Handling of personal data

Notice regarding the handling of personal data

I. Name and address of the controller

The controller, as defined by the General Data Protection Regulation and other national privacy laws of the Member States, as well as other data protection regulations, is:

AIM Agile IT Management GmbH

represented by the Managing Director, Arvin Arora

Habichthorststrasse 1

30655 Hanover

Tel.: +49 (0)172-5156300

Email: datenschutz@agile-im.de

II. Name and address of the data protection officer

The controller’s data protection officer is:

Lawyer Marion Albrecht

activeLAW Klein.Offenhausen.PartmbB

Hans-Böckler-Allee 26

D-30173 Hanover

Germany

Tel.: +49 (0)511 5 47 47 – 14

Email: m.albrecht@activelaw.de

Website: http://www.alles-recht-so.de

III. General information regarding data processing

1. Scope of the processing of personal data

As a matter of principle, we only collect and use our users’ personal data to the extent that this is necessary for providing a functional website as well as our content and services. We regularly only collect and use our users’ personal data after they have given their consent. An exception applies in cases where it is not possible to obtain such consent in advance for factual reasons and the legal regulations allow the processing of such data.

2. Legal basis for processing personal data

Where we obtain your consent for processing operations involving personal data, Art. 6 (1)(a) of the EU General Data Protection Regulation (GDPR) will be the legal basis for the processing of personal data.

The legal basis for the processing of personal data that is required for performing a contract of which you are a party is Art. 6 (1)(b) GDPR. This also applies to processing operations that are necessary in order to take steps prior to entering into a contract.

Where the processing of personal data is necessary in order to fulfil a legal obligation to which we are subject, the processing is based on Art. 6 (1)(c) GDPR.

Where the processing is necessary in order to protect a legitimate interest of our company or a third party, and where your interests, fundamental rights and freedoms are not overriding the first interest mentioned, the processing will be based on Art. 6 (1)(f) GDPR.

3. Data erasure and storage period

Your personal data will be erased or blocked as soon as the purpose of storing it no longer applies. Data may be stored beyond this period if this was provided for by the European or national legislator in Union law regulations, laws or other regulations to which we are subject. Data will also be blocked or erased when a storage period required by the aforementioned legal provisions expires unless the data must still be retained for entering into a contract or performing a contract.

IV. Provision of the website and creation of log files

1. Description and scope of data processing

Whenever our website is requested, our system automatically records data and information from the system of the requesting computer.

In this context we collect the following data:

Information on the browser type and the version used
The user’s operating system
The user’s internet service provider
The user’s IP address
Date and time of access
Websites from which the user’s system arrives at our website
Websites the user’s system requests through our website

The data is also stored in the log files of our system. This data is not stored together with other of the user’s personal data.

2. Legal basis for data processing

The legal basis for the temporary storage of the data and the log files is Art. 6 (1)(f) GDPR.

3. Purpose of data processing

The temporary storage of the IP address by the system is necessary in order to make the website available to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session.

Data is stored in log files in order to ensure the operability of the website. In addition, data is used to optimise the website and to ensure the security of our IT systems. Data is not analysed for marketing purposes in this context.

These purposes also reflect our legitimate interest in the processing of data in accordance with Art. 6 (1)(f) GDPR.

4. Storage period

Data is erased when it is no longer needed to fulfil the purpose for which it was collected. With respect to the recording of data in order to provide the website, data is no longer needed when the session in question has been terminated.

With respect to the storage of data in log files, it is no longer needed after a maximum of seven days. Data may be stored for a longer period. In this case, the user’s IP address is deleted or distorted in order to ensure that it is no longer possible to relate the requesting client to it.

5. Right to object and to have data removed

The recording of data in order to provide the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently, you cannot object to it.

V. Use of cookies

a) Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in the internet browser or rather on the user’s computer by the internet browser. When a user requests a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters which make it possible to clearly identify the browser when the website is requested again.

We also use cookies on our website that allow us to analyse users’ browsing behaviour.

The following data may be transmitted this way:

(1) Google Analytics ID

(2) Frequency of page requests

(3) Use of website features

The users’ data that is collected this way is pseudonymised through technical means. Consequently, it is no longer possible to relate the data to the requesting user. The data is not stored together with any other of the users’ personal data.

