Privacy Notice

Welcome to George P. Johnson UK Ltd. We are pleased to see you’re interested in the services we offer. We, George P. Johnson UK Ltd (hereafter referred to as „GPJ“, „we“, or „our“) abide by the principles of the EU General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (UK GDPR) in the development and supply of our products and services, as well as our processes and workflows.

This is to inform you to what purpose and on which legal basis we process your personal data (PII) and which rights you have concerning this data processing.

Please take the time to read this privacy notice concerning our processing of your personal data.

Controller’s contact details

George P. Johnson UK Ltd, 53 Great Suffolk Street, London, United Kingdom, phone: +44 208 879 2200, e-mail dataprivacy-UK@gpj.com is the controller for data processing, unless otherwise stated.

Data Protection Officer’s contact details

If you think that our processing of your personal data violates your data privacy rights, please contact us at dataprivacy-UK@gpj.com.

General information

Subject and purpose of data privacy

Personal data is subject to data privacy under Data Protection Laws of the UK as well as the EU. This concerns all matters of information which make use of identified or identifiable persons, for example first names, surnames, email addresses, or usage data such as IP addresses or user behaviour.

All personal data is used exclusively for the purposes outlined in this privacy notice.

Content

We have outlined the most important information concerning our typical data processing purposes and grouped it by the relevant parties.

The word ‘data’ in this document pertains solely to personal data in accordance with the data protection laws of the UK and the EU.

What you should know – Your data protection rights

You have the right to obtain confirmation as to whether or not personal data is processed by us, which category of data it is, as well as other information, such as the purpose of processing, the recipient or categories of recipient to whom the data has been or will be disclosed as well as the period for which the data will be stored, and other information outlined in Art. 45 of the UK GDPR

You have the right to demand we supply or correct any incorrect personal data (Right of access / Right of rectification).

You have the right to request the immediate erasure of personal data, or alternatively request a restriction of the processing of your personal data. (Right of erasure)

You have the right to receive all personal data with which you provided us in a structured, commonly used and machine-readable format as well as request the data be transmitted to another controller (Right of portability).

You have the right to withdraw your given consent at any time without cause, in perpetuity. When you withdraw your consent, we are no longer allowed to process any personal data to which use you formerly consented, in perpetuity. Please direct all permission withdrawal requests to dataprivacy-UK@gpj.com (Right of withdrawal).

In case we process your personal data based on our legitimate interests, you can object to their future use at any time on grounds relating to your particular situation. However, we may not always be able to comply, for example in case legal regulation requires us to process your data (Right to object).

In case your objection concerns direct marketing, you have a general right to object. In that case we will abide by your right to object without you having to make your case concerning special circumstance. Please direct all objections to dataprivacy-UK@gpj.com.

In addition, you have the right to enter a formal complaint with the responsible supervisory authority. The supervisory authority for GPJ is the British Information Commissioner’s Office. You can also contact your local regulatory body or that of your employer.

You can contact the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or online here.

Information regarding our typical data processing purposes, categorised by relevant parties.

Website visitors

When you visit our page featuring information about GPJ and their services, we only process the necessary data in order to display the website in its best possible form on your device. In principle, use of the website is possible without the usage of personal data.

Therefore, we claim processing ‘in principle’, because we process your IP address in the short term, in order to make it possible for you to view the website. The IP address, also called internet protocol address, symbolises a network location through which a web server or various devices can be addressed and reached. It takes two IP addresses – ours and yours – in order for the data packages (which make up our website) to be put back together on your side and are shown as the actual website.

Server protocol data

Description and extent

In order to meet your data request, our web server must know your IP address, or rather, ‘process’ it. Every time our site is accessed, our system automatically collates data and information about the operating system of your device. The following data is processed:

• information regarding your type of browser and which version you are running
• your operating system
• your internet service provider
• your IP address
• access time and location
• websites which access our website through your system
• websites which your system accesses from our website or services

This data is collated and saved automatically in a web protocol file called log file. This data is not linked to any personal data.

Purpose

Temporary storage of your data on our system is necessary in order to deliver our website packages to your device. This requires us to store your data for the length of your session on our servers.

