CPC AG Privacy Policy – GDPR-compliant

Last updated: September 2026

1. General Information on Data Processing

General information

The protection of your personal data is very important to us. In this privacy policy we inform you about which personal data we process when you visit our website, contact us, use our information offerings, work with us or apply for a position with us.

Personal data is any information relating to an identified or identifiable natural person. This includes, for example, name, contact details, IP address, application documents or information about the use of our website.

Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

We adapt this privacy policy whenever our data processing, our technical systems or the legal requirements change. The version published on our website at any given time applies.

Who is responsible for data processing?

The controller within the meaning of the General Data Protection Regulation is:

CPC Unternehmensmanagement AG
THE SQUAIRE 12, Am Flughafen
60549 Frankfurt am Main, Germany

Phone: +49 69 56030303
Email: contact@cpc-ag.de

Represented by the Executive Board: Michael Babilon-Teubenbacher, Clemens Heisinger, Michael Kempf, Gunnar Schultze

Data Protection Officer

We have appointed a Data Protection Officer:

Prof. Dr. Andreas Wamsler
Pestalozzistraße 22
74321 Bietigheim

Phone: +49 7142 9669351
Email: datenschutz@cpc-ag.de

How do we collect your data?

We process personal data in particular when you:

visit our website,
contact us via a form,
send us an email or call us,
send us documents by email or via a form,
request information material or newsletters,
register for an event,
ask us to contact you,
apply for a position with us,
visit our social media presences,
consent to analytics or marketing processing,
work with us via collaboration tools.

Some technical data is collected automatically when you visit our website. This includes in particular IP address, browser information, operating system, time of access and content accessed.

What do we use your data for?

We process personal data in particular in order to:

provide you with information,
handle your enquiries,
initiate consulting services,
carry out consulting projects,
process applications,
organise events,
provide further information offerings and newsletters,
provide our website securely and in working order,
improve our website and offerings,
pursue our legitimate business interests,
comply with legal obligations.

Obligation to provide personal data

The provision of personal data is generally voluntary. Certain information may, however, be required in order to:

handle your enquiry or request,
initiate or perform a contract,
provide you with information offerings,
process a registration for an event,
process your application,
comply with legal obligations.

If you do not provide the required information, we may not be able to provide the service you have requested.

Personal data we collect

Depending on the nature of your relationship with us, your use of our website and the services you use, we process different categories of personal data. These may include in particular:

Master data (e.g. surname, first name, salutation, company, position, address)
Contact data (e.g. email address, telephone number, mobile number)
Communication data (e.g. content of enquiries, emails, contact forms, notes of conversations or correspondence)
Contract and business data (e.g. project, offer, contract and billing information)
Applicant data (e.g. CV, cover letter, references, qualifications, interview notes and information from selection procedures)
Usage data (e.g. pages visited, interactions with content, downloads or registrations for events)
Technical data (e.g. IP address, browser type, operating system, device used, times of access)
Marketing and preference data (e.g. interests, consents, newsletter subscriptions or responses to marketing measures)
Event and training data (e.g. registrations, participation information and feedback)
Other information that you provide to us voluntarily or that is required in the context of a business relationship, application or enquiry.

We generally process personal data only insofar as this is necessary for the respective purposes, there is a legal basis for it or you have given us your corresponding consent.

Recipients of personal data

Within our company, only those persons who need personal data to perform their tasks have access to it. In addition, we may transfer personal data in particular to the following categories of recipients:

hosting and IT service providers,
providers of communication and collaboration solutions,
providers of CRM, marketing and applicant management systems,
analytics and marketing service providers,
event and training service providers,
law firms, tax advisers and auditors,
affiliated companies,
authorities and courts, insofar as we are obliged to do so.

We use external service providers who process personal data on our behalf and in accordance with our instructions. Where required, data processing agreements pursuant to Art. 28 GDPR have been concluded with these service providers. These service providers support us in particular in the areas of hosting, IT operations, applicant management, CRM, marketing, analytics and communication.

Some of the service providers we use are based outside the European Union or the European Economic Area or use technical infrastructure in third countries. Personal data is only transferred to a third country if the legal requirements are met. Depending on the recipient, the transfer may be based in particular on:

an adequacy decision of the European Commission,
a valid certification of the recipient under the EU-US Data Privacy Framework,
standard contractual clauses approved by the European Commission,
supplementary technical and organisational safeguards,
explicit consent in the exceptional cases provided for by law.