When our website is requested, an information banner informs users about the use of cookies for analytical purposes and they are referred to this Privacy Notice. In this context, users are also informed about how they can prevent cookies from being stored in their browser settings.

b) Legal basis for data processing

The legal basis for processing personal data through the use of cookies is Art. 6 (1)(f) GDPR.

c) Purpose of data processing

Analytics cookies are used to improve the quality of our website and its content. The analytics cookies provide information to us on how people use our website and allow us to continuously optimise our offering.

These purposes also reflect our legitimate interest in the processing of the personal data in accordance with Art. 6 (1)(f) GDPR.

e) Storage period, right to object and to have data removed

Cookies are stored on the user’s computer and are transmitted to our website from the user’s computer. This gives you, as the user, full control over the use of cookies. You can disable or restrict the transmission of cookies by changing your browser settings. You can delete any cookies already stored on your computer at any time. This can also be done automatically. When users disable cookies for our website, they may no longer be able to fully use all features of the website.

VI. Newsletter

1. Description and scope of data processing

Our website offers a newsletter users can subscribe to free of charge. In this context, the data from the input mask is sent to us when users register for the newsletter.

We receive your email address and your first and last name if you provide it.

In addition, we collect the following data in the context of the registration:

IP address of the requesting computer
Date and time of the registration

In the process of the registration you will be asked to give your consent to the processing of such data and you are referred to this Privacy Notice.

We do not disclose any data to third parties in the context of sending newsletters. This data is only used for the purpose of sending the newsletter.

2. Legal basis for data processing

Where the user has given his/her consent, the legal basis for processing the data after a user has subscribed to the newsletter is Art. 6 (1)(a) GDPR.

3. Purpose of data processing

The user’s email address is collected in order to deliver the newsletter.

We collect additional personal data in the context of the registration process in order to prevent a misuse of the services or the email address used.

4. Storage period

Data is erased when it is no longer needed to fulfil the purpose for which it was collected. Consequently, the user’s email address will be stored as long as the user’s subscription of the newsletter is active.

The other personal data collected in the context of the registration process is usually deleted after a period of seven days.

5. Right to object and to have data removed

You can unsubscribe from the newsletter at any time. A respective link is provided in each newsletter. This also allows you to revoke your consent to the storage of the personal data collected during the registration process.

VII. Contact form and email contact

1. Description and scope of data processing

Our website provides a contact form that can be used for contacting us electronically. If you use this option, the data entered into the input mask is transmitted to and stored by us. This data consists of: name, email address and telephone number.

In addition, we store the following information at the time when the message is sent:

The user’s IP address
Date and time of the registration
Name
Email address
Telephone number

You will be asked to give your consent to the processing of such data and will be referred to this Privacy Notice in the context of the submission process.

Alternatively, you can contact us using the email address provided. In this case, we will store the personal data submitted in the e-mail.

We do not disclose the data to third parties in this context. This data is only used for the purpose of processing the correspondence.

2. Legal basis for data processing

When you have given your consent, the legal basis for processing the data is Art. 6 (1)(a) GDPR.

The legal basis for processing data transmitted in the context of sending us an email is Art. 6 (1)(f) GDPR. Where a user contacts us by email for the purpose of entering into a contract, the processing will also be based on Art. 6 (1)(b) GDPR.

3. Purpose of data processing

We only use the personal data from the input mask to process the email that was sent to contact us. Where people contact us by email, this also implies the required legitimate interest in processing the data.

The additional personal data that is processed when a message is sent to us is used to prevent a misuse of the contact form and to ensure the security of our IT systems.

4. Storage period

Data is erased when it is no longer needed to fulfil the purpose for which it was collected. Personal data from the input mask of the contact form and personal data sent by email is no longer required when the respective correspondence with you has ended. The correspondence has “ended” when the circumstances show that the respective matter has been resolved conclusively.

The additional personal data collected during the process of submitting the form is usually deleted after a maximum of seven days.

