Privacy Policy
The controller within the meaning of data protection laws, in particular the EU General Data Protection Regulation (GDPR), is:
ReformKontor GmbH & Co. KG
Ernst-Litfaß Str. 16,
19246 Zarrentin am Schaalsee
Your Rights as a Data Subject
You may exercise the following rights at any time using the contact details of our data protection officer provided:
- Information about your data stored with us and its processing (Art. 15 GDPR),
- Rectification of inaccurate personal data (Art. 16 GDPR),
- Erasure of your data stored with us (Art. 17 GDPR),
- Restriction of data processing if we are not yet permitted to delete your data due to legal obligations (Art. 18 GDPR),
- Objection to the processing of your data by us (Art. 21 GDPR) and
- Data portability, provided you have consented to the data processing or have concluded a contract with us (Art. 20 GDPR).
If you have given us consent, you may revoke it at any time with effect for the future.
You may lodge a complaint with a supervisory authority at any time, e.g., with the competent supervisory authority of the federal state of your residence or with the authority responsible for us as the controller.
A list of supervisory authorities (for the non-public sector) with addresses can be found at: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.
Collection of General Information When Visiting Our Website
Type and Purpose of Processing:
When you access our website, i.e., if you do not register or otherwise submit information, information of a general nature is automatically collected. This information (server log files) includes, for example, the type of web browser, the operating system used, the domain name of your Internet service provider, your IP address, and similar data.
It is processed in particular for the following purposes:
- Ensuring a smooth connection to the website,
- Ensuring smooth use of our website,
- Evaluation of system security and stability, and
- optimization of our website.
We do not use your data to draw conclusions about you personally. Information of this kind may be statistically analyzed by us in anonymized form to optimize our website and the underlying technology.
Legal Basis and Legitimate Interest:
Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.
Recipients:
Recipients of the data may be technical service providers who act as processors for the operation and maintenance of our website.
Storage Duration:
The data is deleted as soon as it is no longer required for the purpose of collection. This is generally the case for data used to provide the website when the respective session has ended.
In the case of data stored in log files, this is the case after 14 days at the latest. Storage beyond this period is possible. In this case, the IP addresses of users are anonymized so that it is no longer possible to associate the calling client.
Provision Required or Mandatory:
The provision of the aforementioned personal data is neither legally nor contractually required. However, without the IP address, the service and functionality of our website cannot be guaranteed. In addition, individual services and features may be unavailable or restricted. For this reason, objection is excluded.
Third-Country Transfer:
The collected data may be transferred to the following third countries:
no
The following data protection guarantees are in place:
Technically Non-Essential Cookies
Furthermore, we use cookies to better tailor the offering on our website to the interests of our visitors or to improve it generally on the basis of statistical evaluations.
Please refer to the information below on the display, tracking, remarketing, and web analytics technologies used to see which providers set cookies.
Legal Basis:
The legal basis for these processing operations is your consent in each case, Art. 6(1)(a) GDPR.
Recipients:
Recipients of the data may be technical service providers who act as processors for the operation and maintenance of our website.
For further recipients, please refer to the information below on the display, tracking, remarketing, and web analytics technologies used.
Third-Country Transfer:
For information on this, please refer to the listings of the individual display, tracking, remarketing, and web analytics providers.
Provision Required or Mandatory:
Of course, you can generally view our website without cookies. Web browsers are regularly set to accept cookies. In general, you can deactivate the use of cookies at any time via your browser settings (see revocation of consent).
Please note that individual functions of our website may not work if you have deactivated the use of cookies.
Revocation of Consent:
You can revoke your consent at any time via our cookie consent tool.
Notice Regarding Data Transfer to the USA and Other Third Countries
Among other things, we use tools from companies based in the USA or other third countries that are not safe under data protection law. When these tools are active, your personal data may be transferred to and processed in these third countries. We point out that no level of data protection comparable to that in the EU can be guaranteed in these countries. For example, US companies are obliged to disclose personal data to security authorities without you as a data subject being able to take legal action against this. It cannot therefore be ruled out that US authorities (e.g., intelligence services) may process, evaluate, and permanently store your data located on US servers for monitoring purposes. We have no influence over these processing activities.
