I. Information on data protection at EVO GmbH
This data protection declaration provides you with information on the type, scope and purpose of the collection and use of personal data by the controller as defined in the General Data Protection Regulation and other national data protection legislation as applied by the member states and other data protection provisions. The controller is
Telefon + 49 89 315 778-20,
Telefax + 49 89 315 778-29
EVO GmbH is hereinafter also referred to as “EVO”, “we” and “us”, and the website is also referred to as the “offer”.
II. Address of the data protection officer
The controller’s data protection officer can be contacted as follows:
Telefon + 49 89 315 778-13
III. General information regarding data processing
1. Legal basis
The legal basis for data protection can be found in the Federal Data Protection Act (BDSG) and the German Telemedia Act (TMG). In addition, this data protection declaration is compliant with all legal requirements that become mandatory following entry into force of the European General Data Protection Regulation (GDPR). The GDPR applies from 25 May 2018.
2. Legal basis for processing personal data
According to § 3 Abs. 1 of the BDSG, personal data are defined as "information concerning personal or material circumstances attributed to an identified or identifiable individual (data subject)". This includes all information that says something about a person.
Wherever we obtain the consent of the data subject to the processing of their personal data, Art. 6 Para. 1(a) of the EU Data Protection Regulation (GDPR) serves as the legal basis.
When personal data is processed that are necessary to fulfil a contract that has the data subject as a contracting party, Art. 6 Para. 1(b) of the GDPR serves as the legal basis. This also applies to processing operations that are necessary to perform pre-contractual measures.
When personal data are processed that are necessary to fulfil a legal obligation to which our company is subject, Art. 6 Para. 1(c) of the GDPR serves as the legal basis.
In the event that the vital interests of the data subject or another natural person make it necessary to process personal data, Art. 6 Para. 1(d) of the GDPR serves as the legal basis.
If processing is necessary to protect the legitimate interests of our company or of a third party, and these interests are not overridden by the interests, fundamental rights and freedoms of the data subject, Art. 6 Para. 1(f) of the GDPR serves as the legal basis for processing.
3. Duration of storage and deletion of data
The data subject’s personal data will be deleted or blocked as soon as the purpose for storing the personal data no longer applies. In addition, personal data may be stored if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. The data will be deleted or blocked if a storage period specified in the aforementioned standards expires, unless it is necessary to continue storing the data in order to conclude a contract or fulfil a contract.
IV. Provision of the website and generation of log files
1. Scope of processing personal data
We generally only process our users’ personal data if this is necessary to provide a functional website and to provide our content and services.
2. Description of data processing
Every time our website is accessed, our system automatically logs data and information about the computer system accessing the website. We collect data about visits to our websites (known as server log files) directly or through our webspace provider. The data collected (access data) may include the following:
▪ Information about the browser type and version
▪ The user’s operating system
▪ The user’s Internet service provider
▪ The user’s IP address
▪ Date and time of access
▪ Websites from which the user’s system accessed our website
▪ Websites that the user’s system accessed via our website
▪ Name of the accessed website
▪ Transferred quantity of data
▪ Notification of successful access
▪ Browser type and version
▪ Referrer URL (the previously visited page)
The data are also stored in the log files in our system. This data is not saved together with the user’s other personal data.
3. Legal basis for data processing
The legal basis for the temporary storage of this data and the log files is Art. 6 Para. 1(f) of the GDPR.
Log files are saved in order to support the functionality of the website. We also use the data to optimise the website and to safeguard the security of our IT systems. The data is not evaluates for marketing purposes in this context. These purposes constitute our legitimate interest in data processing in accordance with Art. 6 Para. 1(f) of the GDPR.
4. Purpose of data processing
The temporary storage of the IP address by the system is necessary to enable to website to transmitted to the user’s computer. For this purpose, the user’s IP address must be stored for the duration of the visit.
Log files are saved in order to support the functionality of the website. We also use the data to optimise the website and to safeguard the security of our IT systems. The data is not evaluates for marketing purposes in this context.
These purposes constitute our legitimate interest in data processing in accordance with Art. 6 Para. 1(f) of the GDPR.
We also use this log data for the purpose of statistical evaluation of the operation, security and optimisation of the offer. In some cases, it may be necessary for us to examine the log data retrospectively if there is justified suspicion of illegal usage on the basis of concrete evidence.
When you visit our pages and transfer personal information (all information that can be used to identify you), you can be sure that we will only use this information for the purposes of communication, contract settlement or the maintenance of the customer relationship between you and us.
5. Duration of storage
The data will be deleted once it is no longer needed to achieve the purpose of its collection. If the data are collected in order to make the website available, this is the case once the visit has ended.
If that data are stored in log files, this is the case after no more than seven days. It is possible that data may be stored beyond this time. In this case, the IP addresses of the users will be deleted or anonymised so that no reference to the accessing client is possible.
6. Possibility of objection and erasure
It is essential for the data to be logged in order to make the website available and for the data to be stored in log files in order to operate the website. As a consequence, there is no possibility of objection or erasure on the part of the user.
EVO GmbH uses so-called cookies to operate our website.