Furthermore, processing your data in the log files is necessary in order to guarantee that our website functions properly. The data also helps us optimize our web offer, as well as ensuring the security of the information technology of our systems. Your data is not analysed for marketing purposes. This is the reason our interest in processing your data is legitimate.

Legal basis

The legal basis for the temporary storage of your data and creation of log files is our legitimate interest in ensuring the security of the information technology of our systems.

Storage

The data is erased as soon as it is no longer needed for these purposes. In the case of data collected in order to display the website this happens when the session is terminated.

Log files are deleted after a maximum of 14 days. Storage past that time frame is possible. In that case your IP address is deleted or scrambled, so that association with your device is no longer possible.

Objection and erasure options

The collection of data for the presentation of the website, as well as the processing of log file data, is mandatory for our online presence. Therefore, you cannot object to the processing of this data.

Strictly necessary cookies – functional cookies and performance cookies

We strive to provide you with an optimal and user-friendly visit to our website, as well as offer you individual and unique services, tailor-made for your needs. For this purpose, we use cookies, as well as tracking programs designed to analyse usage data. These provide us with insight and statistics which help us improve our online presence, our communication with you, and to make our services more attractive and relevant for you.

When you access our website, a so-called “cookie and consent banner” informs you about the use of cookies and refers you to this privacy notice. Below you will also find a note on how to prevent the storage of cookies in your browser settings. Cookies are text files that are stored by your browser on your device.

Description and scope

When you access one of our web pages, cookies are stored on your system. A cookie contains a unique set of symbols which enables us to clearly identify your unique browser the next time you access our website.

Purpose

The purpose of using strictly necessary cookies is to make the use of our website easier for you. Some of our website functions cannot be offered without the use of cookies. It is necessary to recognize your browser even after a page change. Cookies are required for providing language settings as well as the storage of search terms. The data processed by the strictly necessary cookies is not used to create user profiles.

The use of these cookies serves to improve the quality and content on our website. These cookies tell us how our website is used and how we can continually optimize the website. This is the reason our interest in processing your data is legitimate.

Legal basis

The legal basis for the processing of your data by using strictly necessary cookies as well as the collating and usage of performance analysis is our legitimate interest in improving the quality and content on our website.

Objection- and erasure options in your browser settings

Cookies are saved on your device and transmitted to us from there. Therefore you, as the user, have full control over the use of cookies. You can change the settings of your browser so that no cookies are stored on your device at all. For that you must change the applicable option in the system settings of your browser. This may cause various functions of our website to cease to function.

Below please find information regarding the settings of the most common browser types:

• Microsoft Edge
• Firefox
• Google Chrome
• Safari
• Opera
• In addition to these cookies, our website uses cookies which enable us to measure your online performance. We have activated IP-anonymizing on our websites and services. This data is not stored with your other data. Therefore, assignation of this data to your person is not readily possible.

Storage, objection and erasure options

You are the user, and you have full control over the use of cookies, since cookies are stored on your device and transmitted to us from there. Please consult our “cookies overview” for information about when which cookies are automatically deleted from your device. You can change the settings of your browser to deactivate or limit the use of cookies. Stored cookies can be deleted at any time. You can also change your settings via the cookie and consent banner.

If cookies are deactivated for our website, it may cause various functions of our website to cease to function.

Fonts –embeds

Description and scope

Embedded in our website is SwiftPic’s fonts inventory. SwiftPic is a ShareSpring, Inc. service. ShareSpring, Inc. is an U.S. based company. For accurate fonts display, communication between your device and the SwiftPic server is necessary in order for the server to load the requested fonts. Your data, for example your IP address – usually truncated -, type of browser and running version, your operating system, your internet service provider and date and time of access are solely used for the purpose of display. File requests go through the SwiftPic domains swiftpic.io.

Purpose

Embedding fonts via SwiftPic enables us to ensure our website’s high-quality display standards – specifically regarding short loading times and appealing visuals.

Legal basis

The transmission of data to SwiftPic is based on our legitimate interest concerning an optimized and efficient website display.

Storage duration and erasure

Data which is stored by SwiftPic cannot simply be deleted. Data is transmitted automatically to SwiftPic by accessing the site. You can contact SwiftPic in order to delete data ahead of schedule. In this case you can only prevent data storage by not accessing our site. You can find additional information concerning SwiftPic embedding here.

