Privacy Policy

Below you will find the information to be provided in accordance with Articles 13 and 14 of the General Data Protection Regulation ("GDPR") on the processing of your personal data when you (hereinafter "you" or "your") visit our website www.kostal-karriere.com, www.jobs.kostal.com (hereinafter "website") by Leopold Kostal GmbH & Co. KG (hereinafter "we" or "us") and companies jointly responsible with us.

A. Controller and data protection officer under data protection law

Leopold Kostal GmbH & Co. KG, An der Bellmerei 10, 58513 Lüdenscheid, Germany, 
info(at)kostal.com, telephone +49 (0) 2351 16-0.

Data Protection Officer of the KOSTAL Group, An der Bellmerei 10, 58513 Lüdenscheid, 
datenschutz(at)kostal.com.

B. Information on the processing of personal data

Below you will find information about the processing of your personal data for the purposes listed in more detail and, among other things, about the legal basis for the processing. If the legal basis for processing is the balancing of interests, you can request further information on the balancing of interests from us using the contact details provided in Section A.

The same applies if we are joint controllers with another person. You can also request information about the agreement on joint controllership there.

I. Use of the website

1. informational use of the website

When you visit our website, we process the IP address of your end device for technical reasons, i.e. to be able to display the website at all.

In addition, to protect our IT infrastructure, we process the IP address of your device, the type and version of the Internet browser you are using, information about the operating system of your device, information about the pages accessed, the previously visited page (referrer URL) and the date and time of access and store this information in log files. Without the provision of this information by you, we cannot provide the website content accessed.

If you call up job advertisements on the website, we also process your details in the search mask on our website.

The legal basis for this processing is the balancing of interests (Art. 6 para. 1 sentence 1 lit. f GDPR). Our legitimate interest is the provision of the website content accessed by the user and the protection of the IT infrastructure used for the provision of the website, in particular for the detection, elimination and evidence-protecting documentation of malfunctions (e.g. DDoS attacks).

When using the job advertisements, the recipient is also Haufe-Lexware GmbH & Co KG as the operator of the "Umantis" platform for job advertisements, a company based in Switzerland, which operates parts of the website as our processor. Your personal data is transferred to this company - and therefore to a company outside the European Economic Area - so that these job advertisements can be accessed. However, the European Commission decided in Decision 2000/518/EC of July 26, 2000 that Switzerland guarantees an adequate level of protection for personal data transferred from the Union for all activities previously covered by Directive 95/46/EC and thus now covered by the GDPR. We use a so-called frame for the transmission of data. This means that "UMANTIS" is embedded in the website and you as a user do not notice the transition. As soon as you open a job advertisement, you will be redirected to a website within UMANTIS. This website then begins with the URL "jobs.kostal.com/Vacancies/XXX application/New" ". The same applies if you click on "Set up job subscription", "Login" or "Unsolicited application".

When using the job advertisements via "e-recruiting", the recipient of the personal data is SmartRecruiter as the operator of the "SmartRecruiter" platform, which processes the data as our processor. We use a so-called frame for the transmission of the data. This means that "smartrecruiters" is embedded in the website and you as the user do not notice the transition. As soon as you open a job advertisement, you will be redirected to a website within Smartrecruiters. This website then begins with the URL " jobs.smartrecruiters.com". The same applies if you click on "Set up job subscription", "Login" or "Unsolicited application".

Only the persons involved in the application process (e.g. supervisors and employees of the recruiting department, HR employees and employee representatives) have access to your personal data.

We generally store this personal data in the log files for three (3) months. If you also view job advertisements, we store the log files for six (6) months. In the event of a security-relevant event (e.g. an attack), we store the log files beyond this until the security-relevant event has been eliminated and fully clarified

2. Usercentrics

We use the Usercentrics Consent Manager to manage your consents, possible revocations of consents and objections to the use of cookies.

The data processing in this context is carried out to manage user decisions regarding cookies (consent, revocation, opt-out) and to ensure the security of the application.