Storage period

We store personal data only for as long as is necessary for the respective purpose or as statutory retention obligations exist.

The specific storage period depends in particular on:

the purpose of the processing,
the duration of the business relationship,
statutory retention obligations,
possible limitation periods,
the need to assert or defend legal claims.

After deletion in production systems, personal data may remain in technical backup copies for a limited period. This applies in particular to unalterable (immutable) backup systems that serve as protection against data loss, malfunctions, sabotage and cyber attacks. This data is not used for any other purpose. The legal basis for this is Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring IT security, the integrity of our systems and the ability to restore data and systems in an emergency. The data contained in backup copies is automatically overwritten or deleted in accordance with the technical backup and deletion concepts.

Use of AI systems in consulting and company organisation

We may use AI-supported systems to support our internal workflows and consulting services. Possible areas of application include in particular:

analysis of documents and data sets,
research and structuring of information,
summarising content,
converting speech to text or text to speech,
support in creating and revising information, texts, images or graphics,
translations,
preparation of workshops and consulting services,
support of sales and marketing processes,
support of HR and recruiting processes,
support of finance and organisational processes.

Personal data is only processed in an AI system if this is necessary for the respective purpose and legally permissible. In doing so, we observe the following principles in particular:

data minimisation,
purpose limitation,
confidentiality,
role-based access rights,
human oversight,
review of providers and contractual terms,
appropriate technical and organisational safeguards,
no use of confidential data for the general training of external AI models, unless this is expressly excluded by contract or otherwise lawfully regulated.

The respective legal basis depends on the specific use. Possible legal bases are in particular Art. 6(1)(b), (c) or (f) GDPR and, in appropriate cases, your consent pursuant to Art. 6(1)(a) GDPR.

No solely automated decisions

As a matter of principle, we do not make any decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

Insofar as we use automated or AI-supported systems to support internal processes, the professional assessment and decision remain with duly authorised employees.

2. Legal Bases for Data Processing

We only process personal data if there is a legal basis for doing so. The relevant legal bases derive primarily from the GDPR. These are supplemented by national laws of the Member States and may be applicable together with or in addition to the GDPR. Depending on the respective processing operation, the following legal bases may apply in particular:

Consent
Art. 6(1)(a) GDPR, if you have given us your consent for a specific purpose.

Contract and pre-contractual measures
Art. 6(1)(b) GDPR, if the processing is necessary for the performance of a contract or for taking pre-contractual measures at your request.

Legal obligation
Art. 6(1)(c) GDPR, if the processing is necessary for compliance with a legal obligation.

Vital interests
Art. 6(1)(d) GDPR, if the processing is necessary to protect the vital interests of the data subject or of another natural person.

Public interest
Art. 6(1)(e) GDPR, if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Legitimate interests
Art. 6(1)(f) GDPR, if the processing is necessary for the purposes of our legitimate interests or those of a third party and your interests, fundamental rights and freedoms do not override them.

Legitimate interests may include in particular:

secure and economical operation of our website,
secure and economical handling of business enquiries,
secure and economical handling of applications,
maintaining existing business relationships,
direct marketing within the limits permitted by law,
improving our offerings,
defending against attacks and misuse,
asserting and defending legal claims.

What rights do you have?

Within the scope of the statutory requirements, you have in particular the following rights. To exercise your rights, you can contact us or our Data Protection Officer at any time. To prevent unauthorised access to data, we may request appropriate proof of your identity.

Right of access
Pursuant to Art. 15 GDPR, you have the right to request information as to whether and which personal data we process about you.

Right to rectification
Pursuant to Art. 16 GDPR, you have the right to request the rectification of inaccurate personal data or the completion of incomplete personal data.

Right to erasure
Under the conditions of Art. 17 GDPR, you may request the erasure of your personal data. In particular, the right to erasure does not exist insofar as the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.

Right to restriction of processing
Under the conditions of Art. 18 GDPR, you may request the restriction of processing.

Right to data portability
Under the conditions of Art. 20 GDPR, you have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format or to have it transmitted to another controller.

Right to object
Where personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right, pursuant to Art. 21 GDPR, to object to the processing of your personal data, provided there are grounds relating to your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without you having to state a particular situation.

Withdrawal of consent
You may withdraw any consent you have given at any time with effect for the future. The withdrawal does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal.

