Privacy policy

1. Data Protection

The security and protection of your data is a key concern for Magpie Projects Holding GmbH (hereinafter “Magpie Projects”, “we” or “us”). We operate our website in accordance with the applicable data protection laws, in particular the General Data Protection Regulation (EU) 2016/679 (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications Digital Services Data Protection Act (TDDDG) and the German Digital Services Act (DDG).

This Privacy Policy explains which personal data we collect, process and use when you visit our website, for which purposes and on what legal basis, with whom we share it, how long we keep it and which rights you have.

2. Data Controller

This Privacy Policy applies to the website accessible at www.magpieprojects.com (the “Website”).

The controller within the meaning of Art. 4(7) GDPR is:

Magpie Projects Holding GmbH
Große Gallusstraße 9
60311 Frankfurt am Main
Germany
Email: contact@magpieprojects.com

3. Data Protection Officer

We have appointed a Data Protection Officer. You can reach our Data Protection Officer at:

Magpie Projects Holding GmbH
Attn. Data Protection Officer
Große Gallusstraße 9
60311 Frankfurt am Main
Germany
Email: contact@magpieprojects.com

Please mark your message clearly for the attention of our Data Protection Officer, for example in the subject line. This ensures that your request is forwarded to them without delay and treated confidentially.

4. General Information on Data Processing

We process personal data only where this is necessary to operate our Website, to respond to your requests and to perform our contractual and legal obligations. Beyond the data collected automatically when you visit the Website (see section 7), we process only data you actively provide, for example when you contact us by email or apply for a position.

Where we rely on your consent, you may withdraw it at any time with effect for the future. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Our own processing operations take place within the European Economic Area (EEA). Some of the third-party services described in this Policy, in particular the services provided by Google, Meta and LinkedIn, may involve transfers of personal data to countries outside the EEA, including the United States. Section 6 explains the safeguards that apply to such transfers.

5. Categories of Recipients and Processors

We share personal data only where necessary and only with the following categories of recipients:

  • IT and hosting service providers who operate the Website and our IT infrastructure on our behalf
  • Providers of the analytics, advertising and social media services described in sections 11 and 12
  • Professional advisers such as auditors, tax advisers and lawyers, bound by professional confidentiality
  • Public authorities and courts, where we are legally required to disclose data
  • Companies of the Magpie Projects group, where this is necessary to respond to your request

Where these recipients process personal data on our behalf, we have concluded data processing agreements in accordance with Art. 28 GDPR.

Our Website is hosted by an external hosting service provider established in the European Economic Area, acting as our processor. The servers used are located within the European Economic Area. The hosting provider processes personal data solely on our behalf and in accordance with our instructions. On request, we will tell you which provider this is.

6. International Data Transfers

Where personal data is transferred to recipients outside the EEA, we ensure an adequate level of protection by one of the following means:

  • an adequacy decision of the European Commission pursuant to Art. 45 GDPR, in particular the adequacy decision on the EU-U.S. Data Privacy Framework for recipients in the United States that are certified under that framework
  • standard contractual clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR, supplemented where necessary by additional technical and organisational measures

Please note that data transferred to countries outside the EEA may be subject to access by public authorities of those countries, and that the level of protection may not correspond in every respect to the level of protection within the EEA. Where a transfer is based on your consent, we inform you of these risks in accordance with Art. 49(1)(a) GDPR before you give your consent.

You can request a copy of the safeguards in place by contacting us at the address given in section 2.

7. Server Log Files

When you visit our Website, our hosting provider automatically collects and stores the following information transmitted by your browser:

  • IP address of the requesting device
  • Date and time of access
  • Access status and HTTP status code
  • Volume of data transferred
  • Referrer URL (the previously visited page)
  • Browser type and version
  • Operating system
  • Pages visited and duration of visit

This data is processed to ensure the stability, functionality and security of the Website, to detect and prevent attacks and abuse, and for statistical purposes. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable provision of the Website.

Log data is stored for a maximum of 30 days and is then deleted. Where log data is required as evidence in connection with a specific security incident or attack, it is retained until that incident has been fully investigated and resolved.

8. Cookies and Consent Management

We use cookies and comparable technologies on our Website. Cookies are small text files stored on your device by your browser.

Essential cookies are required for the basic operation of the Website, for example to store your cookie preferences. They are stored on the basis of Section 25(2) no. 2 TDDDG and processed on the basis of Art. 6(1)(f) GDPR. They cannot be disabled.

All non-essential cookies and technologies, in particular those used for analytics, advertising and the integration of third-party content, are only set and read after you have given your prior consent through our consent banner. The legal basis is Section 25(1) TDDDG for the storage of and access to information on your device, and Art. 6(1)(a) GDPR for the subsequent processing of personal data.

You can change or withdraw your consent at any time with effect for the future through the consent settings on our Website. Details of the individual services, their providers, purposes and storage periods are available in the consent banner.

You can also configure your browser to inform you when cookies are set, to allow cookies only in specific cases, to block cookies generally, or to delete cookies automatically when the browser is closed. Disabling cookies may limit the functionality of our Website.

