Privacy Policy

Workist GmbH (hereinafter: "Workist") operates a website with general information about the company and its services. Workist attaches great importance to the protection of privacy and observes the legal data protection regulations. In the following, we explain how we handle your personal data.

1. Who is responsible for this website?

The responsible party in terms of data protection laws, in particular the EU General Data Protection Regulation (GDPR), is

Workist GmbH
Linienstr. 126
10115 Berlin
Germany
E-mail: info@workist.com
Represented by the managing directors: Alexander Müller, Tim Wegner & Dr. Fabian Brosig

We have appointed as external data protection officer
Data Protection Officer of Workist GmbH
c/o activemind AG
Kurfürstendamm 56
10707 Berlin
E-mail: privacy@workist.com

2 What processing activities are carried out?

2.1 Calling up our website

Nature and purpose of the processing

When you access our website, i.e. even if you do not register or otherwise submit information, information of a general nature is automatically collected. This information (server log files) includes, for example, the type of web browser, the operating system used, the domain name of your Internet service provider, your IP address, the date and time of access and similar.

The data is processed in particular for the following purposes:

• Ensuring a smooth connection setup of the website

• Ensuring a smooth use of our website

• Ensuring and evaluating system security and stability, in particular for abuse detection as well as

• For the technically error-free presentation and optimization of our website

We do not use your data to draw conclusions about you personally. However, we reserve the right to check the server log files retrospectively if there are concrete indications of illegal use. Furthermore, we evaluate them statistically in anonymized form, if necessary, in order to optimize our website and the technology behind it.

Legal basis and legitimate interest

The processing is carried out in accordance with Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website and ensuring system security and abuse detection.

Recipients

Recipients of the data may be technical service providers who act as data processors for the operation and maintenance of our website.

Storage period

The data is deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data processed for the purpose of providing the website, this is usually the case after the end of the respective session.

Data is stored in server log files in a form that allows the identification of the data subjects for a maximum period of 30 days; unless a security-relevant event occurs (e.g. a DDoS attack).

Provision mandatory or required

The provision of the aforementioned personal data is not required by law or contract. However, without the IP address, the service and functionality of our website cannot be guaranteed. In addition, individual services may not be available or may only be available to a limited extent. It is therefore not possible to object to the aforementioned processing.

2.2 Appointment booking and contact form

Type and purpose of processing

On our website, we provide a contact form through which inquiries can be sent as well as demo appointments can be arranged. The data you enter in the contact form is processed for the purpose of individual communication with you. For this purpose, a valid e-mail address, a telephone number, your name and the name of your company are required, e.g. to be able to assign your inquiry internally to the responsible department. The provision of further information is optional.

The integration of the contact form and appointment booking for demo appointments into our website is intended to provide you with an easy way to contact us. The information you provide will be used to process the request and stored for any follow-up questions.

Legal basis

If you contact us to request a quote, the data entered in the contact form is processed to carry out pre-contractual measures (Art 6. para. 1 lit. b GDPR). In addition, the processing of the data entered in the contact form is based on our legitimate interest in successful communication with customers and interested parties (Art. 6 para. 1 lit. f GDPR).

Recipients

Recipients of the data may be our data processors. All service providers are contractually obligated to treat your data confidentially.

Storage period

The data will be deleted no later than six months after the request has been processed.

If a contractual relationship is concluded, the data will be stored for longer in accordance with the statutory retention periods and then deleted. Corresponding retention obligations result in particular from the German Commercial Code.

Provision mandatory or required

The provision of your personal data is voluntary. However, we can only process your request if you provide us with the necessary data and the reason for the request.

2.3 Inquiries on our website

Type and purpose of processing

To make an inquiry on our support website, we require some personal data, which is transmitted to us via an input mask.
At the time of the request, the following data is collected:

• Name and first name

• E-mail address

• Password

• Company name

Legal basis

The processing of the data entered during registration or inquiry is based on the execution of an existing contractual relationship or, in the case of support in the context of a test account, the initiation of a contract (Art. 6 para. 1 lit. b GDPR).

Recipients

Recipients of the data may be technical service providers who act as data processors for the operation and maintenance of our website.

Third country transfer

The collected data will not be transferred to third countries.

Storage period

Data is processed in this context for the duration of the existence of the contractual relationship or its initiation. In the event that no contractual relationship is established after a test period, the data will be deleted within 90 days.

Provision mandatory or required

The provision of your personal data is voluntary. However, without the provision of your personal data, we cannot process your support request.