5. Right to object and to have data removed

You can revoke your consent to the processing of the personal data at any time. If you contact us by email, you can object to the storage of your personal data at any time. In this event we will not be able to continue the correspondence. All personal data that was stored in the context of your contacting us will be deleted in this case.

VIII. Data subject rights

If personal data concerning you is processed, you are the “data subject”, as defined in the GDPR, and you have the following rights vis-à-vis the controller:

1. Right of access

You may ask us to confirm whether we are processing personal data concerning you.

Where such processing exists, you may request the following information from us:

(1) the purposes for which the personal data is being processed;

(2) the categories of personal data being processed;

(3) the recipients or categories of recipients to whom the personal data concerning you has been disclosed or is still being disclosed;

(4) the intended period of the storage of the personal data concerning you or, where it is not possible to provide detailed information in this respect, criteria for determining the storage period;

(5) the existence of a right to have the personal data concerning you rectified or erased, a right to have the controller restrict the processing, or a right to object to this processing;

(6) the existence of a right to lodge a complaint with a supervisory authority;

(7) all available information regarding the origin of the data if it was not collected from the data subject;

(8) the existence of automated decision-making including profiling in accordance with Art. 22 (1) and (4) GDPR and – at least in these cases – meaningful information regarding the involved logic, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether the personal data concerning you is being transmitted to a third country or an international organisation. In this context, you may request to be informed about the appropriate guarantees provided in connection with the data transfer in accordance with Art. 46 GDPR.

2. Right to rectification

You have the right to demand that we rectify and/or complete personal data concerning you if the data being processed is inaccurate or incomplete. We have a duty to rectify such information without undue delay.

3. Right to restriction of processing

Under the following circumstances you may request that the processing of personal data concerning you be restricted:

(1) if you dispute the accuracy of the personal data concerning you for a period that allows us to verify the accuracy of the personal data;

(2) if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;

(3) if we no longer need the personal data for the purposes of the processing operation but you need this data for the establishment, exercise or defence of legal claims; or

(4) if you have objected to processing pursuant to Article 21 (1) GDPR pending the verification whether our legitimate grounds override yours.

Where processing of the personal data concerning you has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

Where processing was restricted under the aforementioned circumstances, we will notify you before the restriction of processing is lifted.

4. Right to erasure

a) Duty to erase

You have the right to demand that we erase the personal data concerning you without undue delay, and we have a duty to erase such data without undue delay where one of the following reasons applies:

(1) The personal data concerning you is no longer required for the purposes for which it was collected or otherwise processed.

(2) You revoke your consent on which the processing is based in accordance with Art. 6 (1)(a) or Art. 9 (2)(a) GDPR, and there is no other legal basis for the processing.

(3) You object to the processing in accordance with Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing in accordance with Art. 21 (2) GDPR.

(4) The personal data concerning you has been unlawfully processed.

(5) The personal data concerning you has to be erased for compliance with a legal obligation in Union or Member State law to which we are subject.

(6) The personal data concerning you has been collected in relation to the offer of information society services referred to in Art. 8 (1) GDPR.

b) Information to third parties

Where we have made the personal data concerning you public and are obliged to erase the personal data in accordance with Art. 17 (1) GDPR, we will take reasonable steps, including technical measures, taking into account the available technology and the cost of implementation, to inform data controllers which are processing the personal data that you, as the data subject, have requested the erasure by such controllers of any links to, or copy or replication of, this personal data.

c) Derogations

The right to erasure does not apply to the extent that the processing is necessary:

(1) for exercising the right of freedom of expression and information;

(2) for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;

(3) for reasons of public interest in the area of public health in accordance with Art. 9 (2)(h and i) and Art. 9 (3) GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89 (1) GDPR in so far as the right referred to in Section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

(5) for the establishment, exercise or defence of legal claims.

5. Right of information

Where you have exercised your right to rectification, erasure or restriction of processing, we have a duty to inform all recipients to whom personal data concerning you was disclosed about this rectification or erasure of data or the restriction of processing unless this proves impossible or involves disproportionate effort.

You have the right to be informed about these recipients.