1. What are cookies?
Cookies are small text files that contain information to identify returning visitors. Cookies are generally stored on your device and do not cause any harm. These cookies contain a sequence of characters that enable unique identification of the browser when the website is accessed again. The following data may be stored in the cookies: Language settings, login information. After leaving the website, “session cookies” are deleted. Permanent cookies remain stored on your device until they are deleted from your hard drive by the browser software. This can be done automatically or manually by configuring the appropriate settings. You can prevent cookies from being installed in the first place by configuring your browser software.
The following data may be transmitted in this way:
Here is a list of the data collected. This data may include the following:
(1) Search terms entered
(2) Frequency with which the page is accessed
(3) Website functions used
The user data collected in this way is anonymised using technical methods. This makes it impossible for any reference to be made between the data and the user accessing the website. The data is not stored together with any other personal user data.
When accessing our website, an information banner informs users that cookies are used for analysis purposes and refers them to this data protection declaration. Information is also provided on how to prevent cookies from being stored by configuring the browser settings.
2. Legal basis for data processing
The legal basis for processing personal data using cookies that are necessary for technical reasons is Art. 6 Para. 1(f) of the GDPR.
The legal basis for processing personal data using cookies is Art. 6 Para. 1(f) of the GDPR.
The legal basis for processing personal data using cookies for analysis purposes after appropriate user consent has been provided is Art. 6 Para. 1(f) of the GDPR.
3. Purpose of data processing
Analysis cookies are used to improve the quality of our website and its content. The analysis cookies tell us how the website is used so that we can constantly optimise our offer.
4. Duration of storage, possibility of objection and erasure
VI. Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc. ("Google"). Google Analytics uses the aforementioned cookies. Cookies are small text files that are stored on your computer and enable your use of the website to be analysed. The information generated by the cookie about your use of this website is generally transferred to a Google server in the USA and saved on this server. However, if IP anonymisation is activated on this website, your IP address will first be shortened by Google within Member States of the European Union or in other states outside the European Economic Area that are signatories to the convention. This IP anonymisation is active on this website. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened on this server. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, collate reports about website activity and provide the website operator with additional services relating to the website and Internet use. The IP address of your browser that is transferred as part of Google Analytics will not be combined with any other data from Google.
You can prevent cookies from being saved by configuring the appropriate settings in your browser software; however, please note that in this case it will not be possible to use all of the functions of this website to their full extent.
You can also prevent the data generated by the cookie that relates to your use of the website (incl. your IP address) from being recorded and processed by Google by downloading the browser plugin available at the following link (https://tools.google.com/dlpage/gaoptout?hl=en-GB)
and installing this browser plugin. If you delete your cookies in this browser, you will need to click this link again.
You can prevent the data from being recorded by Google Analytics by clicking the following link: Deactivate Google Analytics. This saves an “opt-out cookie" that prevents your data from being recorded in future when you visit this website. If you delete your cookies in this browser, you will need to click this link again.
Please note that Google Analytics has been expanded on this website to include the code "gat._anonymizeIp();". This ensures that IP addresses are recorded anonymously (known as “IP masking”).
We also use Google Analytics to evaluate data from AdWords and the DoubleClick cookie for statistical purposes. If you want to prevent this, you can deactivate it in the Ad Settings: www.google.com/settings/ads/onweb/. Further information on the terms and conditions of use and on data protection can be found at the following links:
• www.google.co.uk/intl/gb/policies/privacy/ or
The following page on “Verbraucherzentrale” provides information (in German) on configuring cookies in the browser: https://www.verbraucherzentrale.de/wissen/digitale-welt/datenschutz/cookies-im-browser-einstellen-11996
VII. Email contact
1. Description and scope of data processing
It is possible that data will be collected when an email address is used to make contact. In this case, user’s personal data that is transferred with the email will be stored.
No data will be passed on to third parties in this context. The data will be used solely to process the conversation or as part of contractual agreements.
2. Legal basis for data processing
The legal basis for processing data after appropriate user consent has been provided is Art. 6 Para. 1(a) of the GDPR.
The legal basis for processing data using cookies is Art. 6 Para. 1(f) of the GDPR. If the purpose of the email contact is to conclude a contract, the additional legal basis for processing is Art. 6 Para. 1(b) of the GDPR.
3. Purpose of data processing
In the event that contact is made by email, this also provides the necessary legitimate interest for processing data.
4. Duration of storage
The data will be deleted once it is no longer needed to achieve the purpose of its collection. For personal data sent by email, this is the case once the relevant conversation or collaboration with the user
has ended. The conversation is ended once the circumstances show that the relevant matter has been concluded.
The personal data that is also collected during the sending process will be deleted.
5. Possibility of objection and erasure
The user can revoke their consent to the processing of personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In this case, the conversation cannot be continued.
All personal data that was saved during the contact will be deleted.
V. Handling data from applicants
The data collected as part of your application will not be published and will not be sent to third parties without authorisation, i.e. without your consent. Your data will be viewed only by EVO employees who need to use your data in the application process.
The personal data of rejected applicants will be stored for a maximum of six months, starting from the day the application was rejected. The personal data may be stored for longer periods if the data is necessary for the establishment, exercise or defence of legal claims before an authority, or if a legal obligation to retain data applies. The data will be stored for as long as required to fulfil these purposes.
