercise your rights as a data subject, as set out in the “Your Rights” section of this privacy policy. To do so, please send us an informal email to datenschutz@ssf-ing.de. For further information on the processing of your personal data by YouTube and the relevant options for objecting, please see here: YouTube: https://policies.google.com/privacy?gl=DE&hl=en 6.5.2.2. Use of company profiles on professional networking sites 6.5.2.2.1. Scope of data processing The company profile is used for job applications, information/PR and active sourcing. We do not have any information regarding the processing of your personal data by the companies jointly responsible for the company profile. Further information on this can be found in the privacy policy of: LinkedIn: https://www.linkedin.com/legal/privacy-policy XING: https://privacy.xing.com/de On our site, we provide information and offer users the opportunity to communicate. If you carry out an action on our company website (e.g. comments, posts, likes, etc.), you may thereby make personal data (e.g. your real name or photo from your user profile) public. Xing is the sole controller within the meaning of Article 4(7) of the GDPR for the processing of user and profile data, in particular information regarding usage activities. We ourselves do not process any personal data in this regard. Xing provides information on the data processed by Xing, including the purposes of processing and legal bases, via its privacy policy. 6.5.2.2.2. Legal basis for data processing The legal basis for the processing of personal data for the purpose of communicating with customers and prospective customers is Article 6(1)(f) of the GDPR. Our legitimate interest in this regard is to respond to your enquiry in the best possible way and to be able to provide the requested information. If the purpose of making contact is to conclude a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. 6.5.2.2.3. Purpose of data processing Our website serves to inform users about our services. In doing so, every user is free to publish personal data through their activities. 6.5.2.2.4. Duration of storage The data generated by the company website is not stored in our own systems. 6.5.2.2.5. Exercising your rights You may object at any time to the processing of your personal data that we collect in connection with your use of our website and exercise your rights as a data subject, as set out in the ‘Your rights’ section of this privacy policy. To do so, please send us an informal email to the email address provided in this privacy policy. Further information on exercising your rights can be found here: LinkedIn: https://www.linkedin.com/legal/privacy-policy XING: https://privacy.xing.com/en Joint controllership: The following providers supply us with anonymous usage statistics, which we use to improve the user experience when visiting our pages: LinkedIn, Instagram and Facebook We do not have access to the usage data collected by the providers for the purpose of compiling these statistics. Nevertheless, there is a joint responsibility between us and the providers – LinkedIn, Instagram and Facebook – who compile such usage statistics, with regard to the data processing operations involved, in accordance with Article 26 of the GDPR. Where videos are embedded on our websites, there is joint responsibility regarding the processing of personal data collected by Google (YouTube) within the meaning of Article 26 GDPR. As “joint controllers”, we are jointly responsible for the processing and must ensure compliance with applicable data protection law. In this context, we have concluded a joint controller agreement with the providers in accordance with Article 26(2) of the GDPR, and the providers have undertaken to us to assume primary responsibility under the GDPR for the processing of this data, to fulfil all obligations under the GDPR with regard to this data, and to make the essential details of this obligation available to the data subjects. 6.6. Hosting The website is hosted on servers by a service provider commissioned by us. Our service provider is: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany Further information on the processing of personal data by Hetzner can be found at: https://www.hetzner.com/legal/privacy-policy The servers automatically collect and store information in so-called server log files, which your browser transmits automatically when you visit the website. The information stored is: Information about the browser type and version used The user’s operating system The user’s internet service provider Date and time of access Websites from which the user’s system accesses our website Websites accessed by the user’s system via our website This data is not combined with other data sources. The collection of this data is based on Article 6(1)(f) of the GDPR. Our legitimate interest in processing this data is to ensure our website is displayed correctly and to optimise its functions. The website server is geographically located in Germany. 6.7. Cookies As explained in the individual sections, social media providers use so-called cookies, which are stored on your device when you visit our social media pages, even if you do not have your own profile or are not logged into it whilst visiting our site. These cookies allow the providers to create user profiles based on your preferences and interests and to display tailored advertising to you. Cookies remain on your device until you delete them. Further details can be found in the providers’ privacy policies and in this privacy policy. Further information on data processing in connection with cookies can be found in the providers’ cookie policies: Facebook: https://privacycenter.instagram.com/policies/cookies/ Instagram: https://privacycenter.instagram.com/policies/cookies/ YouTube: https://policies.google.com/technologies/cookies?hl=de&gl=de LinkedIn: https://de.linkedin.com/legal/cookie-policy?_l=de_DE 6.8. Integrated third-party services We use various service providers to deliver the services we offer on the website. In general, we have a legitimate interest in sharing your data with the relevant service providers where these services are essential for the provision of the core service offered on the website, in order to provide the relevant website service. If such services are required for additional services, extended functions or additional purposes, your personal data will only be passed on to service providers if you give your consent. You can withdraw your consent to the use of integrated third-party services and manage your consent settings at any time here: https://www.ssf-ing.de/ 6.8.1. Use of Wordfence Security 6.8.1.1. Scope of personal data processing Our website uses features provided by Defiant Inc., 800 5th Ave., Suite 4100, Seattle, WA 98104, USA (hereinafter referred to as ‘Defiant’). Wordfence Security secures our website and thereby protects visitors to the website from viruses and malware. When you visit a page with the plugin, a direct connection is established between your computer and the Defiant server. To determine whether the visitor is a human or a bot, the plugin sets cookies. This may result in further personal data being stored and analysed, particularly device and browser information (in particular the IP address and the operating system). It is possible to analyse behaviour based on the notifications sent (e.g. how often a page is visited). For the purpose of protection against brute-force and DDoS attacks or comment spam, IP addresses are stored on the Wordfence servers. IP addresses classified as harmless are placed on a whitelist. Further information on the processing of data by Defiant can be found here: https://www.wordfence.com/privacy-policy/ 6.8.1.2. Purpose of data processing The website uses the plugin to protect against viruses and malware and to defend against attacks by cybercriminals. 6.8.1.3. Legal basis for the processing of personal data The legal basis for the processing of users’ personal data is, in principle, the user’s consent in accordance with Article 6(1)(a) of the GDPR. 6.8.1.4. Duration of storage Your personal information will be stored for as long as is necessary to fulfil the purposes described in this privacy policy or as required by law, e.g. for tax and accounting purposes. 