We are delighted that you have taken an interest in our organisation. Data protection is a top priority for the management of the Industrieverband Büro und Arbeitswelt e. V., hereinafter referred to as IBA. In principle, it is possible to use the IBA’s websites without providing any personal data. However, if you wish to make use of specific services offered by our company via our website, the processing of personal data may be necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we will generally seek your consent.

The processing of personal data, such as your name, address, email address or telephone number, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection regulations applicable to the IBA. Through this privacy policy, our company informs the public, in accordance with Articles 13 and 14 of the GDPR, about the nature, scope and purpose of the personal data we collect, use and process, as well as the rights to which you are entitled.

As the data controller, the IBA has implemented numerous technical and organisational measures to ensure the most comprehensive possible protection of the personal data processed via this website. Nevertheless, internet-based data transmissions may, in principle, contain security vulnerabilities, meaning that absolute protection cannot be guaranteed. For this reason, you are free to provide us with personal data via alternative means, such as by telephone.

The data controller within the meaning of Article 13(1)(a) of the GDPR, other data protection laws applicable in the Member States of the European Union, and other provisions relating to data protection is:

Industrieverband Büro und Arbeitswelt e. V. (IBA)

Parkstraße 44 B

65191 Wiesbaden

Germany

Tel.: +49 611 9457637–0

Email: info(at)iba.online

Website: iba.online

Our website uses cookies. Cookies are small text files that are stored on your device via a web browser. The use of technically necessary cookies is based on Article 6(1)(f) of the GDPR in conjunction with Section 25(2) of the TTDSG; the use of any additional cookies is based solely on your consent in accordance with Article 6(1)(a) of the GDPR.

Cookies serve to make the use of our website more convenient, secure and effective, for example by saving settings or temporarily storing user input. Cookies enable us to recognise a return visit to the website by reading a previously set cookie. This does not result in the direct identification of your person.

You can prevent the storage of cookies at any time via your browser settings or delete cookies that have already been set. Please note that if cookies are disabled, you may not be able to use all the features of our website to their full extent.

The IBA website collects a range of general data and information every time the website is accessed – regardless of whether this is done by a user or an automated system. This general data and information is stored in the server’s log files. The following may be recorded: the

1. types and versions of browsers used
2. the operating system used by the accessing system
3. the website from which an accessing system reaches our website (so-called referrer)
4. the sub-pages of our website accessed via an accessing system
5. the date and time of access to the website
6. an Internet Protocol address (IP address)
7. the Internet service provider of the accessing system
8. other similar data and information that serves to avert threats in the event of attacks on our information technology systems. Insofar as personal data is processed in this context, this is done on the basis of Article 6(1)(f) of the GDPR.

When using this general data and information, the IBA does not draw any conclusions about your identity. Rather, this information is required on the basis of a legitimate interest pursuant to Article 6(1)(f) of the GDPR in order to

1. deliver the content of our website correctly
2. optimise the content of our website and the advertising on it
3. to ensure the long-term functionality of our information technology systems and the technology of our website, and
4. to provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyberattack.

This data and information, which is generally collected anonymously, is therefore evaluated by the IBA both statistically and with the aim of enhancing data protection and data security within our organisation, ultimately to ensure an optimal level of protection for the personal data we process. The anonymous data from the server log files is stored separately from any personal data you provide, in order to comply with the principles of data minimisation and storage limitation in accordance with Article 5(1)(c) and (e) of the GDPR.

Log file data is generally stored only for a limited period and is subsequently deleted, unless further retention is required for security reasons.

You can register on our website by providing personal data. The personal data transmitted to us in the process is determined by the relevant registration form used for registration. We collect and store the personal data you enter on the basis of Article 6(1)(b) of the GDPR exclusively for internal use and for our own purposes. The data may be disclosed to one or more processors within the meaning of Article 28 of the GDPR, provided that they use the data exclusively on our behalf or for internal purposes.

