Privacy policy

1. Introduction

Below we explain the processing of personal data when using

• our website https://sysfacts.com
• our social media profiles.

Personal data means any information relating to an identifiable natural person, such as their name or IP address.

1.1 Contact details

The controller under Article 4(7) of the EU General Data Protection Regulation (GDPR) is Sysfacts GmbH, Rudolfplatz 3, Cologne, Germany, email: experts@sysfacts.com. We are legally represented by Yannick Haymann.

Our data protection officer can be contacted through heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, email: datenschutz@heydata.eu .

1.2 Scope, purposes and legal bases of processing

The scope, purposes and legal bases of processing are described in detail below. The following legal bases may generally apply:

• Article 6(1)(a) GDPR provides the legal basis for processing for which we obtain consent.
• Article 6(1)(b) GDPR applies where processing is necessary to perform a contract, for example when a visitor purchases a product or we provide a service. It also applies to processing necessary for pre-contractual measures, such as enquiries about our products or services.
• Article 6(1)(c) GDPR applies where processing fulfils a legal obligation, for example under tax law.
• Article 6(1)(f) GDPR applies where processing is based on legitimate interests, for example cookies required for the technical operation of our website.

1.3 Processing outside the EEA

Where we transfer data to providers or other third parties outside the EEA, European Commission adequacy decisions under Article 45(3) GDPR ensure protection during transfer where such decisions exist, as is the case for the United Kingdom, Canada and Israel, for example.

For transfers to US providers, a European Commission adequacy decision provides the legal basis where the provider is also certified under the EU-US Data Privacy Framework.

In other cases, such as where no adequacy decision exists, transfers generally rely on standard contractual clauses unless we state otherwise. These are rules adopted by the European Commission and form part of the contract with the third party. Under Article 46(2)(b) GDPR, they ensure security of the transfer. Many providers give additional contractual safeguards beyond these clauses, such as data encryption or an obligation to notify data subjects when law enforcement authorities seek access.

1.4 Retention

Unless expressly stated otherwise in this policy, stored data is deleted when it is no longer needed for its purpose and no statutory retention obligation prevents deletion. Where data remains necessary for other lawful purposes, processing is restricted: the data is blocked and not processed for other purposes. This applies, for example, to data retained under commercial or tax law.

1.5 Data subjects' rights

You have the following rights regarding your personal data:

• Right of access.
• Right to rectification or erasure.
• Right to restriction of processing.
• Right to object to processing.
• Right to data portability.
• Right to withdraw consent at any time.

You also have the right to complain to a data protection supervisory authority about the processing of your personal data. Contact details for the authorities are available at bfdi.bund.de .

1.6 Requirement to provide data

Within a business or other relationship, customers, prospective customers and third parties need only provide the personal data required to establish, perform and end that relationship, or which we are legally required to collect. Without this data, we will generally have to refuse to enter into a contract or provide a service, or may be unable to continue an existing relationship.

Required information is marked as such.

1.7 No automated individual decision-making

We generally do not use fully automated decision-making under Article 22 GDPR to establish or conduct a business or other relationship. If we use such procedures in individual cases, we will provide separate information where legally required.

1.8 Contact

When you contact us, for example by email or telephone, we store the information you provide, such as names and email addresses, to answer your enquiry. The legal basis is our legitimate interest in responding to enquiries, Article 6(1)(f) GDPR. We delete this data when storage is no longer necessary, or restrict processing where statutory retention obligations apply.

2. Newsletter

We reserve the right to occasionally inform customers who have already purchased goods or services from us about our offers by email or other means, unless they have objected. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is direct marketing (Recital 47 GDPR). Customers can object to use of their email address for marketing at any time without additional cost, for example through the link at the end of each email or by emailing the address above.

Interested parties can subscribe to a free newsletter. We process registration data solely to send it. Registration takes place by selecting the relevant field on our website, ticking a box on a paper document or another clear action expressing consent, making Article 6(1)(a) GDPR the legal basis. Consent may be withdrawn at any time, for example through the newsletter link or by contacting the email address above. Withdrawal does not affect the lawfulness of processing before withdrawal.

With recipients' consent under Article 6(1)(a) GDPR, we also measure newsletter open and click rates to understand which content is relevant.

3. Processing on our website

3.1 Information for visitors from Germany

Our website stores information on visitors' devices, such as cookies, or accesses information already stored there, such as IP addresses. The following sections explain the information involved.

Storage and access are based on the following provisions:

• Where storage or access is strictly necessary to provide a website service expressly requested by the visitor, such as operating a chatbot used by the visitor or ensuring website IT security, it is based on section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
• Otherwise, storage or access requires the visitor's consent under section 25(1) TDDDG.