6.8.1.5. Exercising your rights You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of processing carried out on the basis of your consent prior to its withdrawal. You can prevent the collection and processing of your personal data by Wordfence Security by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. Further information on options for objecting to and removing data processed by Wordfence Security can be found at: https://www.wordfence.com/privacy-policy/ 6.8.2. Use of YouTube videos 6.8.2.1. Scope of processing of personal data We use the YouTube plugin operated by Google, YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA, and its representative in the EU, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as ‘Google’). We use the YouTube plugin to embed YouTube videos on our website. The integration of YouTube videos allows you to view the videos easily and conveniently directly via our website. YouTube videos are embedded in ‘enhanced privacy mode’. According to the provider, this means that simply visiting our website does not result in any data about you as a user being transmitted to YouTube, nor are any user profiles created, provided you do not play the video. The display of these videos is also disabled by default on our website. As a result, simply visiting a page on which a video is embedded does not result in YouTube setting any cookies or any data about you as a user being transmitted to YouTube. Only after you deliberately click the ‘Load YouTube’ button will the video be loaded and a connection established to the YouTube server. Cookies are not set in ‘enhanced privacy mode’. By clicking the “Load YouTube” button or accepting the use of YouTube via the cookie banner, you consent to the data processing carried out by third-party providers as a result. 6.8.2.2. Categories of personal data Once this function is enabled by clicking the “Activate video” button, the videos are loaded on our website and YouTube receives the URL of the currently loaded webpage, the IP address of the device you are using, and, where applicable, further device-specific information (e.g. browser type). This occurs regardless of whether you have a member account or not. If you have a member account and are logged in, your data may also be directly linked to your account by YouTube (e.g. which video you are watching). You can prevent this by logging out of your member account before playing a video. Furthermore, after playing a YouTube video, further data processing operations may be triggered by YouTube, of which we have no precise knowledge and over which we have no influence. 6.8.2.3. Purposes and legal basis of data processing Processing takes place exclusively for the purpose of providing videos and presenting our company. Data is only transferred to YouTube if, when playing a YouTube video, you have given us your consent via the “Activate video” button in accordance with Article 6(1)(a) of the GDPR. Please refer to the privacy policy of the respective provider (see above) for the legal basis on which they process your data. 6.8.2.4. Withdrawal and deactivation You can prevent the transmission of information to Google at any time by not playing the videos embedded on our website. 6.8.2.5. Retention period Specific details regarding the storage period can be found in YouTube’s privacy policy linked above. 6.8.2.6. Recipients Within the European Union, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’) is the data controller for this service. Where personal data is also transferred to and stored on Google’s servers in the USA, the recipient is usually also the US company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When data is transferred to the USA, compliance with the data protection standards and your rights is ensured, according to Google, by means of appropriate safeguards (e.g. standard contractual clauses). Google LLC is also certified under the EU-US Data Privacy Framework. Further information on the purpose and scope of data collection and processing by YouTube, as well as your rights and settings options for protecting your privacy, can be found in YouTube’s privacy policy. 6.8.2.7. Exercising your rights You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawing your consent does not affect the lawfulness of processing carried out on the basis of your consent prior to withdrawal. You can prevent the collection and processing of your personal data by Google by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. You can disable the use of your personal data by Google via the following link: https://adssettings.google.de Further information on options for objecting to and removing data from Google can be found at: https://policies.google.com/privacy?gl=DE&hl=de 6.8.3. Use of WPML 6.8.3.1. Scope of personal data processing We use WPML from OnTheGoSystems Limited, 22/F 3 Lockhart Road, Wanchai, Hong Kong (hereinafter referred to as WPML). WPML is a multilingual plugin for WordPress. We use WPML to display our website in different languages. When you visit our website, WPML stores a cookie on your device to save your chosen language setting. This may result in the storage and analysis of personal data, primarily the user’s activity (in particular, which pages have been visited, and which elements have been clicked on) as well as device and browser information (in particular, the IP address and the operating system). Further information on the processing of data by WPML can be found here: https://wpml.org/de/documentation-3/privacy-policy-and-gdpr-compliance/ 6.8.3.2. Purpose of the processing of personal data The use of WPML serves to enable us to present our online presence in multiple languages. 6.8.3.3. Legal basis for the processing of personal data The legal basis for data processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in addressing visitors to our website in their native language. 6.8.3.4. Duration of storage WPML stores cookies on your device. Information on the storage period of the cookies can be found at: https://wpml.org/documentation/privacy-policy-and-DSGVO-compliance 6.8.3.5. Exercising your rights You can prevent the collection and processing of your personal data by WPML by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. Further information on options for objecting to and removing data processed by WPML can be found at: https://wpml.org/de/documentation-3/privacy-policy-and-gdpr-compliance/ 6.8.4. Use of etracker 6.8.4.1. Scope of processing of personal data We use the etracker analytics service provided by etracker GmbH, Erste Brunnenstraße 1, 20459, Hamburg, Germany (hereinafter referred to as ‘etracker’). Cookies are used in this process, which enable a statistical analysis of how visitors use this website, as well as the display of usage-related content or advertising. This may result in the storage and analysis of personal data, primarily the user’s activity (in particular, which pages have been visited and which elements have been clicked on), as well as device and browser information (in particular, the IP address, login and device ID, and the operating system).The data generated in this way is processed and stored by etracker exclusively in Germany and is therefore subject to strict German and European data protection laws and standards. Further information on the processing of data by etracker is available here: https://www.etracker.com/datenschutz/ 6.8.4.2. Purpose of data processing The processing of users’ personal data by etracker enables us to analyse our users’ browsing behaviour. By evaluating the data collected, we are able to compile information on the use of the individual components of our service. This helps us to continuously improve our online presence and, in this context, also to enhance user-friendliness. 6.8.4.3. Legal basis for the processing of personal data The legal basis for the processing of users’ personal data is, in principle, the user’s consent in accordance with Article 6(1)(a) of the GDPR. 6.8.4.4. Duration of storage Your personal information will be retained for as long as is necessary to fulfil the purposes set out in this privacy policy or as required by law, e.g. for tax and accounting purposes. 6.8.4.5. Exercising your rights You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal. You can prevent the collection and processing of your personal data by etracker by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. Further information on options for objecting to and removing etracker data can be found at: https://www.etracker.com/datenschutz/ 6.8.5. Use of Borlabs cookies 6.8.5.1. Scope of processing of personal data We use features of the Borlabs Cookie consent solution provided by Borlabs – Benjamin A. Bornschein, Georg-Wilhelm-Str. 17, 21107 Hamburg, Germany (hereinafter referred to as Borlabs). Borlabs enables us to obtain, manage and document users’ consent to data processing in a legally compliant manner. To this end, Borlabs places cookies on the user’s device. The following data is processed: Cookie duration Cookie version Domain and path of the website Opt-in and opt-out data UID (randomly generated user ID) Further information on the processing of data by Borlabs is available here: https://de.borlabs.io/datenschutz/ 6.8.5.2. Purpose of data processing The processing of personal data serves to comply with the legal obligations under the GDPR and the BDSG. 6.8.5.3. Legal basis for the processing of personal data The legal basis for the processing of users’ personal data is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the purposes set out in section 2. 6.8.5.4. Duration of storage Your personal information will be stored for as long as is necessary to fulfil the purposes described in this privacy policy, or as required by law. 6.8.5.5. Right to object and right to erasure You can prevent the collection and processing of your personal data by Borlabs by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. Further information on options for objecting to and removing data from Borlabs can be found at: https://de.borlabs.io/datenschutz/