Marketing and analysis

If you consent to our use of marketing and analysis cookies and the use of similar technologies, we use the information garnered as described in the following paragraphs. Here, too, you retain full control over the use of cookies. You can set your browser accordingly or control the transmission of cookies via the privacy cockpit.

Google Universal Analytics – general information

We use Google Universal Analytics on our site. Google Universal Analytics is a service of Google Ireland Limited, based in Gordon House, Barrow Street, Dublin 4, in Ireland („Google”). We apply Google’s service by using “cookies”. Cookies are text files which are saved on your device and which enable usage analysis of our websites and services. The cookies’ collated information regarding your usage of our website and services is transmitted and stored on a Google server in Ireland. We have activated IP-anonymizing on our websites and services. Therefore, your IP address is truncated by Google. Only in rare exceptions is your IP address transmitted to a Google server in the USA.

Web analytics

We use data, which is collated by your Google Client ID, as well as other data generated by Google’s web analytics applications, in order to analyse your interactions with our services and websites. Additional information regarding Google’s operating procedures can be found here.

We have tasked Google with analysing your net usage data of our websites and services using web analytics, in order to generate reports about your activity on our website and to give us additional information regarding your usage of our website, as well as the internet usage of related services. Google Analytics’ Demographic and Interest Reporting for example gives us analyses relating to age, gender, and interests of our users. The IP address transmitted to Google Analytics in this process is not linked to other Google data.

You can prevent the storage of cookies through your browser settings.

You can prevent the acquisition and storage of cookies and the transmission of your usage data collated by our website and services to Google (including your IP address), as well as their processing by Google, by clicking on this link and installing the offered browser plugin.

The legal basis for the storage of Google Analytics cookies is based on your consent. They are stored for an unlimited period of time, unless you make use of your opt-out options.

Remarketing

We use the Google Analytics Remarketing functions in conjunction with the overarching device functions of Google DoubleClick. These functions enable us to connect the relevant advertising target groups determined by Google Analytics Remarketing with the overarching functions of Google DoubleClick. This way, personalized individual marketing messages, determined by your earlier usage and surfing habits on a particular device (i.e. your smartphone), can be displayed for you on a different device (i.e. your tablet or PC).

If you have given Google the corresponding consent, Google will connect your web and app browser history with your Google account. This way every single one of your devices can display the same personalized advertising messages. To support this function, Google Analytics stores your Google-authenticated ID, which is temporarily linked to our Google Analytics data, in order to identify and determine target groups for advertising messages across all devices.

You can prevent overarching remarketing and targeting permanently by deactivating personalized advertising in your Google account. Please use the following link.

The legal basis for the collating of garnered data in your Google account takes place solely based on your consent, which you can give to or withdraw or revoke from Google directly.

For data collection operations that are not merged into your Google account, for example, because you do not have a Google account or have opted out of the merge, the collection of the data is based on our legitimate interest. Our legitimate interest results from the fact that we have an interest in the anonymized analysis of website visitors for advertising purposes. Further information on this function used by us can be found in Google’s data protection information.

Google Tag Manager

We use Google Tag Manager in conjunction with marketing and analysis to manage the Google tools. This is a tag management system that allows us to quickly and easily update tracking codes and related code fragments, commonly known as “tags”, on our websites.

Here you can get an overview of Google’s data protection policies in connection with Google Universal Analytics as well as Google’s privacy policy.

The legal basis for the data processing is based on your consent. The data will be stored for an unlimited period of time, unless you make use of your opt-out options.

Lead Forensics

We use Lead Forensics on our Sites. Lead Forensics is a software as a service provided by LEAD FORENSICS Limited (“Lead Forensics”), whose registered office is at 3000 Lakeside Western Road, Portsmouth, England, PO6 3EN.

Lead Forensics provides an analytics and feedback tool that gives us an insight relating to the website visitors who access our sites from their corporate or business IP addresses. Lead Forensics works on the basis of reverse business IP tracking. A small tracking code is placed on our website which then enables us to identify the business IP addresses of our website visitors. It matches the identified business IP address to a global database of businesses and business information owned by Lead Forensics and allows us to contact potential customers. We have implemented a cookie alongside the code to enhance the tracking capabilities of the software.