The IP address of your end device, the type and version of the Internet browser you are using, information about the operating system of your end device, information about the pages accessed, the previously visited page (referrer URL) and the date and time of access are processed. In addition, the user's decision on individual cookies or groups of cookies is stored at the time of the decision and the last visit.

The legal basis for processing is the balancing of interests (Article 6(1)(f) GDPR). Our legitimate interest here lies in the simple and reliable control of cookies.

The recipient of the data is Usercentrics GmbH, which acts for us as our processor.

We store the data for a period of 6 months. The revocation of previously granted consent is stored for three years (accountability). Server log data is anonymized before storage.

We would like to point out that it is not possible to use the website without transmitting personal data, such as the IP address. There is no automated decision-making process for consenting to the use of cookies.

3. Google Tag Manager

We use the Google Tag Manager service, which is provided for users from the European Economic Area and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and for all other users by Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (together "Google").

Google Tag Manager is used exclusively to manage website tools by integrating so-called website tags. A tag is an element that is stored in the source code of our website in order to execute a tool, for example through scripts. If these are optional tools, they will only be integrated by Google Tag Manager with your consent. The Google Tag Manager does not require the use of cookies.

The legal basis is Art. 6 para. 1 lit. f GDPR, based on our legitimate interest in integrating and managing several tags on our website in an uncomplicated manner.

Google collects information about which tags are integrated through our website for the purpose of ensuring stability and functionality when using Google Tag Manager, but in principle no personal data, in particular no data about usage behavior, the IP address or the pages visited.

We have concluded an order processing contract with Google. In the event that personal data is transferred to the USA, we have concluded standard contractual clauses with Google.

You can find more information on this in Google's information on the Tag Manager: https://support.google.com/tagmanager/answer/9323295?hl=de

4.gstatic

Gstatic is a domain owned by Google. We use this service to offload static content to another domain name in order to reduce bandwidth usage and increase network performance for the end user. The service is provided by users of Alphabet Inc 1600 Amphitheatre Park-way Mountain View, CA 94043, USA a company affiliated with Google. 

The service is used exclusively to increase bandwidth for faster landing The service does not use cookies. 

The legal basis is Art. 6 para. 1 lit. f GDPR, based on our legitimate interest in increasing the speed of the site. 

We have concluded an order processing contract with Google. In the event that personal data is transferred to the USA, we have concluded standard contractual clauses with Google.

5. Google Translate

We use the Google Translate service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (together "Google").

Google Translate is used exclusively to translate the website. For this purpose, the IP address is used to determine the country and thus the language of the website. 

We only process the data with your prior consent (Art. 6 para. 1 lit. a GDPR)

We have concluded an order processing contract with Google. In the event that personal data is transferred to the USA, we have concluded standard contractual clauses with Google.

II. Job abonnement

If you set up a job subscription on our website in order to be informed about new job advertisements, we process your surname and first name, your e-mail address and the job search category for this purpose, i.e. information about the area for which you are looking for a job. The provision of this data is necessary to set up a job subscription; without this data we cannot send you any job advertisements.

The legal basis for the processing of your personal data as part of the job subscription is the performance of the contract (Art. 6 para. 1 sentence 1 lit. b GDPR). You can cancel the job subscription at any time. You will also be informed of this in every message.

The recipient of this personal data is Haufe-Lexware GmbH & Co. KG as the operator of the "Umantis" platform for job advertisements, which processes the data on our behalf and in accordance with our instructions (see section B.I).

We store the data for the provision of the job subscription until you cancel the job subscription.

III. Applicant selection

1. job advertisements/ collection of data.