9. Contacting Us

If you contact us by email, we process the data you provide, in particular your name, your email address, any further contact details and the content of your message, in order to respond to your request.

Where your request relates to the conclusion or performance of a contract, the legal basis is Art. 6(1)(b) GDPR. In all other cases, the legal basis is Art. 6(1)(f) GDPR, our legitimate interest being to respond to enquiries addressed to us.

We delete the data once your request has been dealt with conclusively and no statutory retention obligations apply. Where correspondence is subject to commercial or tax retention obligations, we retain it for six or ten years in accordance with Section 257 of the German Commercial Code and Section 147 of the German Fiscal Code.

10. Applicant Data

Applications are submitted to us by email. We collect and process the data necessary to assess your application, in particular:

  • Name and contact details
  • Academic and professional qualifications
  • Availability
  • Work experience
  • Salary expectations
  • Any further information you provide

The legal basis is Section 26(1) BDSG in conjunction with Art. 88 GDPR and Art. 6(1)(b) GDPR, in each case for the purpose of deciding on the establishment of an employment relationship. Where you provide information that goes beyond what is necessary for that decision, the legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

If your application is unsuccessful, we delete your data no later than six months after we have notified you of our decision. This period allows us to defend claims under the German General Equal Treatment Act. If you consent to us keeping your application on file for future openings, we retain your data for a further twelve months on the basis of Art. 6(1)(a) GDPR.

If we enter into an employment relationship with you, your application data is transferred to your personnel file.

11. Web Analytics

Google Analytics

Our Website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies to analyse how visitors use our Website.

IP anonymisation is enabled, which means your IP address is truncated by Google within the EU or the EEA before being transmitted to Google servers. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. Google uses this information on our behalf to evaluate your use of the Website, to compile reports on website activity and to provide us with further services relating to website and internet use.

Google Analytics is only activated if you have given your prior consent. The legal basis is Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Data may be transferred to the United States on the basis described in section 6.

You can withdraw your consent at any time through our consent settings. You can also prevent Google from collecting and processing this data by installing the browser add-on available at https://tools.google.com/dlpage/gaoptout

Further information on how Google processes data is available at https://policies.google.com/privacy

Google Ads Conversion Tracking and Remarketing

We use Google Ads, a service provided by Google Ireland Limited, for conversion tracking and remarketing. Cookies are used to measure the effectiveness of our advertising and to display our advertisements to users who have already visited our Website.

These technologies are only activated if you have given your prior consent. The legal basis is Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Data may be transferred to the United States on the basis described in section 6.

Further information is available at https://policies.google.com/technologies/partner-sites

12. Social Media and Embedded Content

Our Website integrates content and functions provided by the following third parties. This content is only loaded once you have given your prior consent through our consent banner. Until you do, no connection to the servers of these providers is established and no data is transmitted to them.

Once loaded, these providers receive your IP address and information about the page you are visiting, and may set cookies on your device. If you are logged in to the respective service, the provider may assign your visit to your user account. We have no influence on the scope or purpose of the data processing carried out by these providers on their own responsibility. The legal basis for the integration is Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Data may be transferred to countries outside the EEA on the basis described in section 6.

  • LinkedIn, provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Privacy policy: https://www.linkedin.com/legal/privacy-policy
  • Facebook, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Privacy policy: https://www.facebook.com/about/privacy/
  • XING, provided by New Work SE, Am Strandkai 1, 20457 Hamburg, Germany. Privacy policy: https://privacy.xing.com/en
  • YouTube, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Videos are embedded in extended data protection mode. Privacy policy: https://policies.google.com/privacy

You can withdraw your consent at any time through our consent settings, with effect for the future.

13. Retention

We store personal data only for as long as necessary for the purposes described in this Policy, or for as long as we are required to retain it by law. The specific periods are stated in the relevant sections above. Where processing is based on our legitimate interest, we delete the data when you object and no overriding legitimate grounds for the processing remain, or when the purpose ceases to apply.

14. No Automated Decision-Making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.

15. Provision of Data

The provision of personal data is neither required by law nor by contract, and you are under no obligation to provide it. However, without the information necessary to identify you and to understand your request, we are unable to respond to your enquiry or to process your application.

16. Your Rights

Under the GDPR you have the following rights in relation to your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Right to object (Art. 21 GDPR): where we process your personal data on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to that processing. Where your personal data is processed for direct marketing purposes, you have the right to object at any time to such processing, without giving reasons. Following your objection, we will no longer process your data for those purposes.

To exercise your rights, please contact us at the address given in section 2. If you wish to address your request to our Data Protection Officer, please mark it accordingly as described in section 3.

The supervisory authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit

Postfach 3163, 65021 Wiesbaden, Germany

https://datenschutz.hessen.de

You may also lodge a complaint with the supervisory authority of your habitual residence or place of work.

17. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy to reflect changes in legal requirements or in our processing activities. The current version is always available on our Website.