Right to lodge a complaint
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority generally responsible for CPC Unternehmensmanagement AG is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany

Alternatively, you may contact the data protection supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.

3. Provision of the Website Services

Hosting

Our website is hosted by the following provider:

Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen
Germany

When our website is accessed, the hosting provider processes technical connection data. This includes in particular:

IP address,
date and time of access,
page or file accessed,
amount of data transferred,
referrer URL,
browser type and browser version,
operating system,
requesting provider,
status codes.

The processing serves the secure, stable and efficient provision of our website. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of our website.

SSL or TLS encryption

Our website uses SSL or TLS encryption. This protects data that you transmit to us via our website during transmission. You can generally recognise an encrypted connection by the address in the browser bar beginning with “https://”.

Cookies

Our website uses cookies and similar technologies. Cookies are small files or pieces of information that can be stored on or read from your device. We distinguish in particular between:

technically necessary cookies,
functional cookies,
analytics cookies,
marketing cookies,
technologies for embedding external content.

Insofar as storing information on, or accessing information on, your device is strictly technically necessary, this is done on the basis of Section 25(2) TDDDG. Any subsequent processing of personal data is generally based on Art. 6(1)(f) GDPR.

For cookies and similar technologies that are not strictly necessary, we obtain your consent pursuant to Section 25(1) TDDDG. The subsequent processing of personal data is based on Art. 6(1)(a) GDPR.

Contact form

If you contact us via the contact form, we process the data you enter. This may include in particular:

first and last name,
company,
position,
email address,
telephone number,
content of your message,
time of the enquiry,
technical transmission data.

We use this data to handle your enquiry, to contact you and to prepare possible consulting services.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a possible or existing contract. For other business enquiries, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in handling and documenting incoming enquiries.

Mandatory fields are marked accordingly. Without the information requested there, we may not be able to process your enquiry.

4. Integrated Third-Party Providers and Services

Overview

Cookiebot by Usercentrics
CHEQ (ClickCease)
Cloudflare Turnstile
Google Ads
Google Analytics
Google Tag Manager
Hubspot
Instagram and Facebook
LeadJourney
LinkedIn Insight Tag
Microsoft Advertising
Microsoft Clarity and Microsoft Clarity Analytics
Microsoft Clarity Ads
YouTube

Cookiebot by Usercentrics

We use Cookiebot.

The provider is:

Usercentrics A/S
Havnegade 39
1058 Copenhagen
Denmark

Cookiebot enables us to manage and document your consents and privacy settings. The use of the consent management platform is necessary in order to store your choice and to keep the legally required records of consents given.

The following information in particular may be processed:

consent status,
time of the decision,
selected settings,
technical information about the browser,
pseudonymous consent ID.

Storage on, or reading from, your device is based on Section 25(2) TDDDG. Personal data is processed on the basis of Art. 6(1)(c) GDPR and additionally Art. 6(1)(f) GDPR. Our legitimate interest lies in the legally compliant and user-friendly management of consents.

CHEQ (ClickCease)

We use CHEQ (ClickCease)

The provider is:

CHEQ AI Technologies (2018) Ltd.
23 Yehuda Ha Levi St
Tel Aviv 6513601
Israel

CHEQ is used to protect our website against abusive access, automated bot requests, fraud attempts and other security-relevant activities, and to improve the quality of our website analytics. To this end, CHEQ analyses visitor access and assesses whether it comes from legitimate users, automated systems or potentially harmful activities.

The following data in particular may be processed:

Technical connection and device data (e.g. IP address, browser type, operating system, device information)
Usage data (e.g. pages accessed, interactions, time spent, times of access)
Network and security data (e.g. information about the network connection, detection of conspicuous or automated activity)
Risk and classification information that CHEQ may generate to distinguish between human users, bots or other automated access.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website and our advertising against abusive and fraudulent access, detecting automated access and avoiding data distortion.

Personal data may also be processed outside the European Union, in the USA and in Israel. Insofar as personal data is transferred to third countries, this is done on the basis of the legal requirements of Art. 44 et seq. GDPR.

Cloudflare Turnstile

We use Cloudflare Turnstile.

The provider is:

Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA.