If you apply for job advertisements from us or from another KOSTAL Group company on our website or on your own initiative, i.e. without reference to a specific position, we process (i) the assignment to a specific job advertisement (i.e. a link between your entries and such an advertisement) in order to recruit new employees and carry out an application procedure; (ii) your personal master data (first name, surname, address, contact details, date of birth, place of birth); (iii) the photo you provide; (iv) your information about your previous CV, including educational background and professional experience, as well as references from previous employers and/or training institutions; (v) your letter of application; (vi) information about how you became aware of us and (vii) login data. The processing of login data is necessary for the purposes of submitting your application. With the exception of information about how you became aware of us and about any severe disabilities or other special categories of personal data that fall under Art. 9 para. 1 GDPR and whose disclosure is voluntary, you must provide the other personal data if you wish to enter into an employment relationship with us.

If you submit your documents as a paper application, the data will be transferred manually to our applicant management system. You will receive an e-mail confirming that your data has been entered manually and a link with which you can access your data. In this e-mail, we will inform you whether we will return the application documents to you or destroy them.

The legal basis for this processing is the decision on the establishment of an employment relationship (Art. 88 para. 1 GDPR in conjunction with Section 26 para. 1 sentence 1 BDSG). Insofar as special categories of personal data are processed in accordance with Article 9 (1) GDPR in conjunction with the relevant national regulation (e.g. data on health, religion or trade union membership), this is done on the basis of Article 9 (2) (b) GDPR in conjunction with the relevant national regulation.

The processing of special categories of personal data (health data) may be necessary for the assessment of the ability to work in accordance with Art. 9 para. 2 lit. h) GDPR in conjunction with the relevant national regulation.

In any case, we will retain the personal data for six (6) months after completion of the application process. In the event of legal proceedings within this period, we will retain these documents for a longer period, namely until the conclusion of the legal proceedings. The HR department may delete the applicant data at the individual instruction of the applicant or in accordance with personnel regulations. After a successful application, the data will be transferred to our HR administration system and deleted from the platform. In this case, your data may be transferred to another KOSTAL legal entity and processed there as employee data. An exchange of your personal data with other legal entities within the KOSTAL Group takes place in particular for the fulfillment of contracts, as well as due to our legitimate interest in organizing internal work processes (e.g. shared services, implementation of cross-legal entity transfers).

As part of the application process, we may ask you whether we may forward your application documents to other positions that match your profile or save them for a later vacancy.

2. recipients of the data

Within the respective legal entity of the KOSTAL Group to which you have applied, only the responsible persons and departments (e.g. supervisors and employees of the specialist department involved in the application process, specialist supervisor, HR department, employee representatives) will have access to your personal data for the above-mentioned processing purposes.

If you apply for a position at another legal entity of the KOSTAL Group (Appendix 1), we will also forward your personal data to these legal entities. These legal entities within the KOSTAL Group are in principle their own data controllers. The above-mentioned persons involved in the recruitment process may belong to different companies within the KOSTAL Group, depending on the position. Therefore, your data may be transferred to the respective persons within the KOSTAL Group worldwide.

The recipient of this personal data outside the KOSTAL Group is Haufe-Lexware GmbH & Co. KG as the operator of the "Umantis" platform and Smartrecruiters as the operator of the Smartrecruiters platform, which processes the data on our behalf and in accordance with our instructions (see Section B.I).

Data will only be transferred to third parties (both within and outside the KOSTAL Group) outside the European Economic Area if the third country has been confirmed by the EU Commission to have an adequate level of data protection (adequacy decision) or if other appropriate data protection guarantees (e.g. standard contractual clauses, binding corporate rules) are in place or if legal requirements permit a transfer.

If a transfer to recipients outside the European Economic Area is necessary for the assertion / exercise of or defense against legal claims, this is done in accordance with Art. 49 para. 1 lit e) GDPR.

3. recruitment test

We conduct online recruitment tests to determine the suitability of applicants for a training position as objectively as possible. If we would like to get to know applicants better on the basis of their application documents, we will send them an invitation to take part in an online test based on their application documents. For this purpose, they will receive a personal Tan with which they can register for the test with our processor u-form Testsysteme GmbH & Co. KG for the test. Participation is voluntary. The tests are carried out in accordance with existing standards and comply with DIN 33430. We collect the following personal data from applicants during the online tests:

Personal master data (e.g. first and last name, address, date of birth)

Communication data (e.g. e-mail, telephone)

Data on personal structure and cognitive abilities, based on the answers given in the online test.