Privacy Policy | SSF Ingenieure AG

As of 15 June 2026

1. Who we are

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is:

SSF Ingenieure AG

Domagkstr. 1a

80807 Munich

Germany

+49 (0) 89 360 40 100

datenschutz@ssf-ing.de

www.ssf-ing.de

2. Contacting the Data Protection Officer

The data protection officer of the controller is: DataCo GmbH

Sandstraße 33

80335 Munich

Germany

+49 89 7400 45840

www.dataguard.de

On this page, we provide information about the processing of your personal data on the website (https://www.ssf-ing.de/) or on our social media profiles on LinkedIn, XING, Instagram, Facebook or YouTube. This privacy policy also applies if you contact us by email, telephone or post.

Further information on data protection can be found via the links below:

Privacy notice for applicants (German only): https://karriere.ssf-ing.de/datenschutz-karriere.html

How we collect and use your personal data depends on how you interact with us or which services you use. We only collect, use or share your personal data if we have a legitimate purpose and a legal basis for doing so.

3. What do we mean by legal basis?

Consent (Art. 6 I lit a GDPR) – You have given us your consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. Further information on how to withdraw your consent can be found in the sub-sections entitled “Exercising your rights” in the following sections of this privacy policy.

Contract (Art. 6(1)(b) GDPR) – We need to use your data to fulfil a contract you have with us. Alternatively, it is necessary to use your data because we have asked you to do so or because you have taken certain steps yourself prior to entering into this contract.

Legal obligation (Art. 6(1)(c) GDPR) – We need to use your data to comply with the law.

Vital interests (Art. 6(1)(d) GDPR) – The processing of your data is necessary to protect your vital interests or those of another person. For example, to protect you from serious physical harm.

Public task (Art. 6(1)(e) GDPR) – The processing of your data is necessary for the performance of a task carried out in the public interest or because it is covered by a statutory duty, e.g. for a statutory function.

Legitimate interests (Art. 6(1)(f) GDPR) – The processing of your data is necessary to support a legitimate interest that we or another party have, provided that your own interests do not override this.

Please note that we may not be able to provide you with our website services if your data is processed to fulfil a contract or a legal obligation and you do not provide the requested data.

4. Data sharing and international transfers

As explained in this privacy policy, we use various service providers who help us to provide our services and ensure the security of your data. When we use these service providers, it is necessary for us to share your personal data with them.