2.4 Applications

Purpose of processing and legal basis

You can apply online to Workist via our application portal. We will process the data provided by you exclusively for the purpose of assessing your professional suitability for the advertised position and for contacting you.

The processing is carried out for the purpose of establishing an employment relationship pursuant to Art. 6 (1) lit. b GDPR, where applicable in conjunction with the relevant national laws, such as Section 26 (1) of the German Federal Data Protection Act (BDSG).

Recipients of the data

Within the company, access to your data is granted to those parties that need it to fulfill contractual, legal and supervisory obligations and to protect our legitimate interests.

We use a recruiting tool from Personio GmbH for our application process, with the help of which we manage the application process and job postings. We have concluded a data processing agreement with the service provider.

Storage period

If your application is rejected, your data will be deleted within 180 days.

If an employment relationship is established, the application documents will be stored at Workist for at least the period of employment.

Provision mandatory or required

The provision of your personal data is not required by law or contract. However, without the provision of the data, it is unfortunately not possible to process the application.

2.5 Cookies and similar technologies

Like many other websites, we use cookies. A cookie is a small data record that is created when a website is visited and stored on the user's terminal device. If the server of this website is called up again by the website visitor, the browser of the website visitor sends the previously received cookie back to the server. The server can evaluate the information obtained through this process. Cookies provide us with certain information such as IP address, type of browser and operating system used.

You can find a list of the cookies used with details of the processing purposes and the storage period in our Consent Banner, where you can also change your cookie preferences.

2.5.1 Technically necessary cookies

Type and purpose of processing

We use technically necessary cookies to make our website more user-friendly and to simplify the use of the website. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.

Legal basis and legitimate interest

The processing is carried out in accordance with Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in a user-friendly design of our website.

Recipients

Recipients of the data may be technical service providers who act as data processors for the operation and maintenance of our website.

Third country transfer

The collected data will not be transferred to third countries.

Provision mandatory or required

The provision of the aforementioned personal data is not required by law or contract. However, without this data, the service and functionality of our website cannot be guaranteed. In addition, individual services and services may not be available or may be limited.

Objection

Please read the information about your right to object according to Art. 21 GDPR below.

2.5.2 Technically unnecessary cookies

We also use cookies and similar technologies to better tailor our website to the interests of website visitors and to improve our website based on statistical analysis.

In this section, you will first find the general information about the relevant services. Details about the tools used can be found below.

Legal basis

The legal basis for these processing operations is in each case your consent pursuant to Art. 6 (1) lit. a GDPR. If it comes to the storage of information (such as cookies) in your terminal equipment or access to information already stored in your terminal equipment, the legal basis is your consent pursuant to Section 25 Telecommunications Telemedia Data Protection Act (TTDSG).

Recipients

Recipients of the data may be technical service providers who act as data processors for the operation and maintenance of our website.

For further recipients, please refer to the information below on the display, tracking, remarketing and web analysis technologies used.

Third-country transfer

Please refer to the listings of the individual display, tracking, remarketing and web analytics providers for information on this.

Provision prescribed or required

Of course, you can generally view our website without cookies and similar technologies. Internet browsers are regularly set to accept cookies. You can deactivate the use of cookies at any time via your browser settings. Please note that individual functions of our website may not work if you have disabled the use of cookies.

Withdrawal of consent

You can revoke your consent at any time via our Consent Banner.

Profiling

Profiling of website visitors by Workist does not take place.

Google Analytics

Type and purpose of processing

If you have given your consent, this website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies that allow us to analyze your use of our website and draw conclusions about user behavior on our website. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, due to the activation of IP anonymization on this website, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of Workist, Google uses this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity.

For more information on data processing by Google, please see the following link: https://policies.google.com/privacy.

Recipients of the data and third country transfer

The data is transmitted to Google. To make this possible, we have concluded a data processing agreement with Google.

Google processes your data in the USA. Please note that the level of data protection in the USA does not correspond to that in the European Union; there is also currently no adequacy decision by the European Commission for the USA. To protect your data even after transfer, we have concluded standard contractual clauses with the service provider. Upon request, we will provide you with a copy of the standard contractual clauses.

Storage period

The data is deleted as soon as you have revoked your consent or it is no longer required to achieve the purpose for which it was collected. Deletion generally takes place 14 months after the data has been made available.

Revocation of consent

You can stop tracking by Google Analytics on our website by clicking this link. This will install an opt-out cookie on your device. This will prevent data collection by Google Analytics for this website and for this browser in the future, as long as the cookie remains stored in your browser.