The legal basis for the processing is consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Consent is requested when registering for the online test procedure.

The recipient of this personal data is u-form Testsysteme GmbH & Co. KG, which processes the data on our behalf and in accordance with our instructions.

We will retain the personal data for six (6) months after completion of the application process. In the event of legal proceedings within this period, we will retain these documents for a longer period, namely until the conclusion of the legal proceedings. The HR department may delete the applicant data at the individual instruction of the applicant or in accordance with personnel regulations. After a successful application, the data will be transferred to another system and deleted from the platform.

IV. Measurement of the web audience

We use applications on the website to log and analyze your user behavior on the website. The logging and analysis only takes place if you have given us your prior consent. We use these two solutions for the purpose of logging and analyzing cookies. Detailed information on these cookies can be found in section D).

The personal data collected with the help of these cookies includes your IP address as well as information about the subpages you have visited, the length of your visit and the website from which you came to our website, as well as the page you access after visiting our website. There is no obligation to provide the data. If the data is not provided, we will not be able to analyze the use of our website.

The purpose of processing this data is to optimize the website by evaluating your usage behavior on our website. For example, we can use the frequency with which subpages are accessed to identify which content is of particular interest to visitors to our site and which content should be placed differently, for example, in order to attract the attention of visitors.

The legal basis for this processing - including the setting and reading of cookies - is the consent you have given (Art. 6 para. 1 sentence 1 lit. a GDPR). Access to and storage of information in the end device then takes place on the basis of the implementation laws of the ePrivacy Directive of the EU member states, in Germany according to § 25 para. 1 TTDSG. You can withdraw your consent by deleting the cookies. This is described in section D.

1. Google Analytics 4

If you have given your consent, the website uses the web analysis service Google Analytics 4, which is offered for persons from Europe, the Middle East and Africa (EMEA) by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and for all other persons by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). We use Google Analytics 4 via the Google Tag Manager. If you have not consented to the use of the analysis tools, your data will not be collected by Google Analytics 4.

Google Analytics 4 uses JavaScript and pixels to read information on your end device, as well as cookies to store information on your end device. This is used to analyze your usage behavior and improve our website. The access data is summarized by Google on our behalf into pseudonymous user profiles and transferred to a Google server in the USA. We will process the information obtained in order to evaluate your use of the website and to compile reports on website activity.

As part of the evaluation, Google Analytics 4 also uses artificial intelligence such as machine learning to automatically analyze and enrich the data. For example, Google Analytics 4 models conversions if there is not enough data available to optimize the analysis and reports. Information on this can be found in the corresponding Google documentation. Data analysis is automated with the help of artificial intelligence or based on specific, individually defined criteria. You can find more information on this in the associated Google documentation.

The data collected as part of the usage analysis of Google Analytics 4 is enriched with data from the Google Search Console and linked to the data from Google Ads, in particular to measure the success of our advertising campaigns (so-called conversions).

Processed data: The following data may be processed by Google Analytics 4:

- IP address;

- User ID and device ID;

- Referrer URL (previously visited page);

- pages accessed (date, time, URL, title, duration of visit);

- downloaded files;

- clicked links to other websites;

- Achievement of certain goals (conversions);

- technical information (operating system; browser type, version and language; device type, brand, model and resolution)

- approximate location (country, region and, if applicable, city, based on anonymized IP address).

Data protection settings: We have made the following data protection settings for Google Analytics 4:

- Anonymization of the IP address;

- deactivated advertising function;

- deactivated personalized advertising;

- deactivated remarketing;

- Retention period of 2 months (and no resetting of the retention period for new activity)

- deactivated cross-device and cross-page tracking (Google Signals);

- deactivated data sharing (in particular Google products and services, benchmarking, technical support, account specialist).

