Privacy Policy

Information for data subjects pursuant to Art. 13 & 14 GDPR

---

1. Introduction

Thank you for your interest in our company and our online services. Certain processes require data from you that is defined as personal data. Without this data, it would be difficult or impossible to design these processes with you.

The protection of your personal data is particularly important to us. We take our obligations regarding the processing of your data seriously. In the following, we therefore inform you about the collection, processing and use of your data in the context of our online presence. This privacy policy also provides you with an overview of your rights as the owner of your personal data. You can also find our contact details in this privacy policy.

2. Scope of Application

This privacy policy applies to the online services of Encory GmbH under the domain encory.com and the social media presence on LinkedIn and Instagram.

3. Responsible Body

The controller for data processing within the meaning of data protection laws is:
Company: Encory GmbH
Address: Neuhofweg 5 – Gebäude P
D-85716 Unterschleißheim
Telephone: +49 (0)162 297 35 36
E-Mail: info@encory.com
Homepage: www.encory.com

4. Data Protection Officer

Our data protection officer will be happy to answer any questions you may have about the
processing of your personal data:
Data Protection Officer: Dorit Petersen
E-mail: dataprotection@encory.com
Address: Encory GmbH
Neuhofweg 5 – Gebäude P
D-85716 Unterschleißheim

5. Processing of Personal Data

Processing of Personal Data We only collect your personal data when you actively contact us (e.g. via our contact form, email, telephone, online self-tests) or visit our website. Any processing of your personal data that goes beyond the scope of the statutory permissions will only take place based on your express consent.

5.1 Categories of Data Subjects

The following categories of natural persons are subjects according to the GDPR due to the collection of their personal data:
– Applicants
– Employees
– Customers
– Interested parties
– Suppliers
– Service providers

5.2 Categories of Personal Data

Encory primarily collects your contact and usage data if you voluntarily and knowingly provide it to us. Your consent is essential for data processing. We collect and process other personal data exclusively on the basis of your express consent.

Usually, the following data is collected:
– Name
– E-mail address
– Telephone number
– Application data (if you are taking part in the application process)
– Contract relevant data
– Photo and/or video recordings (e.g. as an employee for company presentations)
– Additional data that you provide to us independently

The following types of data will typically be collected (independent of us) solely through your usage of the internet:
– IP address (when you visit the website)
– Usage data (e.g. time of access, pages visited, length of visit)

5.3 Legal Basis

Your personal data is processed on the basis of the following legal documents:
– Consent (point (a) of Article 6 (1) GDPR)
– Performance of a contract (point (b) of Article 6 (1) GDPR)
– Fulfillment of legal obligations (point (c) of Article 6 (1) GDPR)
– Legitimate interests (point (f) of Article 6 (1) GDPR)

5.4 Purposes of Data Processing

Your data will be used for the following purposes:
– Processing of inquiries
– Provision of information
– Provision of our services
– Contract fulfillment (e.g. offers, orders, purchasing and sales, invoicing)
– Pre-contractual performance (e.g. application process)
– Communication with you
– Participation in promotions (e.g. via social media or online tests on our website)
– Advertising and marketing (if you have consented to this)
– Analysis and improvement of our website and services
– Quality assurance

We only ever process your data within the scope of said purposes. If changes of purpose are intended, we will ask you for your express consent in advance.

5.5 Recipients of Data

Your personal data will only be passed on to third parties outside Encory GmbH if:
– You have given your express consent.
– The order processing is necessary for the fulfillment of a contract.
– There is a legal obligation.
– It is necessary to protect legitimate interests.

The following categories of recipients are possible:
– Processors within and outside the EU (e.g. email providers, server operators, service providers for data processing)
– Public authorities
– Other external parties, provided consent or overriding interests exist

Processors are service providers who process data on our behalf (e.g. hosting providers, marketing service providers). They are contractually obliged to protect your data in accordance with the GDPR

5.6 Duration of Data Storage

Your personal data will only be stored by us for as long as necessary to fulfill the purpose. Once the purpose, e.g. your participation in a promotion, has been fulfilled, we will delete your data immediately. Exceptions to this are:

– If you assert your right to object in accordance with Art. 21 GDPR. In this case, we will contact you immediately if immediate deletion is not possible and discuss further procedures with you in order to provide you with the best possible support in asserting your rights.