VIII. Rights of the data subject
If your personal data is processed, you are the data subject as defined in the GDPR and you have the following right towards the controller:
1. Right of access
You can request a confirmation from the controller as to whether personal data concerning you is processed by us.
If such data is processed, you can request access to the following information from the controller:
(1) the purposes of processing the personal data;
(2) the categories of personal data that are processed;
(3) the recipients or categories of recipient to whom the personal data concerning you have been or will be disclosed;
(4) the envisaged period for which the personal data will be stored, or, if no information about this is available, the criteria used to determine that period;
(5) the existence of the right to request rectification or erasure of personal data concerning you or restriction of processing of personal data by the controller or to object to such processing;
(6) the right to lodge a complaint with a supervisory authority;
(7) where the personal data are not collected from the data subject, any available information as to their source;
You have the right to request information on whether the personal data concerning you are transferred to a third country or an international organisation.
In this context, you have the right to be informed of the appropriate safeguards pursuant to Art. 46 of the GDPR relating to the transfer.
2. Right to rectification
You have a right of rectification and or completion towards the controller if the processed personal data concerning you is inaccurate or incomplete. The controller must make the rectification without undue delay.
3. Right to restriction of processing
You can request that the processing of the personal data concerning you be restricted if the following conditions are met:
(1) you dispute the accuracy of the personal data concerning you for a period that allows the controller to check the accuracy of the personal data;
(2) the processing is unlawful and you object to the erasure of the personal data and instead request that the usage of the personal data be restricted;
(3) the controller no longer requires the personal data for the purposes of processing, but you require the personal data for the establishment, exercise or defence of legal claims, or
(4) if you have objected to the processing in accordance with Art. 21 Para. 1 of the GDPR and it is not yet clear whether the legitimate reasons of the controller outweigh your reasons.
If the processing of personal data concerning you has been restricted, this data – apart from its storage – can only be processed with your consent or for the establishment, exercise or defence of legal claims or for protecting the rights of another natural or legal person or for reasons of an important public interest in the Union or a Member State.
If processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.
4. Right to erasure
a) Obligation to erase personal data
You can request that the controller erase the personal data concerning you without undue delay, and the controller has an obligation to erase this data without undue delay where one of the following grounds applies:
(1) The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
(2) You withdraw consent on which the processing is based according to Art. 6 Para. 1(a) or Art. 9 Para. 2(a) of the GDPR, and there is no other legal ground for the processing.
(3) You object to the processing pursuant to Art. 21 Para. 1 of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 Para. 2 of the GDPR.
(4) The personal data concerning you have been unlawfully processed.
(5) The personal data concerning you have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
(6) The personal data concerning you have been collected in relation to the offer of information society services referred to in Art. 8 Para. 1 of the GDPR.
b) Information to third parties
Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17 Para. 1 of the GDPR to erase the personal data concerning you, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
The right to erasure shall not apply to the extent that processing is necessary:
(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health in accordance with Art. 9 Para. 2(h) and (i) and Art. 9 Para. 3 of the GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 Para. 1 of the GDPR in so far as the right referred to in Section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(5) for the establishment, exercise or defence of legal claims.
5. Right to be informed
If you have asserted your right to rectification, erasure or restriction of processing against the controller, the controller is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of data or restriction of processing, unless this proves to be impossible or would involve a disproportionate amount of work.
You also have a right towards the controller to be informed of these recipients.
6. Right to data portability
You have the right to receive the data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data concerning you have been provided, where:
(1) the processing is based on consent pursuant to Art. 6 Para. 1(a) of the GDPR or Art. 9 Para. 2 (a) of the GDPR or on a contract pursuant to Art. 6 Para. 1(b) of the GDPR and
(2) the processing is carried out by automated means.
In exercising this right, you shall also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This shall not adversely affect the rights and freedoms of others.
The right to data portability shall not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
7. Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 Para. 1(e) or (f) of the GDPR.
The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
8. Right to withdraw consent in the data protection declaration
You have the right to withdraw your consent in the data protection declaration at any time. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.
9. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data concerning you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 of the GDPR.
Our data protection declaration and our responsibility and liability in this regard generally do not cover websites from third-party providers to which our website links or to which you are forwarded. As a consequence, we are not responsible for any data processing that is carried out in these cases by the operators of these websites.
We have no intention of passing on your personal data to third parties for advertising, marketing or other purposes without authorisation.
Do you have any questions?
We know that the issue of data protection is a very complex one. So you can send your questions to us at any time:
Contact details of the company with responsibility for data protection
Telephone + 49 89 315 778-13
Validity of the agreement (severability clause)
The illegality, inefficacy, invalidity or impracticability of parts of these data protection terms and conditions of use will not affect the remaining terms in their efficacy and validity.
Changes and data protection notices
As the current legal situation may change at any time, new laws may come into force, and internal company processes may necessitate changes to this data protection declaration, EVO GmbH reserves the right to make changes to this data protection declaration at any time. For this reason, it may be necessary to read this data protection declaration every time this website is accessed.