We appreciate your interest in our website, www.crmanagement.eu (hereinafter the "Website"). The Website is operated by CR Holding GmbH, managing directors: Ingo Emmeluth, Torsten Hollstein, and Claudius Meyer, Hardenbergstrasse 28a, 10623 Berlin. In what follows, we will provide you with information about how we will use your data when you visit our Website and which rights you have with respect to our use of your data. If you have any questions about our use of your personal data, please don't hesitate to contact us.
The controller within the meaning of the General Data Protection Regulation (hereinafter "GDPR") and other national data protection laws of EU countries and other data protection laws is:
CR Holding GmbH
Managing Directors: Ingo Emmeluth, Torsten Hollstein, Claudius Meyer
GFAD Datenschutz GmbH
We will generally collect and use personal data of our users only if and to the extent necessary to make available a functional website and/or to provide our content and services. Personal data of our users generally will be collected and/or used only with the prior consent of the user. An exception applies in cases where obtaining prior consent is practically impossible and where data processing is permitted by applicable law. The types of data we process are as follows:
If we obtain the consent of a data subject for processing personal data, the legal basis for processing such personal data is Art. 6 para. 1 let. a) EU General Data Protection Regulation (hereinafter "GDPR"). If we process personal data that are necessary to perform a contract to which the data subject is a party, the legal basis for processing such personal data is Art. 6 para. 1 b) GDPR. The same applies if processing personal data is necessary to perform pre-contractual measures. If processing personal data is necessary to perform a legal obligation of our company, the legal basis for such data processing is Art. 6 para. 1 c) GDPR. If processing personal data is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and fundamental freedoms of the data subject do not outweigh that legitimate interest, the legal basis for such data processing is Art. 6 para. 1 let. f) GDPR.
Personal data of a data subject will be erased or blocked as soon as they are no longer needed for the purposes for which they are stored. Data may also be blocked if provided for by EU or national regulations, laws, or other provisions to which the controller is subject. Data will also be blocked or erased if recordkeeping obligations under the aforementioned norms expire, unless continued storage of such data is necessary to enter into or perform a contract.
When our Website is accessed, our system will automatically collect data and information from the computer system of the terminal device accessing the Website.
In this connection the following data will be collected for a limited time period:
Such data will be stored in log files of our system. Such data are needed only to analyze any malfunctions and will be erased at the latest within seven days. The legal basis for temporarily storing data in log files is Art. 6 para. 1 let. f) GDPR. Temporary storage of the IP address for the system is necessary for making the Website available to the terminal device of the user. For this purpose the IP address of the user must be stored for the duration of the session. Data are stored in log files to ensure the functionality of our Website. In addition, such data are used to optimize the Website and to ensure the security of our IT systems. Data will not be analyzed for marketing purposes in this connection, and we will draw no inferences as to your identity. The aforementioned purposes also provide the basis of our legitimate interest in data processing within the meaning of Art. 6 para. 1 let. f) GDPR. Collecting data to make available the Website and storing data in log files is necessary for operating the Website. Consequently, users have no right to object to the collection or use of such data for the aforementioned purposes.
We use Google Maps on this website, a service of Google Inc. to implement maps. For the European area, the company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. When activating a map on our website, Google Maps are loaded via a Google Server. Through these external calls, data such as the IP address of the user is transmitted to the Google servers, including in the USA. The legal basis for the data processing for Google Maps is our overriding legitimate interest in the appealing presentation, convenience and simple functionality of our website in accordance with Art. 6 (1) lit. f) GDPR. Google processes the data in the USA on the basis of EU standard contractual clauses and thus provides sufficient guarantees within the meaning of Art. 46 para. 1, para. 2 lit. c) GDPR. For more information on data usage by Google, setting and objection options, please visit Google's websites: https://policies.google.com/privacy?hl=de&gl=de
We collect and process personal data of job applicants for purposes of managing the job application process. Data may also be processed electronically. This is the case in particular if a job applicant submits job application documents electronically, for example by email. If we enter into an employment agreement with a job applicant, the data that have been provided by the job applicant will be stored for purposes of managing the employment relationship in compliance with applicable law. If we do not enter into an employment agreement with a job applicant, the job application documents will be automatically deleted after we have announced our decision not to hire the job applicant, unless erasure would conflict with other legitimate interests of the controller. Another legitimate interest within the meaning of the foregoing provision may, for example, be a legal obligation to furnish evidence in a proceeding under the German General Non-Discrimination Act (Allgemeines Gleichbehandlungsgesetz).