Profiling:
Please refer to the information below on the display, tracking, remarketing, and web analytics technologies used to see the extent to which we analyze the behavior of website visitors with pseudonymized user profiles.
Contact Form
Type and Purpose of Processing:
The data you enter is stored for the purpose of individual communication with you. For this purpose, it is necessary to provide a valid email address and your name. This serves to assign the inquiry and subsequently answer it. Providing additional data is optional.
Legal Basis:
The processing of data entered into the contact form is based on a legitimate interest (Art. 6(1)(f) GDPR).
By providing the contact form, we want to enable you to contact us easily. The information you provide will be stored for the purpose of processing the inquiry and for possible follow-up questions.
If you contact us to request a quote, the processing of the data entered into the contact form is carried out for the performance of pre-contractual measures (Art. 6(1)(b) GDPR).
Recipients:
Recipients of the data may be processors.
Third-Country Transfer:
The collected data may be transferred to the following third countries:
no
The following data protection guarantees are in place:
Storage Duration:
Data is deleted no later than 6 months after processing the inquiry.
If a contractual relationship arises, we are subject to the statutory retention periods under the German Commercial Code (HGB) and will delete your data after these periods have expired.
Handling of Applicant Data
We offer you the opportunity to apply to us (e.g., by email, by post, or via an online application form). Below, we inform you about the scope, purpose, and use of your personal data collected during the application process. We assure you that the collection, processing, and use of your data is carried out in accordance with applicable data protection law and all other legal provisions, and that your data is treated in strict confidence. The same applies to data we receive from partner management using applicant profiles.
Scope and Purpose of Data Collection
If you submit an application to us or we receive your profile from partner management, we process your associated personal data (e.g., contact and communication data, application documents, notes from interviews, etc.) insofar as this is necessary for deciding on the establishment of an employment relationship. The legal basis for this is § 26 BDSG under German law (initiation of an employment relationship), Art. 6(1)(b) GDPR (general contract initiation), and—if you have given consent—Art. 6(1)(a) GDPR. Consent may be revoked at any time. Your personal data will only be passed on within our company to persons involved in processing your application.
If the application is successful, the data you have submitted will be stored in our data processing systems on the basis of § 26 BDSG and Art. 6(1)(b) GDPR for the purpose of implementing the employment relationship.
Data Retention Period
If we are unable to make you a job offer, you decline a job offer, or you withdraw your application, we reserve the right to retain the data you have submitted on the basis of our legitimate interests (Art. 6(1)(f) GDPR) for up to 6 months from the end of the application process (rejection or withdrawal of the application). The data will then be deleted and the physical application documents destroyed. The retention serves in particular for evidentiary purposes in the event of a legal dispute. If it is evident that the data will be required after the 6-month period has expired (e.g., due to an impending or pending legal dispute), deletion will only take place when the purpose for further retention no longer applies.
Longer retention may also take place if you have given corresponding consent (Art. 6(1)(a) GDPR) or if statutory retention obligations prevent deletion.
Inclusion in the Applicant Pool
If we are unable to make you a job offer, there may be the possibility of including you in our applicant pool. In the event of inclusion, all documents and information from the application will be transferred to the applicant pool in order to contact you in the event of suitable vacancies.
Inclusion in the applicant pool is based exclusively on your express consent (Art. 6(1)(a) GDPR). Giving consent is voluntary and has no relation to the ongoing application process. The data subject may revoke their consent at any time. In this case, the data from the applicant pool will be irrevocably deleted, provided there are no legal retention reasons.
The data from the applicant pool will be irrevocably deleted no later than two years after consent is given.
Provision Required or Mandatory:
The provision of your personal data is voluntary. However, we can only process your inquiry if you provide us with your name, email address, and the reason for the inquiry.