Cloudflare Turnstile serves to protect our website against abusive access by automated programs (bots), spam and other abusive activities. To this end, the service analyses various technical characteristics of the website visit in order to distinguish between human users and automated access. Unlike conventional CAPTCHA solutions, the check is in many cases carried out without users having to actively solve tasks.

The following data in particular may be processed:

IP address,
device and browser information,
technical connection data,
information about the interaction with the website,
security and risk assessment data.

The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website, our forms and IT systems against automated attacks, spam, misuse and other security-relevant risks, and in ensuring the secure and stable provision of our online services.

Personal data may also be processed outside the European Union and in the USA. Insofar as personal data is transferred to third countries, this is done on the basis of the legal requirements of Art. 44 et seq. GDPR.

Google Ads

We use Google Ads.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4, Ireland

Google Ads enables us to draw attention to our services on external websites and in Google's search results and to measure the success of our advertising campaigns. For this purpose, information may be processed in particular as to whether users reached our website via a Google ad and which interactions then take place on our website.

The following data in particular may be processed:

IP address,
device and browser information,
information about the visit to our website,
interaction and event data,
campaign and conversion data,
pseudonymous identifiers and online identifiers.

Insofar as Google Ads uses cookies or similar technologies, they are used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

The service is only activated after you have given your consent. You can withdraw your consent at any time via the privacy settings.

Google Analytics

We use Google Analytics 4.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4, Ireland

Google Analytics serves the statistical analysis of the use of our website.

The following information in particular may be processed:

pages and content accessed,
time and duration of use,
approximate geographical origin,
technical device and browser information,
interactions on the website,
referrer URL,
shortened or otherwise processed IP address,
pseudonymous user identifiers,
campaign information.

When Google Analytics is used, technical information about the use of our website is processed. This may also include IP addresses. Google Analytics 4 uses methods that make it more difficult to directly identify individuals. According to Google, IP addresses are not logged or stored and are processed solely to provide the analytics and security functions.

The legal bases are Section 25(1) TDDDG for storing information on, or reading information from, your device and Art. 6(1)(a) GDPR.

The service is only activated after you have given your consent. You can withdraw your consent at any time via the privacy settings.

Google Tag Manager

We use Google Tag Manager.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4, Ireland.

Google Tag Manager is a solution with which website tags can be managed and integrated via a central interface. Google Tag Manager itself generally does not process any usage profiles and does not set any analytics or marketing cookies of its own. It serves exclusively the technical integration and control of other services on our website.

The following information in particular may be processed:

IP address,
browser information,
device information,
information about the access to our website.

Google Tag Manager is used on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR in the efficient management and technically reliable integration of website services.

HubSpot

We use HubSpot.

The provider is:

HubSpot Ireland Limited
2nd Floor, 30 North Wall Quay
Dublin 1
Ireland

HubSpot supports us in particular in handling contact enquiries, managing customer and prospect data, sending newsletters and specialist information, running events and analysing and optimising our sales and marketing activities.

The following data in particular may be processed:

master data (e.g. name, company, position),
contact data (e.g. email address, telephone number),
communication data,
form data,
contract and prospect data,
event and registration data,
marketing and interaction data,
device and browser information,
IP address,
usage data of our website.

HubSpot may provide functions for the automated evaluation, categorisation, summarisation, analysis and support of communication, sales and marketing processes that are based wholly or partly on artificial intelligence methods. Such functions are used exclusively to support our employees. Decisions with legal effect or a comparably significant impact on data subjects are not made solely by automated means.

Insofar as HubSpot uses forms, analytics functions, tracking technologies, cookies or similar technologies, they are used exclusively within the framework of the applicable legal requirements and on the basis of the consents required in each case.

Depending on the respective purpose, the processing is based on Art. 6(1)(b) GDPR (initiation and performance of contracts), Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest in the efficient management of customers, prospects and communication).

Instagram and Facebook

Our website may provide functions of, or links to, our company profile on Instagram and Facebook. The provider is:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland.

If you have consented to the use of the corresponding social media services, personal data may be transferred to Meta when the corresponding content is accessed or the respective links are clicked. In particular, IP address, device and browser information and information about the use of our website may be processed.

The use is based exclusively on your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, insofar as cookies or similar technologies are used or information is stored on or read from your device.

The service is only activated after you have given your consent. You can withdraw your consent at any time via the privacy settings.

LeadJourney

We use LeadJourney.