If we process your personal data, you will be a data subject within the meaning of the GDPR and you will have the following rights against the controller:
You may demand that the controller confirm whether or not personal data about you are processed by us.
If we do process such data, you may demand the following information from the controller:
You have a right against the controller to have incorrect personal data rectified and/or to have incomplete personal data completed if the personal data we process are incorrect or incomplete. The controller must rectify data without undue delay.
Under the following conditions you may demand restricted processing of your personal data:
If processing of your personal data is restricted, such data may – except for their storage – be processed only with your consent, or to assert, exercise, or defend legal rights or claims, to protect the rights of another natural person or legal entity, or for reasons related to an important public interest of the European Union or any member state.
If processing of your personal data has been restricted under the aforementioned conditions, you will be notified by the controller before the restriction is lifted.
a) Erasure obligation
You may demand that the controller erase your personal data without undue delay and the controller has an obligation to do so if one of the following reasons applies:
b) Information to third parties
Where the controller has made personal data public and has an obligation under Art. 17, para. 1 to erase such personal data, the controller, taking into account available technology and the cost of implementation, must take reasonable steps, including technical measures, to inform controllers which are processing such personal data that the data subject has requested the erasure by such controllers of any links to, or copies or duplicates of, such personal data.
There is no right to erasure if processing personal data is necessary
If you have exercised your right to rectification, erasure, or restricted processing against the controller, the controller has an obligation to notify all recipients to whom your personal data have been disclosed of such rectification, erasure, or restricted processing, unless this proves impossible or would be associated with unreasonable expense.
You have a right to be informed of all such recipients by the controller.
You have a right to receive personal data you have made available to the controller in a structured, standard, and machine-legible format. You also have the right to transfer your personal data to another controller without any interference by the controller to whom the personal data were made available, if
In exercising the right to data portability you further have the right to have your personal data transferred directly from one controller to another controller, if and to the extent that this is technically feasible. No rights or freedoms of any other persons may be infringed thereby.
The right to data portability does not apply to processing of personal data that is necessary to perform a task that is in the public interest or to processing of personal data in the exercise of official authority vested in the controller.
You have the right for reasons related to your particular situation to object to processing of your personal data at any time based on Art. 6 para. 1 let. e) or f) GDPR; the same applies to any profiling based on the aforementioned provisions.
If you object, the controller will no longer process your personal data, unless the controller can show that there are compelling protected reasons for processing your personal data that override your interests, rights and freedoms, or if your data are processed to assert, exercise, or defend legal rights or claims.
If your personal data are processed for direct advertising purposes, you have a right to object to processing of your personal data for purposes of such advertising at any time; the same applies to any profiling associated with such direct advertising.
If you object to processing of your personal data for purposes of direct advertising, your personal data will no longer be processed for such purposes.
In connection with use of information society services you may exercise your right of objection – regardless of Directive 2002/58/EC – by using automated processes for which technical specifications are used. For this purpose you may send an email to our data protection officer.
You have a right to revoke your consent to data processing at any time. If you exercise your right of revocation, the lawfulness of data processing that occurs before revocation based on your consent will remain unaffected.
You have a right not to be subjected to a decision that is made exclusively by means of automated processing – including profiling – if such a decision has legal consequences for you or otherwise substantially impairs your interests. This does not apply if the decision
However, such decisions may not be made with respect to special categories of personal data within the meaning of Art. 9 para. 1 GDPR, unless Art. 9 para. 2 let. a) or g) GDPR applies and appropriate safeguards have been implemented to protect your rights, freedoms, and legitimate interests.
In cases 1) and 3) above the controller must implement appropriate safeguards to protect your rights, freedoms, and legitimate interests, which must include, at a minimum, a right to present your own point of view, and a right to contest the decision.
Without prejudice to any other available administrative or judicial remedies, you have a right to lodge a complaint with a supervisory authority, in particular a supervisory authority located in the member state of your habitual residence, at your workplace, or at the place of the purported infringement, if in your opinion the processing of your personal data violates the GDPR.
The supervisory authority where the complaint is lodged will then notify the complainant of the progress and outcome of the complaint, including judicial remedies available under Art. 78 GDPR.