Subsequent processing follows the sections below and the GDPR.

3.2 Browsing the website

When visitors browse without separately providing information, we collect personal data transmitted by the browser to our server to ensure website stability and security. This is our legitimate interest, making Article 6(1)(f) GDPR the legal basis.

This data includes:

• IP address
• Date and time of the request
• Time-zone difference from Greenwich Mean Time (GMT)
• Request content (specific page)
• Access status/HTTP status code
• Volume of data transferred
• Referring website
• Browser
• Operating system and interface
• Browser language and version

This data is also stored in log files. It is deleted when retention is no longer required, and no later than after 14 days.

3.3 Hosting and website delivery

Our website is hosted by Netlify, which also acts as its content delivery network (CDN). The provider is Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, California 94104, USA. It processes personal data transmitted through the website, such as content, usage, metadata/communications or contact data, in the USA. Further information is available in the provider's privacy policy at netlify.com/privacy.

We have a legitimate interest in providing a functioning website with sufficient storage and delivery capacity to ensure optimal throughput during traffic peaks. The legal basis is therefore Article 6(1)(f) GDPR.

The legal basis for transfer outside the EEA is a European Commission adequacy decision. Netlify, Inc. is certified under the EU-US Data Privacy Framework (DPF). Protection of transferred data is ensured by the European Commission's finding under Article 45(3) GDPR that companies certified under the framework provide an adequate level of protection.

3.4 Contact form

When you use our website contact form, we store the requested information and message content to answer your enquiry. Our legitimate interest in answering enquiries provides the legal basis under Article 6(1)(f) GDPR. We delete this data when storage is no longer necessary, or restrict processing where statutory retention obligations apply.

3.5 Job advertisements

We publish job advertisements on our website, related pages or third-party websites. Application data is processed to conduct recruitment. Where necessary to decide whether to establish employment, the legal basis is Article 88(1) GDPR in conjunction with section 26(1) of the German Federal Data Protection Act (BDSG). Required data is marked or indicated. Without it, we cannot process the application. Further information is voluntary and not required. Where applicants provide it, processing is based on consent under Article 6(1)(a) GDPR.

We ask applicants not to include political opinions, religious beliefs or similarly sensitive data in CVs or cover letters, as it is not required. If applicants nevertheless provide it, we cannot prevent its processing as part of those documents. Processing then also relies on consent under Article 9(2)(a) GDPR.

We also process applicant data for further recruitment procedures where consent has been given. The legal basis is Article 6(1)(a) GDPR.

We share applicant data with the relevant HR employees, our recruitment processors and other employees involved in recruitment.

If employment follows, we delete the data only after employment ends. Otherwise, we delete it no later than six months after rejecting the applicant.

If applicants consent to use of their data for further recruitment procedures, we delete it one year after receiving the application.

3.6 Booking appointments

Visitors can book appointments with us through the website. Alongside the entered data, we process metadata or communications data. Our legitimate interest is to offer a user-friendly booking process, so the legal basis is Article 6(1)(f) GDPR. Information about any third-party tool used appears under “Third-party providers”.

3.7 Technically necessary cookies

Our website uses cookies: small text files stored in the browser on a visitor's device. They help make the service more user-friendly, effective and secure. Where cookies are required for website operation or functionality (“technically necessary cookies”), the legal basis for associated processing is Article 6(1)(f) GDPR. We have a legitimate interest in providing a functioning website to customers and other visitors. Specifically, we use technically necessary cookies

• to remember search terms
• to retain language settings

3.8 Third-party providers

4. Processing on social media platforms

We maintain social media profiles to present our organisation and services. Network operators regularly process user data for advertising. They create profiles from online behaviour, for example to display advertising matching users' interests on their platforms and elsewhere online. They store information about usage in cookies on users' devices and may combine it with other data. Further information and ways to object are provided in the operators' privacy policies below. Operators or servers may be located outside the EU and process data there. This may pose risks, such as making rights harder to enforce or allowing public authorities access to data.

When users contact us through our profiles, we process the information provided to answer their enquiries. This is our legitimate interest under Article 6(1)(f) GDPR.

4.1 Instagram

We maintain an Instagram profile. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Its privacy policy is available at help.instagram.com/519522125107875.

4.2 LinkedIn

We maintain a LinkedIn profile. The operator is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Its privacy policy is available at linkedin.com/legal/privacy-policy. You can object to processing through the advertising settings at linkedin.com/psettings/guest-controls/retargeting-opt-out.

5. Changes to this privacy policy

We reserve the right to amend this privacy policy with future effect. The current version is available here.

6. Questions and comments

Please contact us using the details above with any questions or comments about this privacy policy.