We have entered into agreements with all service providers to whom we disclose your data, obliging them to protect your data.

If your personal data is transferred outside the EU, we ensure that your personal data receives an equivalent level of protection , either because the country to which your data is transferred has an ‘adequate’ data protection standard in accordance with the European Commission, or by applying another safeguard, such as an enhanced contractual arrangement, i.e. the Standard Contractual Clauses (SCCs) adopted by the European Commission.

For example, when we use US service providers, we rely either on the SCCs or the EU-US Data Privacy Framework, depending on the provider. You may request a copy of the SCCs we have entered into with our service providers by sending an email to the email address provided in this Privacy Policy.

5. Your rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller: The right of access (Art. 15 GDPR)

You have the right to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have the right to access this data and to the following information:

Purposes of processing
Categories of personal data
Recipients or categories of recipients
Planned storage period or the criteria for determining this period
the existence of the rights to rectification, erasure, restriction or objection
Right to lodge a complaint with the competent supervisory authority
Where applicable, the origin of the data (if collected from a third party)
Where applicable, the existence of automated decision-making, including profiling, with meaningful information about the logic involved, the scope and the expected consequences
Where applicable, transfer of personal data to a third country or international organisation

5.2. Right to rectification (Art. 16 GDPR)

If your personal data is inaccurate or incomplete, you have the right to request that the personal data be rectified or completed without undue delay.

5.3. Right to restriction of processing (Art. 18 GDPR)

Provided that one of the following conditions is met, you have the right to request a restriction on the processing of your personal data:

You contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data.
In the context of unlawful processing, you object to the erasure of the personal data and instead request the restriction of the use of the personal data.
We no longer require your personal data for the purposes of processing, but you require your personal data to establish, exercise or defend your legal claims, or
after you have objected to the processing, for the duration of the assessment of whether our legitimate grounds override your interests.

5.4. Right to erasure (right to be forgotten’) (Art. 17 GDPR)

If any of the following reasons apply, you have the right to request the immediate erasure of your personal data:

Your data is no longer necessary for the purposes for which it was originally collected.
You have withdrawn your consent and there is no other legal basis for the processing.
You object to the processing and there are no overriding legitimate grounds for the processing, or you object in accordance with Article 21(2) of the GDPR.
Your personal data is being processed unlawfully.
Erasure is necessary to comply with a legal obligation under Union law or the law of the Member State to which we are subject.
The personal data was collected in relation to information society services offered in accordance with Article 8(1) of the GDPR.

Please note that the above reasons do not apply where processing is necessary:

To exercise the right to freedom of expression and information;
To comply with a legal obligation or to perform a task carried out in the public interest to which we are subject;
For reasons of public interest in the area of public health.
For archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes.
To establish, exercise or defend legal claims.

5.5. Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used and machine-readable format or to request that it be transferred to another controller.

5.6. Right to Object to Certain Data Processing (Art. 21 GDPR)

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6(1)(a) or (f) of the GDPR. This also applies to profiling based on these provisions.

If personal data relating to you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing; this also applies to profiling, insofar as it is related to such direct marketing.

5.7. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.

A list of the supervisory authorities with local jurisdiction in Germany can be found on the website of the Federal Commissioner for Data Protection at the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

The supervisory authority responsible for SSF is the Bavarian State Office for Data Protection Supervision (BayLDA). You can contact them at:

The Bavarian State Office for Data Protection Supervision (BayLDA)

Promenade 18, 91522 Ansbach

Postal address: PO Box 1349, 91504 Ansbach

Telephone: 0981/ 180093-0

Fax: 0981/ 180093-800

Email: poststelle@lda.bayern.de

Website: www.lda.bayern.de

6. How is your data processed?

SSF collects and processes various categories of personal data, depending on the specific processing situation.

We process your personal data exclusively in accordance with the provisions of the General Data Protection Regulation (“GDPR”) and the Federal Data Protection Act (“BDSG”).

Below you will find a list of the personal data we process depending on the specific processing situation, the purposes for which this data is processed, and the legal basis on which we process the data.

6.1. Provision of the website and creation of log files

6.1.1. Description and scope of data processing

Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing device.

The following data is collected in this process:

Information about the browser type and version used
The user’s operating system
The user’s internet service provider
Date and time of access
Websites from which the user’s system accesses our website
Websites accessed by the user’s system via our website

This data is stored in our system’s log files.

This data is not stored together with other personal data relating to the user.

6.1.2. Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session.

The data is stored in log files to ensure the website functions properly. The data also helps us to optimise the website and ensure the security of our IT systems. The data is not analysed for marketing purposes in this context.

6.1.3. Legal basis for data processing

The legal basis for the temporary storage of data and log files is Article 6(1)(f) of the GDPR.

6.1.4. Duration of storage

The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of data being collected for the provision of the website, this is the case once the respective session has ended.

In the case of data stored in log files, this occurs after seven days at the latest. Storage beyond this period is possible. In this case, users’ IP addresses are deleted or anonymised so that the client making the request can no longer be identified.

6.1.5. Exercising your rights

The collection of data for the provision of the website and the storage of data in log files is strictly necessary for the operation of the website. The user may object to this. Whether the objection is successful must be determined by weighing up the respective interests.

6.2. Use of cookies

6.2.1. Description and scope of data processing

When you visit our website, we use technical tools for various functions, in particular cookies, which may be stored on your device. When you access our website and at any time thereafter, you have the choice of whether to allow cookies in general or which specific additional functions you wish to select. You can make changes in your browser settings or via our Consent Manager.