You can also prevent the collection and processing of data generated by the cookie and related to your use of the website (including your IP address) by Google by downloading and installing the browser plugin available at the following link: Browser Add-On to disable Google Analytics.

Google Ads and Google Ads Conversion Tracking

Nature and purpose of processing

Our website uses Google Conversion Tracking. The provider of this service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The purpose of this processing is the so-called conversion tracking, i.e. we can see what happened after you clicked on our ad. If you arrive at our website via a Google ad, Google Ads sets a cookie on your terminal device.

If you visit certain subpages of our website and the cookie has not yet expired, we and Google can recognize that you clicked on an ad and were redirected to us. The information collected by the conversion cookie is used to create statistics regarding Google Ads. In doing so, we obtain the total number of users who clicked on our ad and were redirected to our website. However, the information obtained does not allow us to identify users personally.

For more information, please see the following link: https://policies.google.com/privacy.

Recipients of the data and third country transfer

When you visit our website, your personal data, including your IP address, is transferred to Google in the USA. Please note that the level of data protection in the USA does not correspond to that of the European Union; there is also currently no European Commission adequacy decision for the USA. In order to protect your data even after the transfer, we have concluded standard contractual clauses with the service provider. Upon request, we will provide you with a copy of the standard contractual clauses.

Storage period

The cookies used in this context, which are not used for personal identification, expire after 90 days.

Withdrawal of consent

If you wish to prevent the relevant tracking of your activities on our website, you can refuse the cookie use required for this, for example by deactivating the automatic use of cookies in your browser or blocking cookies from the domain "googleleadservices.com". In addition, you can disable relevant cookies at the following link: https://adssettings.google.com.

Google Marketing Platform

Nature and purpose of processing

Our website uses the services of the Google Marketing Platform (formerly "DoubleClick"), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

This tool uses cookies to serve ads that are relevant to users, to improve marketing campaigns, and to prevent a user from being shown the same ad multiple times. For this purpose, Google uses a cookie ID to record which ads were displayed in which browser. In addition, Google can use the cookie ID to record so-called conversions, i.e. the fact that a website visitor visited our website after seeing a relevant ad. If you are logged into your Google account, Google can associate your visit to the relevant website with your user account. If you do not want this, please log out of your Google account beforehand.

Recipients of the data and third country transfer

Your personal data will be transferred to Google in the USA. Please note that the level of data protection in the USA does not correspond to that in the European Union; there is currently also no adequacy decision by the European Commission for the USA. To protect your data even after the transfer, we have concluded standard contractual clauses with the service provider. Upon request, we will provide you with a copy of the standard contractual clauses.

Storage period

Your data will be deleted as soon as you have revoked your consent or the data is no longer required to achieve the purpose for which it was collected.

Revocation of consent

To prevent the use of the Google Marketing Platform, you can prevent the setting of the corresponding cookies, for example in your browser settings or by adjusting your settings accordingly under the following link: https://adssettings.google.com.

Google Tag Manager

This website uses Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a solution that allows us to manage tags used for tracking and marketing through a single interface. It enables JavaScript and HTML tags on our website to be deployed or updated quickly. The Google Tag Manager tool that implements these tags does not set any cookies or collect any personal data. Rather, it is only used to manage other services, such as Google Analytics.

Information on this can be found at https://www.google.com/intl/de/tagmanager/use-policy.html.

LinkedIn Analytics

Nature and purpose of processing

We use LinkedIn Analytics, a service provided by LinkedIn Ireland, Wilton Plaza, Wilton Place, Dublin 2, Ireland ("LinkedIn"). LinkedIn stores and processes information about your user behavior on our website. For this purpose, the service stores cookies on your terminal device. We use LinkedIn Analytics to analyze the use of our website and to continuously improve individual functions of our website and the overall user experience. The statistical evaluation of user behavior enables us to continuously improve our offer and make it more interesting for our website visitors.

More information about the processing of your data by LinkedIn can be found at the following link: https://www.linkedin.com/legal/privacy-policy.

Recipients of the data and third country transfer

LinkedIn, as the recipient of your data, transfers your data to the USA. Please note that the level of data protection in the USA does not correspond to that in the European Union; there is currently also no adequacy decision by the European Commission for the USA. In order to protect your data even after the transfer, we have concluded standard contractual clauses with the service provider. Upon request, we will provide you with a copy of the standard contractual clauses.