We have concluded a data processing agreement with Google Ireland Limited for the use of Google Analytics 4. In the event that personal data is transferred from Google Ireland Limited to the USA, Google Ireland Limited and Google LLC have concluded standard contractual clauses (Implementing Decision (EU) 2021/914, Module 3) in accordance with Art. 46 para. 2 lit. c GDPR. In addition, we also obtain your express consent for the transfer of your data to third countries in accordance with Art. 49 para. 1 lit. a GDPR.

Further information on Google Analytics 4 can be found in Google's privacy policy and in the Google Analytics privacy policy. Further information on the cookies used by Google Analytics 4 can also be found in Google's documentation.

We store the usage profiles for twenty-six (26) months.

2. Microsoft Advertising

Microsoft Advertising is a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft").

Microsoft uses cookies and similar technologies to create campaign reports, track conversions, click events and targeted advertising outside our websites (retargeting) based on e.g. URL, referrer URL, membership of remarketing lists defined by us in order to present you with advertisements that are relevant to you. The use of these technologies enables Microsoft and its partner websites to display ads based on previous visits to our or other websites on the Internet. The data collected in this context may be transferred by Microsoft to a server in the USA for analysis and stored there.

The data described in this section B.IV. 1 may be transmitted to Microsoft in the USA. The USA is a third country outside the European Union, which is why we have concluded standard contractual clauses with Google for this case. The USA is not considered a safe third country under EU data protection law. We would like to point out that US companies are obliged to hand over personal data to security authorities without you as the data subject being able to take legal action against this.

We have no influence on this processing activity and it cannot be ruled out that US authorities (e.g. secret services) may process, evaluate and permanently store your data on US servers for surveillance purposes.

You can find more information on this in Microsoft's privacy policy

help.bingads.microsoft.com and privacy.microsoft.com/en/privacystatement.

In addition to withdrawing your consent, you also have the option of deactivating personalized ads in Microsoft Advertising or in the ad settings in your Microsoft account:

about.ads.microsoft.com/de-de/ressourcen/richtlinien/personalisierte-anzeigen and choice.microsoft.com/de-de/opt-out.

We store the data for 13 months.

3. third-party plug-ins

So-called third-party plug-ins are integrated on our website. These allow you to use certain services from external providers directly on our website. These third-party plug-ins are provided under the provider's own responsibility.

Providers of plug-ins can (similar to accessing an external website via a link) in particular receive your IP address and the address (URL) of the website from which you access the plug-in. If you are registered as a user with the third-party provider, the provider of the plug-in can usually also assign the data received to your user account.

I. Bing Maps

We have integrated the map service Bing Maps. The third-party provider of this plug-in is Microsoft Corporation Information about Google can be found here, Microsoft's privacy policy can be found here. There you will find information about the processing of personal data by Microsoft. The information on the transfer of personal data to the USA in section B.IV therefore applies accordingly.

II. YouTube

We have integrated the YouTube video player. The third-party provider of this plug-in is YouTube LLC. This is a company under US law. Information about YouTube can be found here, the privacy policy of YouTube LLC can be found here. There you will find information about the processing of personal data by YouTube LLC.

YouTube is a subsidiary of Google. The information on the transfer of personal data to the USA in section B.IV therefore applies accordingly.

III. Haufe Umantis

The Umantis job platform from Haufe Lexware AG is integrated. The third-party provider is Haufe-Lexware AG, based in St. Gallen, Switzerland. Further information on the data protection principles of the Haufe Group can be found here. The transfer of personal data to Switzerland was carried out in accordance with the adequacy decision 2000/518/EC of July 26, 2000.

VI. SmartRecruiters

The job platform SmartRecruiters of SmartRecruiters GmbH, Wilhelmstraße 118, 10963 Berlin, Germany is integrated. Further information on the data protection principles of SmartRecruiters GmbH can be found here. 