Cookies are text files or information in a database that are stored on your hard drive and assigned to the browser you are using, so that certain information can be sent to the entity setting the cookie. Below, we describe the types of cookies we use:

We use technically necessary cookies that are required for the technical structure of the website. Without these cookies, our website cannot be displayed (correctly), or the support functions will not work.

The following data is stored and transmitted by the technically necessary cookies:

Language settings
Saving cookie consent

We use cookies on our website that are not technically necessary. Text files that do not serve solely to ensure the functionality of the website, but also collect other data, are considered technically non-essential cookies.

The following data is processed when technically non-essential cookies are set:

IP address
Location of the internet user
Date and time of the website visit
Tracking of browsing behaviour

6.2.2. Purpose of data processing

The purpose of using technically necessary cookies is to ensure the functionality of our website. Some features of our website cannot be provided without the use of cookies. For these, it is necessary for the browser to be recognised even after a page change.

We require technically necessary cookies for the following applications:

Saving language settings
Saving cookie consent

Technically non-essential cookies are used to improve the quality of our website, its content and, consequently, our reach and cost-effectiveness. By setting these cookies, we learn how the website is used and can thus continuously optimise our offering. In particular, these cookies serve the following purposes:

Non-essential cookies are used for statistical purposes.

6.2.3. Legal basis for data processing

The provisions of the Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services (TDDDG) apply to the storage of information on the end user’s device and/or access to information already stored on the end user’s device. Where the setting and reading of cookies is technically necessary, this is done to ensure the functionality of our website. In this case, the storage of and access to cookies on your terminal equipment is based on Section 25(2)(2) of the TDDDG. This storage and access to the information on your terminal equipment serves to facilitate your use of our website and to enable us to offer you our services as you have requested. Some functions of our website also do not work without the use of these cookies and could therefore not be offered. Cookies are generally deleted at the end of the session (e.g. logging out or closing the browser) or after a specified period has elapsed. Information on different storage periods for cookies can be found in the following sections of this privacy policy.

Where cookies are used that are not technically necessary, this is done on the basis of your explicit consent, which you can give via the cookie banner. In this case, the legal basis for the storage of and access to information is Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) and Article 7 of the GDPR. You may withdraw your consent at any time with future effect or subsequently grant it again by configuring your cookie settings accordingly. Alternatively, you can prevent the storage of cookies by adjusting the settings in your browser software. Please note that the browser settings you make only apply to the browser you are currently using. If personal data is processed following the storage of and access to the information on your device, the provisions of the GDPR apply. You can find further information on this in the following sections of this privacy policy.

6.2.4. Exercising your rights

You may withdraw your consent to the use of cookies at any time and manage your consent preferences under the ‘Consent’ tab at the bottom of the website.

6.3. Contact by email, telephone or post

6.3.1. Description and scope of data processing

You can contact us via the email address provided on our website. In this case, the user’s personal data transmitted with the email will be stored. When you contact us, we process the following personal data in particular:

First name and surname,
email address,
Time of the enquiry,
Telephone number (if contact is made by telephone)
Information you provide when contacting us.

The data is used exclusively for the purpose of processing the conversation.

6.3.2. Purpose of data processing

In the case of contact via email, this also constitutes the necessary legitimate interest in the processing of the data.

6.3.3. Legal basis for data processing

The legal basis for processing the data transmitted when sending an email is Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing the best possible response to your enquiry sent by email.

If the email contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR.

6.3.4. Duration of storage

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. For personal data sent by email, this is the case once the relevant conversation with the user has ended. The conversation is deemed to have ended when it is clear from the circumstances that the matter in question has been conclusively resolved.

Any additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

6.3.5. Exercising your rights

If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

All personal data stored in the course of the contact will be deleted in this case.

6.4. Job applications

6.4.1. Description and scope of data processing

An application form is available on our website, which can be used for electronic applications. If an applicant makes use of this option, the data entered in the form will be transmitted to us and stored. This data includes:

Title
Surname
First name
Address
Telephone/mobile number
Email address
Salary expectations
CV
References
Photo (if provided voluntarily)
Potential start date

Once the application has been submitted, the applicant will receive confirmation from us that we have received their application documents.

No data will be passed on to third parties. The data will be used exclusively for the processing of the application.

6.4.2. Purpose of data processing

We process the personal data from the application form solely for the purpose of processing your application.

The other personal data processed during the submission process is used to prevent misuse of the application form and to ensure the security of our IT systems.

6.4.3. Legal basis for data processing

The legal basis for the processing of your data is the initiation of a contract, which takes place at the request of the data subject, Article 6(1)(b)(1) of the GDPR and Section 26(1)(1) of the BDSG.

6.4.4. Duration of storage

Once the application process has been completed, the data will be stored for up to 6 months. Your data will be deleted no later than 6 months after this period. In the event of a legal obligation, the data will be stored in accordance with the applicable provisions.

Any additional personal data collected during the submission process will be deleted no later than seven days after submission.

Further information can be found in our “Data Protection Notice for Applicants ”.

6.5. Company websites

6.5.1. Integration of social media on our website

On our website, we deliberately do not use the plugins offered by social media services, but merely provide links to LinkedIn, Facebook, Instagram and YouTube. Therefore, simply visiting our website does not result in any user data being transmitted to the servers of the social media providers. Only when you click on a social media button a connection will be established between your browser and the server of the respective social media service, and you will be redirected to the websites of these services. We do not collect any personal data via these buttons on our pages and therefore do not transmit any data to the social media providers.