– If you have sent application data to us. In this case, we will delete your data within 4 months, unless you have given us your consent to extend data storage in the context of inclusion in the applicant pool.

– If statutory retention obligations apply. In this case, the data may generally be stored for up to 10 years.

6. Encory’s Website

6.1 Website

Our website is hosted by Microsoft Azure (Europe West) servers. Microsoft is the technical operator of these servers and is to be understood as the processor of Encory GmbH. The order processing is limited to the maintenance of the data stored by Encory. Microsoft provides further information by itself (https://azure.microsoft.com/).

6.2 Google Tag Manager

Our website uses Google Tag Manager, a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). The Tag Manager facilitates more efficient management of so-called website tags. A website tag is a placeholder embedded in the source code of our website to record the integration of frequently used website elements (e.g., code for web analytics services). Google Tag Manager operates without the use of cookies. In some cases, data is processed on a Google server in the USA. We have entered into a data processing agreement with Google in accordance with Article 28 of the GDPR, stipulating that Google may only process data according to our instructions and must comply with the data protection standards of the GDPR. The legal basis is Article 6 (1) (f) of the GDPR, based on our legitimate interest in the efficient operation of our website. Further information can also be found in Google’s information on Tag Manager.

6.3 Cookies and Analysis Tools

6.3.1 Google Analytics

Our website uses Google Analytics. This web analysis service uses cookies to improve user-friendliness and analyze website usage. This may result in information about your use of our website being stored on servers in the USA. You can manage the use of cookies in your browser settings.
Google will use this information on behalf of the operator of this website for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. You may refuse the use of cookies by selecting the appropriate settings on your browser, however, please note that if you do this you may not be able to use the full functionality of this website.

The operator of Google Analytics provides its privacy policy by itself (https://policies.google.com/privacy).

6.3.2 Dealfront

Our website uses the technologies of Dealfront (Dealfront Finland Oy as part of Dealfront Group GmbH) to analyze visitor behavior. In this process, the IP address of a visitor is processed. This processing has the purpose of helping us understand which businesses (B2B) are visiting our site, by enriching IPs with associated information such as the company name or industry code.

To do this, at the beginning of the visitor’s session, their IP address and corresponding session data is matched against a large whitelist of known companies.

Whenever we process website traffic data, this processing is based on our legitimate interest (Art. 6 (1) lit. f GDPR) in optimizing our products, services, sales and marketing. To prevent this processing activity, you (website visitor) may install and configure appropriate ad-blockers or use no-script-plugins in your browser. The data will be deleted as soon as it is no longer required for its intended purposes. Statutory retention obligations can lead to a longer retention period of the data in question. We have concluded a data processing agreement with Dealfront in order to ensure compliance with applicable data protection standards.

7. Encory’s Online Presence

7.1 Social Media

We are active on Instagram and LinkedIn. When using these platforms, personal data may be transferred to the respective operators.

The operators of Instagram and LinkedIn are each regarded as separate controllers. We therefore refer to the privacy policies of the respective platforms:
– https://about.instagram.com/[…]/instagram-community-data-policy/
– https://de.linkedin.com/legal/privacy-policy

If you contact us via the platforms mentioned (e.g. Direct Messages on Instagram), further personal data may be requested.

7.2 Online Advertising in General

We use access data collected during visits to our website to display advertisements on the online platforms of other providers (retargeting). Our goal is to present personalized advertising tailored to your interests, making it more relevant to you. To achieve this, we participate in the advertising networks of Google (“Google Advertising Network”) and Microsoft Bing Ads (“Bing Advertising Network”). This enables us to display personalized ads on the online platforms of other providers participating in these advertising networks (known as publishers). Further information is available from the operators of the respective advertising networks:
– Google Privacy Policy
– Microsoft Privacy Statement

The legal basis for the data processing described below is Article 6 (1) (f) of the GDPR, based on our legitimate interest in conducting advertising that aligns with your interests.

7.3 Facebook and Meta Ads

This website uses the so-called Facebook Pixel provided by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter referred to as “Facebook”).

Legal Basis: The legal basis for processing your data is Article 6(1)(b) of the GDPR.