Use of Google Maps
This site uses the Google Maps map service. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
To use the functions of Google Maps, it is necessary to store your IP address. This information is usually transmitted to a Google server in the USA and stored there. The provider of this site has no influence over this data transmission. If Google Maps is activated, Google may use Google Fonts for the purpose of uniform display of fonts. When you access Google Maps, your browser loads the required web fonts into your browser cache to display texts and fonts correctly.
The use of Google Maps is in the interest of an appealing presentation of our online offerings and easy location of the places we indicate on the website. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g., device fingerprinting) within the meaning of the TTDSG. Consent may be revoked at any time.
Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.
More information on the handling of user data can be found in Google's privacy policy: https://policies.google.com/privacy?hl=en.
Revocation of Consent:
The provider currently does not offer an option for a simple opt-out or blocking of data transmission. If you want to prevent tracking of your activities on our website, please revoke your consent in the cookie consent tool for the corresponding cookie category or all technically non-essential cookies and data transfers. In this case, however, you may not be able to use our website or may only be able to use it to a limited extent.
Links to Social Media Profiles (Facebook and Instagram)
Embedded YouTube Videos
We embed YouTube videos on our website. The operator of the corresponding plugins is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (hereinafter "YouTube"). YouTube, LLC is a subsidiary of Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA (hereinafter "Google"). When you visit a page with the YouTube plugin, a connection to YouTube servers is established. YouTube is informed which pages you visit. If you are logged into your YouTube account, YouTube can assign your surfing behavior to you personally. You can prevent this by logging out of your YouTube account beforehand.
When a YouTube video is started, the provider uses cookies that collect information about user behavior.
Further information on the purpose and scope of data collection and its processing by YouTube can be found in the provider's privacy policy. There you will also find further information on your rights in this regard and settings options to protect your privacy (https://policies.google.com/privacy).
Revocation of Consent:
The provider currently does not offer an option for a simple opt-out or blocking of data transmission. If you want to prevent tracking of your activities on our website, please revoke your consent in the cookie consent tool for the corresponding cookie category or all technically non-essential cookies and data transfers. In this case, however, you may not be able to use our website or may only be able to use it to a limited extent.
SSL Encryption
To protect the security of your data during transmission, we use encryption methods (e.g., SSL) via HTTPS that correspond to the current state of the art.
Information About Your Right to Object Under Art. 21 GDPR
Right to Object on a Case-by-Case Basis
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR (data processing on the basis of a balancing of interests); this also applies to profiling based on this provision within the meaning of Art. 4(4) GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
Recipient of an Objection
ReformKontor GmbH & Co. KG
Ernst-Litfaß-Str. 16
19246 Zarrentin am Schaalsee
Phone: 038851-510
Email: datenschutz@reformkontor.de
Changes to Our Privacy Policy
We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g., when introducing new services. Your next visit will then be subject to the new privacy policy.
Questions to the Data Protection Officer
If you have any questions about data protection, please send us an email or contact the person responsible for data protection in our organization directly:
Genossenschaftsverband – Verband der Regionen e.V.
Audit and Consulting Division for Large Clients
Administrative Office Düsseldorf
Ludwig-Erhard-Allee 20, 40227 Düsseldorf
Phone: +49211160914957
Email: datenschutz@reformkontor.de
This privacy policy was created with the help of activeMind AG, the experts in external data protection officers (Version #2020-09-30).
Internal Whistleblower Office
Information on the Collection of Personal Data Under the GDPR for Whistleblowers in the Whistleblower System
The EU General Data Protection Regulation requires us to provide you with comprehensive information on the processing of personal data in the context of our activities.
This information relates to the processing of personal data by us in the context of the
Whistleblower System
for the implementation of Directive 2019/1937 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 October 2019 on the protection of persons who report breaches of Union law and the legal requirements for internal reporting offices pursuant to §§ 12(1), 13 of the Whistleblower Protection Act (Federal Law Gazette 2023 I No. 140 of 2 June 2023; hereinafter: HinSchG) and state legislation enacted thereunder for state and local authorities and their companies.