6.5.2. Social media profiles

6.5.2.1. General information and joint responsibility with LinkedIn, Facebook and Instagram

We maintain publicly accessible profiles on various social networks (LinkedIn, XING, Instagram, Facebook and YouTube) to report on the latest developments within our company and to connect with customers and other interested parties. We are currently active on the following social media platforms:

Instagram:

Instagram, part of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland You can find the privacy policy for our Instagram fan page via the following link (German only): https://www.ssf-ing.de/datenschutzerklaerung-instagram/

Facebook:

Facebook, part of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland The privacy policy for our Facebook fan page can be found at the following link: https://www.ssf-ing.de/datenschutz-fb/

YouTube:

YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, United States

On our company page, we provide information and offer YouTube users the opportunity to communicate.

If you carry out an action on our YouTube corporate page (e.g. comments, posts, likes, etc.), you may thereby make personal data (e.g. your real name or user profile photo) public.

However, as we generally have little or no influence over the processing of your personal data by YouTube, we cannot make any binding statements regarding the purpose and scope of the processing of your data.

We use our corporate presence on social networks for communication and the exchange of information with (potential) customers. In particular, we use our corporate presence for showcasing our projects, events, internal company events and job vacancies. In this way, we inform interested parties about our company and offer an opportunity for mutual exchange.

In this context, posts on our corporate social media presence may contain the following content:

Information about services
Internal and external events

Users are free to publish personal data through their activities.

Where we process your personal data to analyse your online behaviour, offer you competitions or conduct lead generation campaigns, we do so on the basis of your explicit declaration of consent, Article 6(1)(a) and Article 7 of the GDPR.

The legal basis for the processing of personal data for the purpose of communicating with customers and prospective customers is Article 6(1)(f) of the GDPR. Our legitimate interest in this regard is to respond to your enquiry in the best possible way and to be able to provide the requested information.

If the purpose of contacting you is to conclude a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR.

For the processing of your personal data in third countries, we have put in place appropriate safeguards in the form of standard contractual clauses in accordance with Article 46(2)(c) of the GDPR. A copy of the standard contractual clauses can be requested from us.

You may object at any time to the processing of your personal data that we collect in connection with your use of our website and exercise your rights as a data subject, as set out in the “Your Rights” section of this privacy policy. To do so, please send us an informal email to datenschutz@ssf-ing.de. For further information on the processing of your personal data by YouTube and the relevant options for objecting, please see here:

YouTube: https://policies.google.com/privacy?gl=DE&hl=en

6.5.2.2. Use of company profiles on professional networking sites

6.5.2.2.1. Scope of data processing

The company profile is used for job applications, information/PR and active sourcing. We do not have any information regarding the processing of your personal data by the companies jointly responsible for the company profile. Further information on this can be found in the privacy policy of:

LinkedIn: https://www.linkedin.com/legal/privacy-policy
XING: https://privacy.xing.com/de

On our site, we provide information and offer users the opportunity to communicate.

If you carry out an action on our company website (e.g. comments, posts, likes, etc.), you may thereby make personal data (e.g. your real name or photo from your user profile) public.

Xing is the sole controller within the meaning of Article 4(7) of the GDPR for the processing of user and profile data, in particular information regarding usage activities. We ourselves do not process any personal data in this regard. Xing provides information on the data processed by Xing, including the purposes of processing and legal bases, via its privacy policy.

6.5.2.2.2. Legal basis for data processing

If the purpose of making contact is to conclude a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR.

6.5.2.2.3. Purpose of data processing

Our website serves to inform users about our services. In doing so, every user is free to publish personal data through their activities.

6.5.2.2.4. Duration of storage

The data generated by the company website is not stored in our own systems.

6.5.2.2.5. Exercising your rights

You may object at any time to the processing of your personal data that we collect in connection with your use of our website and exercise your rights as a data subject, as set out in the ‘Your rights’ section of this privacy policy. To do so, please send us an informal email to the email address provided in this privacy policy.

Further information on exercising your rights can be found here:

LinkedIn: https://www.linkedin.com/legal/privacy-policy
XING: https://privacy.xing.com/en

Joint controllership:

The following providers supply us with anonymous usage statistics, which we use to improve the user experience when visiting our pages:

LinkedIn,
Instagram and
Facebook

We do not have access to the usage data collected by the providers for the purpose of compiling these statistics. Nevertheless, there is a joint responsibility between us and the providers – LinkedIn, Instagram and Facebook – who compile such usage statistics, with regard to the data processing operations involved, in accordance with Article 26 of the GDPR.

Where videos are embedded on our websites, there is joint responsibility regarding the processing of personal data collected by Google (YouTube) within the meaning of Article 26 GDPR.

As “joint controllers”, we are jointly responsible for the processing and must ensure compliance with applicable data protection law. In this context, we have concluded a joint controller agreement with the providers in accordance with Article 26(2) of the GDPR, and the providers have undertaken to us to assume primary responsibility under the GDPR for the processing of this data, to fulfil all obligations under the GDPR with regard to this data, and to make the essential details of this obligation available to the data subjects.

6.6. Hosting

The website is hosted on servers by a service provider commissioned by us.