When you register on our website, the IP address assigned by your Internet Service Provider (ISP), as well as the date and time of registration, are also stored on the basis of Article 6(1)(f) of the GDPR. This data is stored to prevent misuse of our services and, where necessary, to enable the investigation of criminal offences. In this respect, the storage of this data is necessary for our protection in accordance with the legitimate interest under Article 6(1)(f) of the GDPR. This data is not passed on to third parties as a matter of principle, unless there is a legal obligation to do so or the disclosure serves the purposes of criminal prosecution.

Registration serves to offer you content or services which, by their nature, can only be made available to registered users. You have the option at any time to amend the personal data provided during registration or to have it deleted entirely.

Under Article 15 of the GDPR, you may at any time request information regarding which personal data we hold about you. Furthermore, your personal data will be rectified or deleted upon request or notification in accordance with Articles 16 and 17 of the GDPR, provided there are no legal obligations to retain such data. Our staff are available to assist you with this at any time.

In accordance with legal requirements, the IBA website contains information that enables you to contact our company quickly by electronic means and to communicate directly with us, including a general electronic mail address (email address). If you contact us by email or via a contact form, the personal data you provide will be automatically stored on the basis of Article 6(1)(b) GDPR or Article 6(1)(f) GDPR. Such personal data initially transmitted to us by you is stored for the purposes of processing or contacting you. This personal data will not be disclosed to third parties unless there is a legal obligation to do so.

We process and store your personal data in accordance with Article 5(1)(e) of the GDPR only for the period necessary to fulfil the purpose of storage or where required by law.

If the purpose of storage no longer applies or a statutory retention period expires, the personal data will be blocked or deleted routinely and in accordance with the statutory provisions, in accordance with Articles 17 and 18 of the GDPR.

Under the GDPR, you have the following rights regarding your personal data:

a. Right to confirmation

In accordance with Article 15 of the GDPR, you have the right to request confirmation from us as to whether personal data concerning you is being processed.

b. Right of access

In accordance with Article 15(1) of the GDPR, you have the right to receive, free of charge, information regarding the personal data stored about you, as well as a copy of this data in accordance with Article 15(3) and (4) of the GDPR. This information includes, in particular:

• the purposes of processing
• the categories of data processed
• the recipients or categories of recipients
• the envisaged storage period, or otherwise the criteria for determining this period
• your other rights (e.g. rectification, erasure, restriction, objection)
• the existence of a right to lodge a complaint with a supervisory authority
• where the personal data has not been collected from you: information regarding its origin
• the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR. Where data has been transferred to a third country or to an international organisation, you may, pursuant to Article 15(2) of the GDPR, request information regarding the safeguards provided for this purpose. We will respond to your requests without undue delay, and in any event within one month, in accordance with Article 12(3) of the GDPR. The exercise of your rights is generally free of charge. Manifestly unfounded or excessive requests may be refused or subject to a reasonable fee in accordance with Article 12(5) of the GDPR.

c. Right to rectification

You may request the immediate rectification of inaccurate data or the completion of incomplete data in accordance with Article 16 of the GDPR.

d. Right to erasure (right to be forgotten)

You may request the erasure of your data in accordance with Article 17 of the GDPR, in particular if:

• the data is no longer necessary,
• you have withdrawn your previously given consent,
• you have objected,
• the data has been processed unlawfully, or
• there is a legal obligation to erase the data.

If personal data has been made public and we are obliged to erase it in accordance with Article 17(1) of the GDPR, we shall take appropriate measures within the framework of Article 17(2) of the GDPR to inform other controllers processing this data of your request for erasure. The right to erasure does not apply where processing is necessary pursuant to Article 17(3) of the GDPR, in particular due to legal obligations, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

e. Right to restriction of processing

You may request the restriction of the processing of your data in accordance with Article 18(1) of the GDPR if:

• you have contested the accuracy of the data,
• the processing is unlawful,
• we no longer require the personal data, or
• you have objected to the processing in accordance with Article 21(1) of the GDPR.