ECOVIS operates the whistleblower system on our behalf, as we as the data controller hereby provide our employees and possibly also third parties (so-called whistleblowers) with the—including anonymous—transmission of information on possible legal violations or ethical misconduct by employees of the company (data subjects) with the aim of examining such information and, if necessary, initiating follow-up measures to eliminate deficiencies or sanction violations of internal company or legal regulations.
This applies equally to use as an ombudsman's office within the scope of application of § 2(1) Nos. 1-10 HinSchG.
The whistleblower system may therefore process data of the whistleblower and also data of third parties, i.e.,
- our employees as data subjects,
- possible witnesses to facts
due to the contractual arrangement between us and Ecovis as a processor.
As part of the transfer of functions, ECOVIS receives reports from whistleblowers, anonymizes them, and transmits the information necessary to examine possible legal violations to the responsible offices within our organization. After we have clarified the facts, we inform ECOVIS of the follow-up measures taken. ECOVIS then—where possible—informs the whistleblower of the follow-up measures taken.
- Contact Details
Controller
ReformKontor GmbH & Co. KG
Ernst-Litfaß-Str. 16
19246 Zarrentin
Phone: +49 (0) 38851 510
Fax: +49 (0) 38851 / 51-299
Email: info@reformkontor.de
Data Protection Officer of the Company
Genossenschaftsverband – Verband der Regionen e.V.
Audit and Consulting Division for Large Clients
Administrative Office Düsseldorf
Ludwig-Erhard-Allee 20, 40227 Düsseldorf
Phone: +49211160914957
Processor as Internal Reporting Office:
Ecovis Keller Rechtsanwälte PartG mbB
Am Campus 1-11, 18182 Rostock/Bentwisch
Tel.: 0381 128849-0
Email: meldestelle380@ecovis.com
Website: Reporting Office - Data Protection Consulting (ecovis.com)
External Data Protection Officer
Mr. Sebastian Fröhlich
Email: datenschutz@ecovis.com
- Processing Framework
If you are a whistleblower:
As part of the whistleblower system, the reporting office at ECOVIS commissioned by us collects the following categories of data, depending on the information transmitted by the whistleblower, third parties, or us:
- Identification data Contact data Salutation / Gender Address data,
- Professional activities Residential address Current place of employment,
- Information on possible criminal offenses, administrative offenses, or actions in violation of internal company ethical regulations,
- Information on possible witnesses to the reported facts.
This data may have a personal reference, particularly if the third parties are natural persons or such persons act as an organ, other authorized representative, contact person, legal representative, or in a similar function for third parties.
The internal reporting office ECOVIS generally collects the data in direct contact with the whistleblower. Personal data of affected employees of our company is also initially collected by the reporting office from the whistleblower. This may be verified and supplemented by information that the reporting office has received from us.
In the course of examining the facts, additional data may also be disclosed to us by third parties. This is particularly the case when data is transmitted to us by customers and business partners, legal representatives, insurance companies, public bodies, experts, courts, or authorities.
From public sources, we collect—if not already available—contact data and supplementary information.
There is no legal obligation to provide data of the whistleblower.
Failure to provide personal data of the whistleblower generally means that it is not possible to inform about follow-up measures. The facts may not be fully clarified.
If the whistleblower provides their personal data to the ECOVIS reporting office, this data will only be processed by us as the employer within the scope of informed and written consent and only to the extent necessary to clarify the facts. The reporting office ensures the anonymity of the whistleblower both through data separation within the whistleblower system and through the transmission of exclusively anonymized data to us.
No automatic monitoring or evaluation systems are used in data processing in our company.