This involves assigning you, as a visitor to our websites, a unique user identifier. Lead Forensics sets a cookie for this purpose. However, this only happens if you visit our pages from a registered company domain. If you visit us from a private IP, you are automatically filtered out. In this case, your IP address is only used for matching with the Lead Forensics domain database and then deleted. In this case, no cookie is set, and no unique user identification is assigned. The unique user identifier allows Lead Forensics to track returning users, but also ensures, that no data is processed that can directly identify you as an individual person. This means that relevant personally identifiable information is not transmitted to the Lead Forensics servers.

The data collected through Lead Forensics will be processed in England. The relevant storage period is a maximum of 365 days.

We use the Lead Forensics features because they serve our legitimate business interest in providing and improving our websites and optimising our sales activities. You can prevent us and Lead Forensics from processing your data (“opt-out”) by making the appropriate settings in your browser.

Social media buttons (recommendation buttons) – Facebook and Twitter

Recommendation buttons

We maintain a social media presence. It is part of our online media presence. Our aim is to inform and exchange information with interested parties in a target group-oriented manner. Social media enables us to establish electronic contact quickly and therefore to communicate directly via the media of your choice.

Recommendation buttons from Facebook and Twitter are integrated on our website. The links to these platforms are integrated in such a way that your data is only sent to the respective service when you click on the recommendation button (so-called Shariff solution).

We have no influence on what data is sent to Facebook (Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland) or Twitter (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland) after clicking on it. You use these platforms and their functions at your own risk. This applies in particular to the use of the interactive functions, such as commenting on, sharing or evaluating our contributions, as well as liking our company site. Most interactive functions are reserved for registered and logged in users.

Your rights

You are entitled to the following rights regarding the processing of your data: right of access; right of rectification; right to erasure; right to restriction of processing; right to object; right to data portability, and the right to complain about unlawful processing of your personal data to the relevant data protection authority.

We do not have full access to your personal data. Therefore, you should contact the provider of the respective platform(s) directly when making a claim. Providers have access to the personal data of their users and can take the appropriate measures as well as provide information. We are happy to support you if you need further assistance. Please contact dataprivacy-UK@gpj.com for this purpose.

Objection on Facebook

For a detailed presentation of respective data processing and the possibilities of objection (opt-out), we refer to the following linked information:

• Facebook Privacy Policy
• Facebook advertising cookies opt-out

Objection on Twitter

For a detailed presentation of respective data processing and the possibilities of objection (opt-out), we refer to the following linked information:

• Twitter privacy policy
• Opt-Out on Twitter

Shared responsibility – Joint Controllership

According to the case law of the European Court of Justice, we are jointly responsible controllers in the cases listed below.

Shared responsibility – joint controllership with Google

We use Google Universal Analytics on our site. We apply Google’s service by using “cookies”. Cookies are text files which are saved on your device and which enable usage analysis of our websites and services. The cookies’ collated information regarding your usage of our website and services is transmitted to Google. Google uses this information to analyse how you use our website and to provide us reports about your activity on our website and to give us additional information regarding your usage of our website, as well as the internet usage of related services. By applying Google’s Universal Analytics on our website, we are, together with Google responsible, and liable under data protection laws. Google Universal Analytics is a service of Google Ireland Limited, based in Gordon House, Barrow Street, Dublin 4, in Ireland („Google”). You can find more information about the joint controllership here.

Shared responsibility – joint controllership with Facebook

As the operator of a fan page on the social network Facebook, we are, together with the operator of this network, responsible, and liable under data protection laws. Facebook is a service which is operated by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland. When visiting our fan page, your personal data is processed by those responsible, i.e. by us and by Facebook.

Agreement with Facebook

We have an agreement with Facebook, which among other things regulates the conditions for the use of our respective fan page. Facebook’s terms of use and the other terms and guidelines listed at the end of this agreement are definitive.

Page Insights

In connection with the operation of our respective fan page, we use the Page Insights function to obtain user statistics. For this purpose, Facebook stores a cookie on the respective devices of registered users who visit our fan page. When you visit our fan page, Facebook stores the cookies listed on your device to enable us to statistically evaluate your visit. The information stored in the cookies is processed by Facebook, specifically when you (the user) visit the Facebook services and services provided by other companies using Facebook services. You can find more detailed information on the use of cookies by Facebook here, in their cookie policy.