Our service provider is:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

Further information on the processing of personal data by Hetzner can be found at: https://www.hetzner.com/legal/privacy-policy

The servers automatically collect and store information in so-called server log files, which your browser transmits automatically when you visit the website. The information stored is:

Information about the browser type and version used
The user’s operating system
The user’s internet service provider
Date and time of access
Websites from which the user’s system accesses our website
Websites accessed by the user’s system via our website

This data is not combined with other data sources. The collection of this data is based on Article 6(1)(f) of the GDPR. Our legitimate interest in processing this data is to ensure our website is displayed correctly and to optimise its functions.

The website server is geographically located in Germany.

6.7. Cookies

As explained in the individual sections, social media providers use so-called cookies, which are stored on your device when you visit our social media pages, even if you do not have your own profile or are not logged into it whilst visiting our site. These cookies allow the providers to create user profiles based on your preferences and interests and to display tailored advertising to you. Cookies remain on your device until you delete them. Further details can be found in the providers’ privacy policies and in this privacy policy.

Further information on data processing in connection with cookies can be found in the providers’ cookie policies:

Facebook: https://privacycenter.instagram.com/policies/cookies/
Instagram: https://privacycenter.instagram.com/policies/cookies/
YouTube: https://policies.google.com/technologies/cookies?hl=de&gl=de
LinkedIn: https://de.linkedin.com/legal/cookie-policy?_l=de_DE

6.8. Integrated third-party services

We use various service providers to deliver the services we offer on the website.

In general, we have a legitimate interest in sharing your data with the relevant service providers where these services are essential for the provision of the core service offered on the website, in order to provide the relevant website service.

If such services are required for additional services, extended functions or additional purposes, your personal data will only be passed on to service providers if you give your consent.

You can withdraw your consent to the use of integrated third-party services and manage your consent settings at any time here: https://www.ssf-ing.de/

6.8.1. Use of Wordfence Security

6.8.1.1. Scope of personal data processing

Our website uses features provided by Defiant Inc., 800 5th Ave., Suite 4100, Seattle, WA 98104, USA (hereinafter referred to as ‘Defiant’). Wordfence Security secures our website and thereby protects visitors to the website from viruses and malware. When you visit a page with the plugin, a direct connection is established between your computer and the Defiant server. To determine whether the visitor is a human or a bot, the plugin sets cookies. This may result in further personal data being stored and analysed, particularly device and browser information (in particular the IP address and the operating system).

It is possible to analyse behaviour based on the notifications sent (e.g. how often a page is visited). For the purpose of protection against brute-force and DDoS attacks or comment spam, IP addresses are stored on the Wordfence servers. IP addresses classified as harmless are placed on a whitelist.

Further information on the processing of data by Defiant can be found here: https://www.wordfence.com/privacy-policy/

6.8.1.2. Purpose of data processing

The website uses the plugin to protect against viruses and malware and to defend against attacks by cybercriminals.

6.8.1.3. Legal basis for the processing of personal data

The legal basis for the processing of users’ personal data is, in principle, the user’s consent in accordance with Article 6(1)(a) of the GDPR.

6.8.1.4. Duration of storage

Your personal information will be stored for as long as is necessary to fulfil the purposes described in this privacy policy or as required by law, e.g. for tax and accounting purposes.

6.8.1.5. Exercising your rights

You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of processing carried out on the basis of your consent prior to its withdrawal.

You can prevent the collection and processing of your personal data by Wordfence Security by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.

Further information on options for objecting to and removing data processed by Wordfence Security can be found at: https://www.wordfence.com/privacy-policy/

6.8.2. Use of YouTube videos

6.8.2.1. Scope of processing of personal data

We use the YouTube plugin operated by Google, YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA, and its representative in the EU, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as ‘Google’). We use the YouTube plugin to embed YouTube videos on our website. The integration of YouTube videos allows you to view the videos easily and conveniently directly via our website.

YouTube videos are embedded in ‘enhanced privacy mode’. According to the provider, this means that simply visiting our website does not result in any data about you as a user being transmitted to YouTube, nor are any user profiles created, provided you do not play the video. The display of these videos is also disabled by default on our website. As a result, simply visiting a page on which a video is embedded does not result in YouTube setting any cookies or any data about you as a user being transmitted to YouTube. Only after you deliberately click the ‘Load YouTube’ button will the video be loaded and a connection established to the YouTube server. Cookies are not set in ‘enhanced privacy mode’.

By clicking the “Load YouTube” button or accepting the use of YouTube via the cookie banner, you consent to the data processing carried out by third-party providers as a result.

6.8.2.2. Categories of personal data

Once this function is enabled by clicking the “Activate video” button, the videos are loaded on our website and YouTube receives the URL of the currently loaded webpage, the IP address of the device you are using, and, where applicable, further device-specific information (e.g. browser type). This occurs regardless of whether you have a member account or not. If you have a member account and are logged in, your data may also be directly linked to your account by YouTube (e.g. which video you are watching). You can prevent this by logging out of your member account before playing a video. Furthermore, after playing a YouTube video, further data processing operations may be triggered by YouTube, of which we have no precise knowledge and over which we have no influence.

6.8.2.3. Purposes and legal basis of data processing

Processing takes place exclusively for the purpose of providing videos and presenting our company. Data is only transferred to YouTube if, when playing a YouTube video, you have given us your consent via the “Activate video” button in accordance with Article 6(1)(a) of the GDPR. Please refer to the privacy policy of the respective provider (see above) for the legal basis on which they process your data.

6.8.2.4. Withdrawal and deactivation

You can prevent the transmission of information to Google at any time by not playing the videos embedded on our website.