VII  Facebook social media plugins

We maintain an online presence on social networks. We use social networks to inform our customers and interested parties about our products and services and also to communicate with users on these platforms. As a rule, user data is used by the social networks for market research and advertising purposes. 

We would like to point out that user data may also be transferred outside the EEA. We have no influence on this processing activity. The storage of this data is normally realized by cookies. 

Based on these usage profiles, advertisements are then placed within the social networks and on third-party websites, for example. As part of the operation of our online presence, we may have access to information such as statistics on the use of our online presence provided by the social networks. These statistics are aggregated and may include, in particular, demographic information and data on interaction with our online presence and the posts and content distributed via it. Please refer to the list below for details and links to the social network data that we can access as the operator of the online presences. 

The processing of users' personal data is based on our legitimate interests in effective user information and communication with users in accordance with Art. 6 para. 1 sentence 1 lit. f. GDPR. GDPR. If users are asked by the respective providers for consent to data processing (i.e. they give their consent, e.g. by ticking a checkbox or confirming a button), the legal basis for processing is Art. 6 para. 1 sentence 1 lit. a. GDPR.

Further information on the processing of your personal data and your options to object can be found under the links of the respective provider listed below. Data subjects can also assert their rights to information and other rights against the providers, as only they have direct access to the users' data and have the corresponding information. We are of course available to answer any questions you may have and will support you if you need help.

 - Instagram (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland): Privacy policy: help.instagram.com/519522125107875; 

- Google/YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): Privacy Policy: policies.google.com/privacy; Opt-Out: https://www.google.com/settings/ads; 

- LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland): Operation of the LinkedIn company page under joint responsibility on the basis of an agreement on the joint processing of personal data (so-called Page Insights Joint Controller Addendum): legal.linkedin.com/pages-joint-controller-addendum; Information on the processed Page Insights data and the contact option in the event of data protection inquiries: legal.linkedin.com/pages-joint-controller-addendum; Privacy Policy: www.linkedin.com/legal/privacy-policy; Opt-Out: www.linkedin.com/psettings/guest-controls/retargeting-opt-out; 

- Facebook (Agreement on joint responsibility for the processing of personal data (https://de-de.facebook.com/legal/technology_terms) Opt-Out (https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen)

D.  Use of cookies

When you use our website, we store cookies in the browser of your end device, unless you prohibit this by making the appropriate settings in your browser.

I. General information about cookies

Cookies are small text files containing information that can be stored on the user's device via the browser when visiting a website. The cookie and the information stored in it can be read when the website is called up again with the same end device.

In principle, and also in the description of the individual cookies used by us in Section D.III, a distinction is made between (i) first-party and third-party cookies, (ii) transient and persistent cookies and (iii) cookies that do not require consent and cookies that require consent.

First-party cookies are cookies that are set by us or by a processor commissioned by us. Third-party cookies, on the other hand, are cookies that are set and accessed by another controller.

Transient cookies are deleted when you close your browser. Persistent cookies, on the other hand, are cookies that are stored on your end device for a certain period of time.

Cookies that do not require consent are those whose sole purpose is to transmit a message via an electronic communications network. Cookies that are strictly necessary for the provider of an information society service explicitly requested by the subscriber or user to provide this service (also referred to as "strictly necessary cookies") are also consent-free. All other cookies require consent.

II. Management of cookies

If the user's consent is required for the use of certain cookies, we will only use these cookies when you use the website if you have given your prior consent. For information on whether consent is required for the use of a cookie, please refer to Section D.III.

When you visit our website, we display a so-called "cookie banner" in which you can give your consent to the use of cookies on this website by clicking a button. By clicking on the button provided for this purpose, you have the option of consenting to the use of all cookies requiring consent described in detail in Section D.III of this cookie information.

We also store your consent and, if applicable, your individual selection of cookies requiring consent in the form of another cookie ("opt-in cookie") on your end device in order to determine whether you have already given your consent when you visit the website again. The opt-in cookie has a limited validity period of one (1) month.