In connection with statistical analysis, we use the filters provided to us by Facebook to specify the categories of data according to which Facebook provides us with anonymized statistics. The following criteria or categories are available to us in anonymized form for evaluating your activities on our Facebook page, provided that you as a user have provided the relevant information:

• Age range
• Gender
• Place of residence (city and country)
• Language
• Mobile or stationary page view (YouTube to include individual device types)
• Interactions in context with posts (e.g. reactions, comments, shares, clicks, views, video usage time)
• Time of use

Data sharing in the context of Facebook interactions

If you interact with our fan page during your visit, Facebook will also have access to your data. It is therefore also possible that Facebook Inc. at 1601 Willow Road in 94025 Menlo Park, California, i.e. in the USA, has access to your data. Facebook Inc. is located in a third country in which an adequate level of data protection is not ensured.

Shared responsibility – joint controllership with YouTube

We rely on the technical platform and services of YouTube, a Google company with headquarters at Gordon House, Barrow Street, Dublin 4, Ireland. If you are a resident of the UK or the European Economic Area or Switzerland, (unless otherwise specified in any additional terms), these services are provided by Google Ireland Limited (“Google”), a company incorporated and organised under the laws of Ireland.

In accordance with Google’s privacy policy, we assume that any transfer of personal data, including the processing thereof, will also be transferred to the servers of Google LLC in the USA.

In its ruling in case C-210/16, the European Court of Justice decided that platform operators (here: YouTube) and the channel operators located on the platform are jointly responsible for the data processing carried out via the respective channel. To this extent, platform operators and channel operators are to be regarded as jointly responsible parties or joint.

Shared responsibility – joint controllership with LinkedIn

With regard to the operation of our LinkedIn presence, we are jointly responsible with LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. When visiting our LinkedIn page, personal data is processed by the responsible parties. We operate our company page on LinkedIn to present ourselves to the public, in particular to provide users with information about our company, our products, services and employment opportunities, combined with the opportunity for users to interact with us directly.

In connection with the operation of our LinkedIn company page, we use the Page Insight function to obtain statistical data on users and the use of our company page. In connection with statistical analysis, we use the filters provided to us by LinkedIn to specify the categories of data according to which LinkedIn provides us with anonymized statistics. The following criteria or categories are available to us in anonymized form for evaluating your activities on our LinkedIn page, provided that you as a user have provided the relevant information:

• Location (place of work or residence)
• Type of profession
• Career stage
• Field/Industry
• Company size
• Age range
• Gender
• Language
• Mobile or stationary page view (YouTube to include individual device types)
• Interactions in context with posts (e.g. reactions, comments, shares, clicks, views, video usage time)
• Time of use

In order to be able to carry out the statistical evaluations, LinkedIn stores a cookie on your respective device. The cookie contains a unique user ID. The information stored in the cookie is processed by LinkedIn, specifically when you visit LinkedIn services and services provided by other companies that use LinkedIn services. The visitor statistics created are transmitted to us by LinkedIn exclusively in aggregated form. We do not have access to the data collected by LinkedIn. LinkedIn does not transmit any data to us that allows conclusions to be drawn about individual persons. For more information on the use of cookies by LinkedIn, please refer to their cookie policy.

The essence of the joint controller agreement is that users can assert their data subject rights directly against LinkedIn, and that no personal data of LinkedIn members is transferred to us. We only receive aggregated statistical data from LinkedIn. However, if our assistance in asserting data subject rights is required, please feel free to contact us at any time. For more information on data protection, please refer to LinkedIn’s privacy policy.

There is a possibility that your data may also be processed outside the UK or the European Union by LinkedIn Corporation in the USA. The LinkedIn Corporation was certified under the U.S.-EU Privacy Shield and has concluded standard contractual clauses. You can find more information here. We do not share any personal data ourselves.

Purpose of data processing

The first purpose of processing personal data in connection with our LinkedIn presence is to compile statistics on visitor flows. This allows us to better understand how users interact with our site and the products and services offered. It allows us to better design our company page and adapt our products and services to the needs of users. Furthermore, we process users’ personal data in order to be able to communicate with you directly via the media outlet of your choice.