6.8.2.5. Retention period

Specific details regarding the storage period can be found in YouTube’s privacy policy linked above.

6.8.2.6. Recipients

Within the European Union, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’) is the data controller for this service. Where personal data is also transferred to and stored on Google’s servers in the USA, the recipient is usually also the US company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When data is transferred to the USA, compliance with the data protection standards and your rights is ensured, according to Google, by means of appropriate safeguards (e.g. standard contractual clauses). Google LLC is also certified under the EU-US Data Privacy Framework.

Further information on the purpose and scope of data collection and processing by YouTube, as well as your rights and settings options for protecting your privacy, can be found in YouTube’s privacy policy.

6.8.2.7. Exercising your rights

You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawing your consent does not affect the lawfulness of processing carried out on the basis of your consent prior to withdrawal.

You can prevent the collection and processing of your personal data by Google by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.

You can disable the use of your personal data by Google via the following link: https://adssettings.google.de

Further information on options for objecting to and removing data from Google can be found at: https://policies.google.com/privacy?gl=DE&hl=de

6.8.3. Use of WPML

6.8.3.1. Scope of personal data processing

We use WPML from OnTheGoSystems Limited, 22/F 3 Lockhart Road, Wanchai, Hong Kong (hereinafter referred to as WPML). WPML is a multilingual plugin for WordPress. We use WPML to display our website in different languages. When you visit our website, WPML stores a cookie on your device to save your chosen language setting. This may result in the storage and analysis of personal data, primarily the user’s activity (in particular, which pages have been visited, and which elements have been clicked on) as well as device and browser information (in particular, the IP address and the operating system). Further information on the processing of data by WPML can be found here: https://wpml.org/de/documentation-3/privacy-policy-and-gdpr-compliance/

6.8.3.2. Purpose of the processing of personal data

The use of WPML serves to enable us to present our online presence in multiple languages.

6.8.3.3. Legal basis for the processing of personal data

The legal basis for data processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in addressing visitors to our website in their native language.

6.8.3.4. Duration of storage

WPML stores cookies on your device. Information on the storage period of the cookies can be found at: https://wpml.org/documentation/privacy-policy-and-DSGVO-compliance

6.8.3.5. Exercising your rights

You can prevent the collection and processing of your personal data by WPML by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. Further information on options for objecting to and removing data processed by WPML can be found at: https://wpml.org/de/documentation-3/privacy-policy-and-gdpr-compliance/

6.8.4. Use of etracker

6.8.4.1. Scope of processing of personal data

We use the etracker analytics service provided by etracker GmbH, Erste Brunnenstraße 1, 20459, Hamburg, Germany (hereinafter referred to as ‘etracker’). Cookies are used in this process, which enable a statistical analysis of how visitors use this website, as well as the display of usage-related content or advertising. This may result in the storage and analysis of personal data, primarily the user’s activity (in particular, which pages have been visited and which elements have been clicked on), as well as device and browser information (in particular, the IP address, login and device ID, and the operating system).The data generated in this way is processed and stored by etracker exclusively in Germany and is therefore subject to strict German and European data protection laws and standards.

Further information on the processing of data by etracker is available here: https://www.etracker.com/datenschutz/

6.8.4.2. Purpose of data processing

The processing of users’ personal data by etracker enables us to analyse our users’ browsing behaviour. By evaluating the data collected, we are able to compile information on the use of the individual components of our service. This helps us to continuously improve our online presence and, in this context, also to enhance user-friendliness.

6.8.4.3. Legal basis for the processing of personal data

The legal basis for the processing of users’ personal data is, in principle, the user’s consent in accordance with Article 6(1)(a) of the GDPR.

6.8.4.4. Duration of storage

Your personal information will be retained for as long as is necessary to fulfil the purposes set out in this privacy policy or as required by law, e.g. for tax and accounting purposes.

6.8.4.5. Exercising your rights

You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal.

You can prevent the collection and processing of your personal data by etracker by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. Further information on options for objecting to and removing etracker data can be found at: https://www.etracker.com/datenschutz/

6.8.5. Use of Borlabs cookies

6.8.5.1. Scope of processing of personal data

We use features of the Borlabs Cookie consent solution provided by Borlabs – Benjamin A. Bornschein, Georg-Wilhelm-Str. 17, 21107 Hamburg, Germany (hereinafter referred to as Borlabs). Borlabs enables us to obtain, manage and document users’ consent to data processing in a legally compliant manner. To this end, Borlabs places cookies on the user’s device.

The following data is processed:
Cookie duration
Cookie version
Domain and path of the website
Opt-in and opt-out data
UID (randomly generated user ID)

Further information on the processing of data by Borlabs is available here: https://de.borlabs.io/datenschutz/

6.8.5.2. Purpose of data processing

The processing of personal data serves to comply with the legal obligations under the GDPR and the BDSG.

6.8.5.3. Legal basis for the processing of personal data

The legal basis for the processing of users’ personal data is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the purposes set out in section 2.

6.8.5.4. Duration of storage

Your personal information will be stored for as long as is necessary to fulfil the purposes described in this privacy policy, or as required by law.

6.8.5.5. Right to object and right to erasure

You can prevent the collection and processing of your personal data by Borlabs by blocking the storage of third-party cookies on your computer, using the ‘Do Not Track’ function of a compatible browser, disabling the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.

Further information on options for objecting to and removing data from Borlabs can be found at: https://de.borlabs.io/datenschutz/