Strictly necessary cookies cannot be deactivated via the cookie management function of this website. However, you can generally deactivate these cookies in your browser at any time.

You can also manage the use of cookies in your browser settings. Different browsers offer different ways to configure the cookie settings in the browser. You can find more detailed information on this at www.allaboutcookies.org/ge/cookies-verwalten/, for example.

If you deactivate the storage of cookies in your browser, some functions of the website may not work or may no longer work properly.

III. Cookies used on this website

Below you will find information on the cookies we use.

1. General cookies

a) Name: cookie_notice_accepted

Purpose and content: absolutely necessary opt-in cookie (see section D.II) to store your consent and, if applicable, your individual selection for the use of cookies on your end device in order to determine whether you have already given your consent when you visit the website again.

Responsibility: First party

Validity: persistent (six (6) months)

Requirement for consent: no

Permission under data protection law: balancing of interests (Art. 6 para. 1 sentence 1 lit. f GDPR). Our legitimate interest is the management of the cookie consents granted by the user for this website.

b)  Name: googtrans

Purpose and content: Used to save the language settings

Responsibility: First party

Validity: Session

Need for consent: yes

2. google analytics cookies

a) Name: _ga

Purpose and content: for use with Google Analytics (see section B.IV.1), serves to distinguish users by means of an assigned ID.

Responsibility: first party

Validity: persistent (two (2) years)

Requirement for consent: yes

Permission under data protection law: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR).

b) Designation: _ga_Container Id

Purpose and content: for use with Google Analytics (see section B.IV.1), serves to distinguish users by means of an assigned ID.

Responsibility: First party

Validity: persistent (two years)

Requirement for consent: yes

Permission under data protection law: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR).

3) Microsoft Advertising Remarketing

a) Designation: _uetsid

Purpose and content: This cookie is used for tracking for targeted advertising.

Responsibility: Third party

Validity: persistent (thirty (30) minutes)

Requirement for consent: yes

b) Name: MUID

Purpose and content: This cookie is used to track the user ID, which helps to count valid clicks for targeted advertising.

Responsibility: Third party

Validity: persistent (thirteen (13) months)

Requirement for consent: yes

c) Name: _uetvid

Purpose and content:

Responsibility: Third party

Validity; persistent (sixteen (16) days)

Requirement for consent: yes

4. YouTube cookies

a) Name: pm_sess

Purpose and content: This cookie is used to maintain the browser session

Responsibility: Third party

Validity: persistent (thirty (30) minutes)

Requirement for consent: yes

b) Name: CGIC

Purpose and content: This cookie is used to provide search results by auto-completing search queries based on a user's initial input.

Responsibility: Third party

Validity: persistent (six (6) months)

Requirement for consent: yes

c) Name: DEVICE INFO Pref

Purpose and content: This cookie is used to track the user's interaction with embedded content.

Responsibility: Third party

Validity: persistent (six (6) months)

Requirement for consent: yes

d) Name: CONSENT

Purpose and content: This cookie is used to embed videos on the website using YouTube (see section C.II).

Responsibility: Third party

Validity: persistent (two (2) years)

Requirement for consent: yes

e) Name: YEC

Purpose and content: This cookie is used to save the video player settings of the user with an embedded YouTube video.

Responsibility: Third party

Validity: persistent thirteen (13) months)

Requirement for consent: yes

f) Name: PREF

Purpose and content: This cookie is used to embed videos on the website using YouTube (see section C.II) and to store information such as your preferred page configuration and playback settings such as explicit autoplay options, random mix and player size.

Responsibility: Third-Party

Validity: persistent eight (8) months)

Requirement for consent: yes

g) Name: VISITOR_INFO_LIVE

Purpose and content: This cookie is used to embed videos on the website using YouTube (see section C.II).

Responsibility: Third party

Validity: persistent six (6) months)

Requirement for consent: yes

h) Name: remote_sid

Purpose and content: This cookie is used for the implementation and functionality of YouTube video content on the website.