Storage period

The data is deleted as soon as you have revoked your consent or it is no longer required to achieve the purpose for which it was collected. In principle, the relevant cookies are each valid for the duration of the session, 24 hours, 30 days or two years.

Withdrawal of consent

If you do not want LinkedIn Analytics to be used, you can revoke your consent in our Consent Banner. In addition, you can adjust your privacy settings or opt out of the use of LinkedIn Analytics in general on the LinkedIn website: https://www.linkedin.com/legal/cookie-policy.

LinkedIn Ads

Type and purpose of processing

We also use the retargeting and conversion tracking tool of LinkedIn Ireland, Wilton Plaza, Wilton Place, Dublin 2, Ireland. For this purpose, the LinkedIn Insight Tag is integrated into our website. LinkedIn thus collects statistical, pseudonymized data about your visit to our website and provides us with corresponding aggregated statistics.

More information about the processing of your data by LinkedIn can be found at the following link: https://www.linkedin.com/legal/privacy-policy.

Recipients of the data and third country transfer

LinkedIn, as the recipient of your data, transfers it to the USA. Please note that the level of data protection in the USA does not correspond to that of the European Union; there is also currently no adequacy decision by the European Commission for the USA. In order to protect your data even after the transfer, we have concluded standard contractual clauses with the service provider. Upon request, we will provide you with a copy of the standard contractual clauses.

Storage period

Depending on the type of data, it will be stored for the duration of the session, 24 hours or two years.

Revocation of consent

If you do not want LinkedIn Ads to be used, you can revoke your consent in the Consent Banner. In addition, you can adjust your privacy settings or generally refuse the use of LinkedIn Ads on the LinkedIn website: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Microsoft Ads

Nature and purpose of processing

Microsoft sets cookies on the end devices of website visitors that analyze user behavior on our website. This happens if the website visitor arrived at our website via a Microsoft Ads ad. In doing so, we obtain information about the total number of users who clicked on this type of ad. No IP addresses are stored and no information about the identity of the website visitors is disclosed. The provider of the service is Microsoft Corporation, 1 Microsoft Way, Redmond, Washington 98052-8300, USA ("Microsoft").

For more information, please see Microsoft's privacy policy: https://privacy.microsoft.com/de-de/privacystatement.

Recipients of the data and third country transfers

Microsoft, as the recipient of your data, processes the data in the USA. Please note that the level of data protection in the USA is not the same as in the European Union; there is also currently no European Commission adequacy decision for the USA. To protect your data even after transfer, we have concluded standard contractual clauses with the service provider. Upon request, we will provide you with a copy of the standard contractual clauses.

Storage period

Depending on the type of data, it will be stored for 30 minutes or 90 days.

Withdrawal of consent

If you do not wish to use Microsoft Ads, you can revoke your consent in the Consent Banner. In addition, you can generally refuse the use of Microsoft Ads at the following link: https://account.microsoft.com/privacy/ad-settings/.

HubSpot

Nature and purpose of the processing

HubSpot is a software solution that we use to cover various aspects of our online marketing. These include email marketing, reporting, social media publishing, contact management, landing pages and contact forms. The service is provided by HubSpot Inc, 25 First Street, Cambridge, MA 02141, USA ("HubSpot").

The relevant information is stored on the servers of our service provider HubSpot. We may use it to contact website visitors as well as to determine which of our company's services are of interest to them.

More information about the processing of your data by HubSpot can be found at the following link: https://legal.hubspot.com/privacy-policy.

Recipients and transfer to third countries

HubSpot, as the recipient of your data, processes the data in the USA. Please note that the level of data protection in the USA does not correspond to that in the European Union; there is currently also no adequacy decision by the European Commission for the USA. To protect your data even after transfer, we have concluded standard contractual clauses with the service provider. Upon request, we will provide you with a copy of the standard contractual clauses.

Storage period

Depending on the type of data, it will be stored for the duration of the session, 30 minutes, one day, one year or 13 months.

Withdrawal of consent

If you want to prevent the use of HubSpot, you can revoke your consent at any time in our Consent Banner.

Hotjar

Nature and purpose of processing

This website uses the Hotjar analytics tool provided by Hotjar Ltd, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St. Julian's STJ 3141, Malta. We use Hotjar to obtain information about how a user interacts with our site. In doing so, your personal data is automatically anonymized. In particular, your IP address, device information (browser and client information), location, language settings and visited sub-websites, as well as the date and time of access are processed.

Additional information on Hotjar can be found in Hotjar's privacy policy, which can be accessed at https://www.hotjar.com/legal/policies/privacy/.