In the event of a restriction on processing, your personal data – apart from its storage – may, in accordance with Article 18(2) of the GDPR, only be processed with your consent or for the establishment, exercise or defence of legal claims or for reasons of substantial public interest.

f. Right to data portability

In accordance with Article 20(1) and (2) of the GDPR, you have the right to receive your data in a structured, commonly used and machine-readable format or – where technically feasible – to have it transmitted to another controller, provided that the processing is based on your consent or on a contract.

This right applies only insofar as it does not conflict with the rights and freedoms of others or with overriding public interests pursuant to Article 20(3) of the GDPR.

g. Right to object

Pursuant to Article 21 of the GDPR, you may object at any time, on grounds relating to your particular situation, to the processing of your data carried out on the basis of Article 6(1)(e) or (f) of the GDPR.

If we process your data (including profiling) for the purposes of direct marketing, you may object to such processing at any time.

Where we process data for scientific or statistical purposes in accordance with Article 89(1) of the GDPR, you may object to this on grounds relating to your particular situation.

h. Automated decisions in individual cases

In accordance with Article 22(1) of the GDPR, you have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you. Such a decision shall, pursuant to Article 22(2) of the GDPR, only be made where it is necessary for the conclusion or performance of a contract, is based on a legal basis, or is made with your explicit consent.

In such cases, in accordance with Article 22(3) of the GDPR, we shall take appropriate measures to protect your rights, freedoms and legitimate interests, in particular the right to human intervention, to express your point of view and to contest the decision.

No decision-making based solely on automated processing of special categories of personal data within the meaning of Article 9(1) of the GDPR takes place, unless it is exceptionally permitted under Article 22(4) of the GDPR.

i. Right to withdraw consent under data protection law

Any data subject affected by the processing of personal data has the right, granted by the European legislator, to withdraw consent to the processing of personal data at any time.

You may contact us at any time to exercise your rights. If you exercise your rights to rectification, erasure or restriction, we will inform the recipients of your personal data of this, insofar as this is required under Article 19 of the GDPR.

Where, in the preceding sections, the processing of personal data is based on your consent pursuant to Article 6(1)(a) of the GDPR, this does not constitute the sole legal basis for all processing operations. Depending on the individual case, processing may also be based on Article 6(1)(b) to (f) of the GDPR.

If the processing of personal data is necessary for the performance of a contract to which you are a party, the processing is based on Article 6(1)(b) of the GDPR. The same applies to processing operations necessary for the implementation of pre-contractual measures.

If our company is subject to a legal obligation requiring the processing of personal data, such as to fulfil tax obligations, the processing is based on Article 6(1)(c) of the GDPR.

In rare cases, the processing of personal data may be necessary to protect your vital interests or those of another natural person. In such cases, the processing is based on Article 6(1)(d) of the GDPR. Finally, processing operations may be based on Article 6(1)(f) of the GDPR if the processing is necessary to safeguard a legitimate interest of our company or a third party, and there are no overriding interests, fundamental rights or freedoms on your part that prevent this. A legitimate interest may exist in particular if you are our customer, Recital 47 of the GDPR.

Where the processing of personal data is based on Article 6(1)(f) of the GDPR, our legitimate interest lies in the proper conduct of our business activities, ensuring IT security and optimising our online services.

The length of time for which personal data is stored depends on the specific purpose of processing and the applicable statutory retention periods. Personal data is deleted as soon as it is no longer required to fulfil the purpose of the contract. Data may be stored for a longer period only if and for as long as statutory retention periods apply or the data is still required to fulfil or initiate the contract.

We would like to inform you that the provision of personal data is in some cases required by law (e.g. tax regulations) or may also arise from contractual provisions (e.g. details of the contracting party). In certain cases, it may be necessary for the conclusion of a contract that you provide us with personal data, which we will subsequently process. If you do not provide us with the personal data required to conclude the contract, a contract cannot be concluded. In individual cases, we will inform you separately as to whether the provision of personal data is required by law or contract, or is necessary for the conclusion of the contract, and what consequences failure to provide such data may have, Art. 13(2)(e) GDPR.

No automated decision-making or profiling within the meaning of Article 22 of the GDPR takes place.