Lawfulness of data processing

We operate our LinkedIn page in order to present ourselves to LinkedIn users who visit our company page and to communicate directly with them. The processing of your personal data is based on our legitimate interests in an optimized company and product presentation as well as in direct communication with LinkedIn users.

If we publish images of individuals, this is done primarily via consent or on the basis of a contractual agreement, and in exceptional cases on the basis of legitimate interests.

Objection and erasure

You have the right to object to processing on grounds relating to your particular situation at any time. You can exercise your right to object via the LinkedIn settings or the form to object to LinkedIn data processing. As a LinkedIn user, you can influence settings for advertising preferences, and thus also specify the extent to which your user behaviour may be recorded when visiting our LinkedIn page. You can find more information about the right to object here.

Shared responsibility – joint controllership with Instagram

We are responsible for the content on our Instagram company page. The Instagram service is a product provided by Facebook Ireland Limited (“Facebook”). As the operator of an Instagram company page, we are jointly responsible with the operator of the social network Facebook Ireland Ltd. When visiting our Instagram page, personal data is processed by the responsible parties.

Instagram is an online platform which enables the sharing of photos and videos. Users can edit photos and videos and add filters. Other users can in turn share these photos and videos, comment on them or mark them with a “Like”. Users can also get in touch with each other by writing private messages.

As the person responsible for this site, we have entered into various agreements with Facebook, which, among other things, regulate the conditions for use of the Instagram page.

There is a possibility that your data may also be processed outside the UK or the European Union by Facebook Inc. in the USA. We ourselves do not pass on any personal data.

The joint controller agreement with Facebook essentially means that you can assert your data subject rights directly against Facebook. However, should our assistance be required, please feel free to contact us at any time at dataprivacy-UK@gpj.com.

Provision of statistical evaluation – Instagram Insights

The Instagram page is a company page featuring the Instagram Insights function. This means that part of the data collected by Facebook during use is made available to us as a statistical evaluation in anonymized form. However, this statistical evaluation only relates to the audience, content and activity on our Instagram page. Specifically, the evaluation includes the following data:

• Number of “likes” of our photos and videos.
• Number of comments on our photos and videos
• Number of people who have seen a photo or video
• Number of times a photo or video was shared
• Number of times a photo or video was reported as spam
• Number of times a click indicated that the user no longer likes the page
• Age, gender, location, and language of visitors in aggregate form

This information transmitted to us by Facebook is anonymized and cannot be associated by us with your person. However, this does not necessarily mean that the data collection and data processing by Facebook itself is anonymized. For more information, please see the Instagram privacy policy.

Visibility of personal data for us, as well as other users

When using certain interactive functions on Instagram (e.g. the comment function or the “Like” button), comments or likes are visible to other users and to us as the provider of the Instagram page. Thus, a direct user assignment can be made based on the disclosed personal data.

We have no influence on interactive functionalities and visibility of comments, likes or other activities on our Instagram page. We are therefore not the responsible party in terms of data protection laws. The type, scope and duration of the processing and storage of personal data in this regard are determined by Facebook, so Facebook is ultimately responsible for this.

It is always possible to visit our Instagram page without leaving comments or clicking “Like”.

Please note that the interactive functions of Instagram are generally only possible after registration. Data relating to this may also be processed by Facebook but does not fall within our area of responsibility.

Contacting us via private message or comment

It is possible to contact us through our Instagram page either by private message or by comment. You can contact us with questions about us, our Instagram page, or other inquiries.

When you contact us, we are furnished with your username, your actual request and other personal data, if applicable. We have to store this data in order to be able to answer your inquiry. Comments are public and visible to all other Instagram users.

We delete the data generated in the course of your inquiry/contact six months after the last message. If there are legal storage obligations, the data will be stored for the duration of the legally required storage obligation. A public comment can only be deleted by you.

Purpose of data processing

The first purpose of processing personal data in connection with our Instagram presence is to compile statistics on visitor flows. This allows us to better understand how users interact with our site and the products and services presented. It allows us to better design our company page and adapt our products and services to the needs of users. Furthermore, we process users’ personal data in order to be able to communicate with you directly via media of your choice.