Responsibility: Third party

Validity: Session

Requirement for consent: yes

i) Name: Test_cookie

Purpose and content: This is a test for the cookie setting authorizations in the user's browser.

Responsibility: Third party

Validity: persistent for one (1) day

Requirement for consent: yes

j) Name: UULE

Purpose and content: This cookie is used to determine the geographical location of the user

Responsibility: Third party

Validity: persistent (six (6) hours)

Requirement for consent: yes

k) Name: YSC

Purpose and content: This cookie is used to embed videos on the website via YouTube (see section C.II).

Responsibility: Third party

Validity: Session

Requirement for consent: yes

4. jobs.kostal.com

a) Name: CGISESSID

Purpose and content: When visiting the website, each visitor is assigned an individual ID for the duration of the visit. Your entries and your behavior on the website are assigned to this ID by our web server. This makes it possible, for example, to assign your entries to your person as you navigate through the website.

Responsibility: First party

Validity: Session

Need for consent: no

Permission under data protection law: balancing of interests (Art. 6 para. 1 sentence 1 lit. f GDPR). Our legitimate interest is the provision of the informational function of the website accessed by the user.

b) Name; CompanyID

Purpose and content: To ensure that the job offer is linked to the right company.

Responsibility: First party

Validity: Session

Need for consent: no

Permission under data protection law: balancing of interests (Art. 6 para. 1 sentence 1 lit. f GDPR). Our legitimate interest is the provision of the informational function of the website accessed by the user.

c) Name: ExternalDesignID

Purpose and content: To ensure that the job offer is linked to the right company.

Responsibility: First party

Validity: Session

Need for consent: no

Permission under data protection law: balancing of interests (Art. 6 para. 1 sentence 1 lit. f GDPR). Our legitimate interest is the provision of the informational function of the website accessed by the user.

e) Language

Purpose and content: To define the language of the display. 

Responsibility: First party

Validity: Session

Need for consent: no

Permission under data protection law: balancing of interests (Art. 6 para. 1 sentence 1 lit. f GDPR). Our legitimate interest is the provision of the informational function of the website accessed by the user.

E. Information on the rights of data subjects

As a data subject, you have the following rights in relation to the processing of your personal data, which you can exercise by contacting us using the contact information provided in Section A:

A right to information (Art. 15 GDPR) as to which of your personal data we process. This includes further information about the data processing, such as the purpose and legal basis as well as the recipients of this data. You also have the right to request a copy of this data. 
A right to request the rectification of inaccurate personal data concerning you and the completion of incomplete personal data (Art. 16 GDPR).
A right to request the deletion of personal data concerning you in the cases provided for by law (Art. 17 GDPR), for example if the data is no longer required for the purposes for which it was collected or if it has been processed unlawfully. 
A right to request the restriction of processing in the cases prescribed by law (Art. 18 GDPR) 
A right to receive the personal data concerning you, which we process on the basis of your consent or for the performance of a contract (see Section B), in a structured, commonly used and machine-readable format (right to data portability, Art. 20 GDPR). 
The right to withdraw consent given to us at any time. This does not affect the lawfulness of the processing carried out until the withdrawal.
A right to lodge a complaint with a supervisory authority (Art. 77 GDPR). A list of data protection supervisory authorities with their addresses can be found here.
 

You are not necessarily entitled to the aforementioned rights without restriction in every case. The law provides for restrictions in each case. The full scope of your rights can be found in the above-mentioned articles, which you can access via the following link:

eur-lex.europa.eu/legal-content/DE/TXT/HTML/

You can also assert the above rights against us if the assertion of the right relates to data processing in the context of applicant selection, where we are considered a joint controller within the meaning of the GDPR with another company in the KOSTAL Group. We have concluded an agreement with these companies to ensure that we respond to inquiries from the data subjects.

Last updated: 25.04.2024

Appendix 1: Legal entities of the KOSTAL Group(EU/EEA)