The provider is:

LeadJourney Ltd.
Artemidos 6 str., Office 24
Joanna Court
6030 Larnaca
Cyprus

LeadJourney helps us understand where website visitors come from and how effective our marketing measures are. For this purpose, interactions on our website are recorded and assigned to the respective marketing channels. We use the information for statistical evaluation and optimisation of our online offerings.

The following data in particular may be processed:

IP address,
pages visited,
time and duration of the visit,
technical browser and device information,
information on the origin of the website visit,
interactions with forms.

Insofar as LeadJourney stores information on your device or accesses information stored there, this is done on the basis of your consent pursuant to Section 25(1) TDDDG. The associated processing of personal data is based on Art. 6(1)(a) GDPR.

You can withdraw any consent you have given at any time with effect for the future via the privacy settings of our website.

LinkedIn Insight Tag

We use the LinkedIn Insight Tag.

The provider is:

LinkedIn Ireland Unlimited Company
Wilton Plaza
Wilton Place
Dublin 2
Ireland.

The LinkedIn Insight Tag enables us to understand how visitors who reached our website via LinkedIn use it, to measure the success of our marketing measures and to analyse the reach and effectiveness of our content and campaigns.

The following data in particular may be processed:

IP address,
device and browser information,
pages and content visited,
referrer information,
time stamps and usage data,
campaign and conversion data,
pseudonymous identifiers and online identifiers.

The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in analysing the use of our website, measuring the success of our marketing activities and optimising our online offering and our communication measures in line with demand.

Microsoft Advertising

We use Microsoft Advertising.

The provider is:

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18, Ireland

Microsoft Advertising enables us to display advertisements in search engines and in the Microsoft advertising network and to analyse the success of our marketing measures. For this purpose, it can be tracked whether visitors reached our website via an advertisement and which interactions take place on our website.

The following data in particular may be processed:

IP address,
device and browser information,
usage and interaction data,
pages and content visited,
referrer information,
campaign and conversion data,
pseudonymous identifiers and online identifiers.

Insofar as Microsoft Advertising uses cookies or similar technologies, they are used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

The service is only activated after you have given your consent. You can withdraw your consent at any time via the privacy settings.

Microsoft Clarity & Microsoft Clarity Analytics

We use Microsoft Clarity and Microsoft Clarity Analytics.

The provider is:

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18, Ireland

Microsoft Clarity and Microsoft Clarity Analytics help us to better understand the use of our website and to improve its usability.

The following data in particular may be processed:

mouse movements,
clicks,
scrolling behaviour,
pages visited,
session duration,
technical device and browser information,
approximate geographical information,
IP address or information derived from it.

The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

The service is only activated after you have given your consent. You can withdraw your consent at any time via the privacy settings.

Microsoft Clarity Ads

We use Microsoft Clarity Ads.

The provider is:

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18, Ireland

Microsoft Clarity Ads enables us to analyse the effectiveness of our online advertising and to better understand how visitors who reach our website via advertisements interact with our content. For this purpose, analytics functions of Microsoft Clarity are combined with advertising and conversion data from Microsoft Advertising.

The following data in particular may be processed:

IP address,
device and browser information,
usage and interaction data,
mouse movements, clicks and scrolling behaviour,
pages and content visited,
referrer information,
advertising, campaign and conversion data,
pseudonymous identifiers and online identifiers.

Microsoft Clarity Ads is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. The consent covers both the storing and reading of information on your device and the subsequent processing of personal data for analytics, marketing and conversion measurement purposes.

The service is only activated after you have given your consent. You can withdraw your consent at any time via the privacy settings.

YouTube

We use YouTube.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4, Ireland.

YouTube allows us to embed videos and multimedia content in our website. When a page with an embedded YouTube video is accessed, personal data may be transferred to Google. This applies in particular when a video is played or you have consented to a corresponding embedding.

The following data in particular may be processed:

IP address,
device and browser information,
pages and content visited,
date and time of access,
usage and interaction data,
referrer information,
where applicable, information about an existing Google account.

YouTube is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, insofar as cookies or similar technologies are used or information is stored on or read from your device.

The service is only activated after you have given your consent. You can withdraw your consent at any time via the privacy settings.

Links to external websites

Our website contains links to external websites. As a rule, data is only transferred to the operator of the external website when you follow the respective link.

The respective operator is responsible for the data processing on the external website.

5. Newsletters, Information Material and Events

Registration and dispatch

Via our website you can request newsletters, information material, invitations or other specialist content.