- Legal Basis
- Legal bases for data processing in the context of fulfilling the contractual transfer of functions to provide a whistleblower system:
- The data processing of whistleblowers at the ECOVIS reporting office is based on consent pursuant to Art. 6(1)(a) GDPR for the processing of personal data concerning them for the purpose of informing them about the progress of the procedure and, if necessary, follow-up questions to clarify the facts. Finally, it may happen that we base the data processing on consent given voluntarily, informedly, and unambiguously by the whistleblower for further specific purposes. In this case, we will inform the whistleblower separately in connection with the consent.
- The documentation of the report and the use of the whistleblower's own personal data provided, possibly named third parties as witnesses or as the cause of a matter to be investigated, is based on Art. 6(1)(c) GDPR in implementation of the legal requirements of the Whistleblower Protection Act, in particular pursuant to §§ 9, 10 HinSchG.
We expressly point out that cases are conceivable in which the processing could be based on several legal bases that apply alongside each other. In such a case, we reserve the right to base the processing on another legal basis even in the event of revocation of consent. We will inform you accordingly in the event of revocation of consent.
- Data Storage Duration
The documentation of the report is retained by Ecovis as part of the contract processing for 3 years after completion of the procedure due to legal requirements (§ 11(5) HinSchG).
The reporting office at Ecovis has its own statutory retention periods, so that the documentation of the report must be stored for six years pursuant to § 50 BRAO after the end of the year in which the procedure was completed,
- Transfer and Foreign Reference
- Recipients or Categories of Recipients of Personal Data
The data collected by the reporting office will only be forwarded to other recipients and third parties in compliance with legal provisions if this is possible while maintaining the anonymity of the whistleblower or if the whistleblower has given consent in individual cases.
For the technical operation of the communication and data processing systems, external data processors are involved as processors within the meaning of Art. 4 No. 10 GDPR, so that the processing of data by them does not constitute a transfer within the meaning of Art. 4 No. 2 GDPR. These have been carefully selected, particularly with regard to the required confidentiality of data processing, are contractually bound, and are regularly monitored.
- No transfer of your personal data to a third country takes place and is not intended.
- Your Rights
As a data subject, you have various rights under the General Data Protection Regulation. These are
- Right to information about the data stored about you with us (Art. 15 GDPR)
- Right to rectification of inaccurate data (Art. 16 GDPR)
- Right to erasure of data if there is no legal basis for further storage (Art. 17 GDPR) and
- Right to restriction of processing of data for specific purposes (Art. 18 GDPR).
If the processing of your data is based on consent, you have the right to revoke the consent you have given at any time. The lawfulness of the processing carried out on the basis of the consent given until revocation is not affected by the revocation. We also expressly point out once again that cases are conceivable in which the processing could be based on several legal bases that apply alongside each other. In such a case, we reserve the right to base the processing on another legal basis even in the event of revocation of consent. We will inform you accordingly in the event of revocation of consent.
Please note that the obligation to provide information pursuant to Art. 14(5)(d) GDPR does not apply to data subjects whose personal data the reporting office does not collect directly from them in the course of its activities for us. The right of data subjects to information pursuant to Art. 15 GDPR is also restricted insofar as this would impair the opposing rights and freedoms of the whistleblower or third parties. Insofar as the reporting office has therefore been transmitted data from third parties in the context of an order issued, we ask you to request the data subject rights directly from us.
The reporting office is not permitted to fulfill these data subject rights for professional legal reasons insofar as the reporting office would violate the professional confidentiality that applies to it by law by fulfilling them.
In addition, pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of data concerning you violates data protection regulations. The supervisory authority responsible for us is:
[The State Commissioner for Data Protection and Freedom of Information Mecklenburg-Western Pomerania
Schwerin Castle, Lennéstraße 1,
19053 Schwerin
Phone: +49 385 59494 0
Fax: +49 385 59494 58
Email: info@datenschutz-mv.de
Web: www.datenschutz-mv.de https://www.datenschutz-mv.de/kontakt/kontaktformular/
Finally, you have the right to contact our data protection officer at any time. They are obliged to maintain confidentiality with regard to your inquiry insofar as it concerns the processing of your data. You can reach our data protection officer using the contact details provided in Section 1.