7.3.1 Scope of Processing

When you activate the Facebook Pixel on our site, cookies are stored that allow your browser to be recognized via a unique identifier when visiting pages on our website or other websites that use the Facebook Pixel.

If you have activated the Facebook Pixel for our site, each time you visit a page on our website that uses the Pixel, the following data related to the page visit and cookie data, including the identifier stored in the cookie, is processed and usually transmitted to a Facebook server in the USA and stored there. The following data is transmitted:
– Pixel ID
– Data from Facebook cookies (see above)
– “Button-click data” (information about buttons clicked by the user and the page to which the user was redirected)
– eCommerce tracking

The pixel we use does not utilize the “Advanced Matching” or “Lookalike Audiences” features, meaning we do not transmit any additional personal data to Facebook. The data collected is only made available to us by Facebook in the form of anonymized reports. However, we assume that Facebook may combine the data we transmit with a user’s Facebook account and use it for its own purposes, including creating detailed profiles of individuals. Facebook uses the collected data to create interest profiles, which serve as the basis for generating target groups known as “Custom Audiences.” Facebook may add you to such a target group and show you interest-based ads when you visit Facebook-owned pages. Further information on Facebook’s privacy policies can be found at the following links:
– Facebook Data Policy
– Facebook Terms of Service
– Facebook Data Processing Terms
– Facebook Cookie Policy
– Data collected via Facebook Pixel
– Retention period for Custom Audiences

7.3.2 Purpose of Processing

We use the Facebook Pixel to advertise our offerings on Facebook in a targeted manner. By allowing Facebook to assign individuals to relevant target groups, we can use our advertising resources more effectively. The use of the Facebook Pixel is intended to ensure that our ads on Facebook pages match the potential interests of users and do not appear intrusive.

7.3.3 Retention Period

Individuals added to a “Custom Audience” are removed from the target group after 180 days unless they are re-added through subsequent page visits. We do not store any personal data ourselves. Otherwise, the retention of personal data is governed by Facebook’s privacy policies (see above).

7.3.4 Right to Object and Removal Options

You can view and revoke your consent status at any time via our consent manager. Revoking consent does not affect the legality of processing carried out prior to the revocation. Your decision regarding the use of the service is stored in a cookie (see above). It applies only to this browser and must be renewed after the specified validity period expires. Registered Facebook users can choose which types of ads they see on Facebook at: https://www.facebook.com/settings?tab=ads

If personal data is transferred to the USA, EU Standard Contractual Clauses must be concluded with the respective providers, and the provider’s compliance with EU data protection standards must be verified. [You can prevent data transmission from US providers by adjusting your browser settings accordingly.]

8. Your Rights

In accordance with Chapter III GDPR (in particular Art. 15 to Art. 18 GDPR and Art. 21 GDPR), you have the following rights as a user of our website:

8.1 Right of Access by the Data Subject

You can request information in accordance with Art. 15 GDPR about your personal data processed by us. In your request for information, you should specify your request in order to make it easier for us to compile the necessary data. Please note that your right of access by the data subject may be restricted under certain circumstances in accordance with the statutory provisions.

8.2 Right to Rectification

If the information concerning you is not (or no longer) accurate, you can request rectification in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed.

8.3 Right to Erasure

You can request the erasure of your personal data under the conditions of Art. 17 GDPR. Your right to erasure depends, among other things, on whether the data concerning you is still required by us to fulfill our legal obligations.

8.4 Right to Restriction of Processing

Within the framework of the provisions of Art. 18 GDPR, you have the right to request that the processing of data concerning you be restricted.

8.5 Right to Data Portability

In accordance with Art. 20 GDPR, you have the right to receive your data from us in a structured, commonly used and machine-readable format. Under certain conditions, you also have the option of requesting that we forward your data to other controllers.

8.6 Right to Object

In accordance with Art. 21 GDPR, you have the right to object to the processing of data concerning you at any time on grounds relating to your particular situation. However, we are not always able to comply with this, e.g. if we are required by law to process data as part of our official duties.

8.7 Right to Lodge a Complaint

If you are of the opinion that we have not complied with data protection regulations when processing your data, you can contact us or the responsible party with a complaint.

9. Changes to the Privacy Policy

We reserve the right to amend this privacy policy at any time. The current version will be published on our website.

---

Status: 09/01/2025

Valid from: 09/01/2025