Lawfulness of data processing

We operate our Instagram page in order to present ourselves to Instagram users and to communicate directly with them. The processing of your personal data is based on our legitimate interests in an optimized company and product presentation as well as direct communication with Instagram users. This also corresponds to the reasonable expectations of the data subjects, as the communication is not initiated by us, but by them.

If we publish images of individuals, this is done primarily via consent or on the basis of a contractual agreement, and in exceptional cases on the basis of legitimate interests.

Objection and erasure

You have the right to object to data processing on grounds relating to special circumstances at any time. You can exercise your right to object via the Instagram/Facebook settings. If you wish to object to processing within our area of responsibility, you can contact us for this purpose.

Storage duration

Since we are merely operators of an Instagram page, limited personal data is transmitted to us as described above. The criteria specified by Instagram apply to the storage period, unless it is data that is generated in the context of your inquiry/contact. Inquiry/contact data will be deleted by us six months after the last message.

Web page videos

When we integrate videos on our websites they are stored on YouTube. YouTube is a platform offered by YouTube LLC, located at 901 Cherry Ave, San Bruno, CA 94066 in the USA. YouTube is a company affiliated with Google. We embed our videos via YouTube because local hosting is not powerful enough to display the videos.

When you click on one of our videos, a connection is established to YouTube in order to embed the video provided for you on our site. The integration of the video results in a call to the YouTube or Google servers for technical reasons. The servers are located in Ireland, in the EU. We have no influence on which data is transmitted to YouTube after clicking. Therefore, for the associated use of data from your browser or device, we refer you to the privacy notices of YouTube or Google, which you can find here.

You have the right to object to the processing of your personal data, but you must address the objection to YouTube and Google.

When you visit our website with an embedded YouTube video, YouTube receives information about the specific website you are visiting. In the process, your personal data is transmitted to YouTube as just described. Such transmission takes place regardless of whether you have logged into your YouTube account or whether you do not have a corresponding account at all. If you have logged into your YouTube account, your personal data will be assigned to your YouTube profile. If you do not want your personal data to be assigned to your profile, you should log out of your YouTube account before accessing one of our videos. YouTube and Google use this data for advertising, market research and/or a demand-based design of their website.

Google ReCaptcha

We use “Google reCAPTCHA” (hereafter “reCAPTCHA”) on our websites. reCAPTCHA is a service of Google Inc., business located at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). With reCAPTCHA, we check whether the data entry on our websites (e.g. in our contact form) is made by a human or by an automated program (a so-called BOT). For this purpose, reCAPTCHA analyzes the behavior of website visitors based on various characteristics. This analysis begins automatically as soon as a visitor accesses our website. For this analysis, reCAPTCHA evaluates various information points (e.g. IP address, time spent by each visitor on the website or mouse movements made by the user). The data collected during the analysis is forwarded to Google.

Purpose / Lawfulness

We have a legitimate interest in protecting our web offerings from abusive automated spying and from SPAM. You can find more information about Google reCAPTCHA here.

Newsletter subscribers

On our website, we offer a free newsletter subscription with information about services, digital consultancy and design.

General information

We need your email address in order to send you our newsletter. Otherwise we cannot provide you with the newsletter. Our newsletters are always personalized, i.e. we always address you personally. In order to address you personally in our newsletters and event invitations, we also need your first and last name.

Two-factor authentication („Double Opt-In“) of email addresses and proof of consent

If you subscribe to the newsletter distribution list, we will send you a link and ask you to confirm the registered e-mail address by means of the so-called double opt-in. In this way, we ensure that you have access to the specified e-mail account and that your e-mail address is correct.

Only after clicking on the confirmation link are you included in our distribution list.

In this case, we save your registration and confirmation time in order to log your registration and, if necessary, to be able to prove your e-mail verification or your consent.

The provision of this data is essential for the receipt of newsletters. Without the provision of this data, we cannot send you newsletters.

For the processing of this data, your consent is obtained, and reference is made to the data protection notice.

Analysis of page opening and click behaviour for success analysis

We analyze the dispatch and receipt of our newsletters in order to constantly optimize the content for you. For this purpose, we primarily record how many users open our newsletters and which articles are clicked on most often by the subscribers. For this purpose, the newsletters contain a small file, the so-called tracking pixel, which is retrieved from the sending server when the newsletter is opened. Upon retrieval we process the following data:

1. your e-mail address,
2. your traffic data, specifically your IP address, and
3. the time stamp.