6. Right to data portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. Furthermore, you have the right to transmit such data to another controller without hindrance from the controller to which the personal data has been provided, where

(1) the processing is based on consent in accordance with Art. 6 (1)(a) GDPR or Art. 9 (2)(a) GDPR or on a contract in accordance with Art. 6 (1)(b) GDPR; and

(2) the processing is carried out by automated means.

In exercising this right you further have the right to have the personal data concerning you transmitted directly from one controller to another where this is technically feasible. This must not adversely affect the rights and freedoms of others.

7. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art 6 (1)(e or f) GDPR; this also applies to profiling based on those provisions.

We will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or where the personal data is being processed for the establishment, exercise or defence of legal claims.

Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.

Where you object to the processing for purposes of direct marketing, the personal data concerning you will no longer be used for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. Right to revoke the consent provided for data protection law purposes

You have the right to revoke your consent provided for data protection law purposes at any time. The revocation of your consent does not affect the lawfulness of processing based on the consent before its revocation.

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged violation, if you believe that the processing of personal data concerning you violates the GDPR.

The supervisory authority with which the complaint has been lodged will inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy in accordance with Article 78 GDPR.

The supervisory authority responsible for our company is:

The State Commissioner for Data Protection for the State of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Telephone: +49 511 120-4500, Fax: +49 511 120-4599, Email: poststelle@lfd.niedersachsen.de

10. Privacy notice regarding Google Analytics

On our website we use Google Analytics, an analytics service provided by the US company Google Inc. (“Google”), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics uses “cookies”, small text files that are stored on your computer. These cookies are used to analyse your use of our website. The respective data regarding your user behaviour is forwarded to a server of the Google company in the United States and is analysed and stored there.

If IP anonymisation is enabled on this website within the Member States of the European Union and the Agreement on the European Economic Area, Google will shorten your IP address for anonymisation purposes. In this event, IP addresses will only be transferred to the United States without having been shortened in exceptional cases. In these cases, the IP address will be shortened on a server in the United States.

At the instigation of the owner of this website, Google will use this information to analyse how you use the website. Furthermore, Google will use this information to prepare reports on the website activities and provide additional services related to the use of the website and the use of the internet to its operator. Google will not combine the IP address provided by your browser through the use of Google Analytics with other Google data.

You can prevent the storage of cookies yourself by selecting the respective settings in your browser. However, in this case you may not be able to fully use all features of the website. You can prevent the recording of the data generated by the cookie on your use of the website (including your IP address) as well as the processing of such data by Google. You only need to download and install an additional browser plugin for this purpose. You can download this plugin using the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

11. Privacy notice regarding Atlassian Marketplace

We offer our plugins at https://marketplace.atlassian.com/.

This marketplace contains a link to our contact form on this website.

In addition, we also use a solution to record customer inquiries which is provided by Atlassian Marketplace (Atlassian Jira Servicedesk).

If you use this option, the data entered into the input mask is transmitted to and stored by us. This data consists of: Name, email address and user name.

You will be asked to give your consent to the processing of such data and will be referred to this Privacy Notice in the context of the submission process.

We do not disclose the data to third parties in this context. This data is only used for the purpose of processing the correspondence.

Where you have given your consent, the legal basis for processing the data is Art. 6 (1)(a) GDPR.

We only use the personal data from the input mask to process the email that was sent to contact us.

The additional personal data that is processed when a message is sent to us is used to prevent a misuse of the contact form and to ensure the security of our IT systems.

We are not informed about the user data recorded by Atlassian.

We do receive personal data through Atlassian if you actively provide it to us in a personal message. We use your data to answer your request in our customer service department. Your data is stored in our CRM System for this purpose.

Further information regarding Atlassian’s privacy shield status is available here: https://de.atlassian.com/legal/privacy-policy

We cannot exclude the possibility that personal data of users will be transferred to, or further processed, in third countries such as the United States, or any related risks for users.

Due to the continuous development of Atlassian, the availability and the preparation of the data changes. Consequently, we refer to Atlassians’s privacy notice already mentioned above for further details in this respect.

User rights

Given that only Atlassian has full access to the user data, we recommend that you contact Atlassian directly if you would like to request information or have any other questions regarding your rights as a user (e.g. the right to erasure). Please do not hesitate to contact us if you need assistance with contacting them or have any other questions.