Depending on the offering, we process in particular:

first and last name,
email address,
company,
position,
selected topics and interests,
time of registration,
IP address at registration,
proof of consent.

The processing is based on your consent pursuant to Art. 6(1)(a) GDPR.

Double opt-in

We may use a so-called double opt-in procedure. After registering, you will receive an email in which you must confirm your registration. The confirmation serves as proof that the registration was actually made by the owner of the email address provided. The registration is logged to fulfil our obligations to provide evidence on the basis of Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR.

Performance measurement

If you have consented to this, we may evaluate whether messages are opened and which links contained in them are clicked.

The following information in particular may be processed:

time of retrieval,
links clicked,
technical device information,
browser information,
where applicable, IP address.

The evaluation serves to improve our content and offerings and to align them more closely with the interests of the recipients.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, insofar as information on your device is accessed.

Withdrawal and storage period

You can withdraw your consent at any time with effect for the future. To do so, you can in particular use the unsubscribe link in the respective message.

After you unsubscribe, your data will no longer be used for dispatch. We may store your email address in a block list to ensure that you do not receive any further messages. Storage in the block list is based on Art. 6(1)(f) GDPR.

6. Social Media Presences

We maintain company profiles on social networks and platforms, in particular:

LinkedIn,
Xing,
Kununu,
Facebook,
Instagram,
X,
YouTube.

When you visit our social media presences, the respective platform operator processes personal data under its own responsibility. In doing so, usage profiles may be created and data may also be processed outside the European Union or the European Economic Area.

We process the information available there when you:

interact with our profile,
comment on or share posts,
send us a message,
provide publicly recognisable information.

The processing serves communication, the presentation of our company, recruitment and the maintenance of business contacts. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in contemporary corporate communication and interaction with customers, prospects and applicants.

Insofar as we decide jointly with a platform operator on the purposes and means of certain processing operations, joint controllership pursuant to Art. 26 GDPR may exist.

Further information can be found in the privacy notices of the respective platform.

7. Applications

Processing of applicant data

If you apply to us, we process the personal data you provide in order to carry out the application procedure.

This may include in particular:

first and last name,
address and contact details,
date of birth, if provided by you,
cover letter and letter of motivation,
CV,
application photos,
references and certificates,
information on education and professional experience,
language and specialist skills,
information on the desired position and availability,
interview notes,
results of case studies and selection procedures,
communication during the application process,
where applicable, special categories of personal data provided voluntarily.

The data is processed in order to:

review your application,
assess your suitability for the advertised position,
conduct job interviews and selection procedures,
communicate with you,
prepare a hiring decision,
conclude an employment contract, where applicable.

The legal bases are Section 26(1) BDSG, Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. The legitimate interest lies in the efficient conduct of the application process.

Insofar as you voluntarily provide us with special categories of personal data, the processing takes place within the framework of the legal requirements, in particular on the basis of Section 26(3) BDSG and Art. 9(2) GDPR.

Recipients and authorised persons

Within the CPC Group, only those persons involved in the respective application and decision-making process have access to applicant data. These may include in particular:

recruiting and the HR department,
responsible managers,
members of the Executive Board,
interviewers,
technical administrators to the extent necessary.

AI-supported assistance in the application procedure

To support our application procedure, we use AI-supported tools, in particular Microsoft Copilot. The systems support our employees with administrative and analytical tasks within the recruiting process.

In particular, they may be used to:

record information from application documents in a structured way,
check minimum qualifications,
sort applications according to predefined criteria,
create summaries for further human review,
generate text suggestions for communication activities.

No solely automated decision is made about an invitation to a selection procedure or about hiring. The final assessment and decision is always made by duly authorised employees.

Insofar as Microsoft Copilot is used within Microsoft 365, the processing takes place in compliance with the data protection and security measures agreed with Microsoft. We do not use applicant data to train generally available AI models.

Deletion of applicant data

If your application is unsuccessful, we generally delete your applicant data no later than six months after the conclusion of the application procedure.

Longer storage may take place if:

you have expressly consented to being included in a talent pool,
statutory retention obligations exist,
the data is required for the establishment, exercise or defence of legal claims.

If an employment relationship is established, the data required for the employment relationship will be transferred to the personnel file.

Talent pool

With your express consent, we may store your application documents beyond the specific application procedure in order to contact you about suitable future vacancies.