Recipients and transfer to third countries

Here, your data is also processed in the USA, i.e. outside the EEA, among other places. Since there is no adequacy decision in this regard, we use additional safeguards and measures to ensure an appropriate level of protection in data processing.

We have concluded standard contractual clauses with Hotjar (pursuant to Art. 46 II, III GDPR).

Storage period

Depending on the type of data, it will be stored between 90 days and 365 days.

Withdrawal of consent

An option for a simple opt-out or blocking of data transmission is offered by the provider. Instructions for this can be found at https://www.hotjar.com/policies/do-not-track/.

In addition, if you want to prevent the use of Hotjar, you can revoke your consent at any time in our Consent Banner.

Facebook Pixel

Type and purpose of processing

We use Facebook Pixel, a service provided by Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland. Facebook stores and processes information about your user behavior on our website. For this purpose, the service stores a cookie on your terminal device. We use Facebook Pixel to track visitor interactions with websites ("events") after they have clicked on an ad placed on Facebook or other services provided by Meta ("conversion") and to continuously improve individual features of our website and the overall user experience. The statistical analysis of user behavior enables us to continuously improve our offer and make it more interesting for our website visitors.

Recipients of the data and third country transfer

Your personal data will be transferred to Meta in the USA. Please note that the level of data protection in the USA does not correspond to that in the European Union; there is currently also no adequacy decision by the European Commission for the USA. To protect your data even after the transfer, we have concluded standard contractual clauses with the service provider. Upon request, we will provide you with a copy of the standard contractual clauses.

Storage period

Your data will be deleted as soon as you have revoked your consent or the data is no longer required to achieve the purpose for which it was collected.

Revocation of consent

To prevent the use of Facebook Pixel, you can prevent the setting of the corresponding cookies, for example in your browser settings or by revoking your consent at any time in our Consent Banner.

Facebook Custom Audiences

Nature and purpose of the processing

We use Facebook Custom Audiences, a service provided by Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland. Facebook stores and processes information about your user behavior on our website. For this purpose, the service stores a cookie on your terminal device. We use Facebook Custom Audiences to play out target group-relevant advertising and to continuously improve individual functions of our website and the overall user experience. The statistical analysis of user behavior enables us to continuously improve our offer and make it more interesting for our website visitors.

Recipients of the data and third country transfer

Your personal data will be transferred to Meta in the USA. Please note that the level of data protection in the USA does not correspond to that in the European Union; there is currently also no adequacy decision by the European Commission for the USA. To protect your data even after the transfer, we have concluded standard contractual clauses with the service provider. Upon request, we will provide you with a copy of the standard contractual clauses.

Storage period

Your data will be deleted as soon as you have revoked your consent or the data is no longer required to achieve the purpose for which it was collected.

Withdrawal of consent

To prevent the use of Facebook Custom Audiences, you can prevent the setting of the corresponding cookies, for example in your browser settings or by adjusting your settings accordingly under the following link: https://www.facebook.com/ads/website_custom_audiences.

Usercentrics

Type and purpose of processing

We use Usercentrics, a service provided by Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany. We use the Consent tool from Usercentrics for the purpose of consent management on our website.

Storage period

Your data will be deleted as soon as you have revoked your consent or the data is no longer required to achieve the purpose for which it was collected.

Revocation of consent

To prevent the use of Usercentrics, you can prevent the setting of the corresponding cookies, for example in your browser settings.

3. What data protection rights do you have?

Every data subject has the right to information under Article 15 of the GDPR, the right to rectification under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restriction of processing under Article 18 of the GDPR, the right to object under Article 21 of the GDPR and the right to data portability under Article 20 of the GDPR.

You may revoke your consent to the processing of personal data at any time. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected.

In addition, you have the right to lodge a complaint with the competent data protection supervisory authority, e.g. the supervisory authority of your place of residence or the authority that supervises us. A list of the supervisory authorities with the respective addresses can be found at: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_node.html

4. Information about your right to object according to Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you which is carried out on the basis of Art. 6(1)(f) GDPR (data processing on the basis of a balance of interests); this also applies to profiling based on this provision within the meaning of Art. 4 No. 4 GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

5. SSL encryption

To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. SSL) via HTTPS.

6. Change of our privacy policy

We reserve the right to adapt this privacy policy so that it always complies with the current legal requirements or to implement changes to our services in the privacy policy, e.g. when introducing new services. The new privacy policy will then apply to your next visit.