The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 26(2) BDSG.

Consent is voluntary and can be withdrawn at any time with effect for the future.

8. Collaboration and Communication Platforms

General information

To collaborate with customers, prospects, applicants, business partners and service providers, we use digital collaboration and communication platforms. These enable in particular video conferences, the exchange of information, the joint editing of documents and collaboration on projects.

The following categories of data in particular may be processed:

master data (e.g. name, company, position),
contact data (e.g. email address, telephone number),
communication data,
audio, video and chat content,
files and documents,
appointment and meeting information,
device and browser information,
log and usage data,
access and authorisation information.

Depending on the use case, the processing is based on Art. 6(1)(b) GDPR (initiation and performance of contracts), Art. 6(1)(f) GDPR (efficient collaboration and communication) or on consent given pursuant to Art. 6(1)(a) GDPR.

Use of collaboration platforms

The use of the collaboration and communication platforms provided is voluntary. Processing of the personal data required for this is technically necessary for participating in video conferences, collaborating on projects, accessing shared files, using guest access and communicating via the respective platforms.

If you use the services we provide, the data arising from the respective use is processed in accordance with the purposes described in this privacy policy. If you do not wish your personal data to be processed via the respective platform, you should not use that platform and should agree alternative means of communication or exchange with us.

By voluntarily participating in a meeting, using guest access or accessing shared content, the personal data technically and organisationally required for this is processed to the extent described.

Please note that content shared, uploaded or edited by authorised users within collaboration platforms may be visible to other authorised participants of the respective workspaces, meetings, teams, projects or boards. Access rights are granted on a need-to-know basis and are reviewed regularly. Personal data should only be processed within the platforms to the extent necessary for the respective collaboration.

Microsoft Teams

We use Microsoft Teams.

The provider is:

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18, Ireland.

Microsoft Teams is used in particular for:

video conferences and online meetings,
telephony and chat communication,
joint project work,
file sharing and document editing,
screen sharing and presentations,
collaboration with customers, applicants, business partners and service providers.

In the course of collaboration, we may provide external persons with temporary or permanently set-up guest access to Teams areas, channels, meetings or shared files. Guest users receive only the access rights required for the respective collaboration.

In particular, communication content, meeting data, files, comments, task information and access and log data may be processed.

Within Microsoft 365 and Teams, Microsoft provides various functions that are based wholly or partly on artificial intelligence methods, in particular Microsoft Copilot. These functions can be used, for example, to create meeting summaries, transcriptions, minutes, task lists, research results or document summaries.

Insofar as such functions are used, they serve exclusively to support the persons involved in their work. Decisions with legal effect or a comparably significant impact on data subjects are not made solely by automated means.

Miro

We use Miro.

The provider is:

RealtimeBoard, Inc. (Miro)
201 Spear Street, Suite 1100
San Francisco, CA 94105
USA.

Miro enables the joint editing of digital whiteboards and is used in particular for:

workshops,
project work,
strategy and transformation projects,
visualisation of processes and organisational structures,
brainstorming sessions,
documentation of work results,
collaboration with customers, applicants, business partners and service providers.

In the course of use, content can be stored on Miro boards and edited jointly. This may include, for example, texts, comments, files, documents, graphics, tasks, project information and other content provided by users.

To collaborate with external persons, we may provide guest access or shared board access. Guest users receive only the permissions required for the respective collaboration.

Miro also provides functions that are based wholly or partly on artificial intelligence methods. These can be used, for example, to structure content, summarise information, create drafts, cluster workshop results or support creative work processes. Insofar as such AI functions are used, they serve exclusively to support the persons involved. Decisions with legal effect or a comparably significant impact on data subjects are not made solely by automated means.

9. Miscellaneous

Liability for our own content

The content of these pages has been created with the greatest care. However, we cannot guarantee that the content is correct, complete and up to date. As a service provider, we are responsible for our own content on these pages in accordance with general law.

Liability for content of external providers

These own contents must be distinguished from cross-references (“links”) to content provided by other providers. We have no influence on their content; the respective provider or operator of the linked pages is always responsible for their content.

Objection to advertising emails

We hereby object to the use of contact data published within the scope of the imprint obligation for sending advertising and information material that has not been expressly requested. We expressly reserve the right to take legal action in the event of unsolicited advertising information being sent, for example by spam emails.