This analysis of opening and clicking behaviour allows us to understand which content is of interest to you, so that we can adapt our mailings to your needs and interests.

By subscribing to our newsletter and clicking on the confirmation link, you expressly consent to us collecting your data as just described. Without this consent, you cannot use our newsletter subscription.

We will only use your data for internal evaluation purposes and will not pass it on to third parties.

Unsubscribe

You can prevent the sending of newsletters and thus the future analysis of opening and click behaviours at any time by unsubscribing from the newsletters. To do so, click on the unsubscribe button that you can find at the bottom of each newsletter. Alternatively, you can also contact dataprivacy-UK@gpj.com.

Purpose

We process your data for the purposes of sending personalized newsletters with content of interest to you, the recipient, to verify the accuracy of your email address and to prove your consent. A change of these purposes is not planned.

Lawfulness

We base the processing of your data in the context of sending newsletters on your consent.

The storage of your registration and confirmation time is based on our legitimate interest to be able to prove that you have subscribed to the distribution list for the sending of newsletters in the event of any legal disputes. With the double opt-in procedure, we also take your legitimate interest into account by ensuring that you have not been registered by unauthorized third parties.

The evaluation of your opening and clicking behaviour is based on your consent.

Erasure

Data that you have provided to receive the newsletter or data that can be traced back to you will be deleted upon unsubscription.

Third country transfer

We use the US newsletter provider Mailchimp to send our newsletters. Mailchimp is a brand of “The Rocket Science Group, LLC.”, with its registered office in Atlanta, Georgia, USA. Data is transferred to the USA. However, in order to ensure appropriate level of data protection for these data transfers, we have concluded the EU standard contractual clauses with Mailchimp. Mailchimp is obligated by means of an order processing agreement to process your data exclusively within the scope of our instructions and not for its own purposes.

Customers, business partners and their employees

If you are our customer or business partner or an employee of our customers or business partners, we process your data in order to establish and execute contractual relationships with you or with your company, as well as to fulfil legal requirements. As a customer or business partner or as an employee of our customers or business partners, you are required by law and by contract to provide us with the relevant data. Without the corresponding information, a customer or business relationship with us can neither be established nor carried out.

Purpose

We process your data for the establishment and implementation of business relationships. We do not anticipate any change of the aforementioned purposes.

Lawfulness

In the context of contracts with natural persons the legal basis for the processing is the preparation and execution of a contracts. For contracts with legal persons the legal basis is our legitimate interest in being able to communicate with contact persons relevant to the contract.

In the context of tax and commercial law regulations we are legally obliged to process your data. In the event of any examination, enforcement or dismissal of claims the legal basis for data processing is our legitimate interest, which is based on the enforcement of or defence against claims.

Forwarding

Primary recipients of your data for the purpose of processing payments are banks. Insofar as we are obligated or authorized to transmit data, public authorities and offices may be recipients of your data within the scope of their duties. In individual cases, your data may be transferred to collection service providers, lawyers and courts.

Storage

All data relevant to contracts and accounting are stored in accordance with the retention periods under tax and commercial law.

Interested parties and communication partners

If you contact us by calling us, sending us an e-mail, fax or letter, or by using the contact form provided on our website, we will process your data (name, e-mail address, message content) in order to process your request. The provision of data is necessary in order to process your request. Without providing data, communication is not possible.

Purpose

We process your data for the purposes of efficient and effective communication. We do not anticipate any change of the aforementioned purposes.

Lawfulness

The legal basis for the processing of your data is our legitimate interest in being able to communicate efficiently and effectively with interested parties and other communication partners. Furthermore, as the operator of this website, we are legally obliged to provide you with an effective means of contact.

Erasure

Inquiries and communications are erased automatically after a minimum period of six (6) calendar years from the end of the last company financial year they relate to.

Job applicants and employment relationships

If you apply for a job with us or for a position to be placed by us, we process your personal data (so-called application data) in principle only insofar as this is necessary for the decision regarding the establishment of an employment relationship with you. The provision of data is required for applicants. It is not possible to submit an application without providing data.

Only persons authorized to make decisions will have access to your application data. As a rule, these are members of the respective management and team leads.

We ask you to upload your application documents exclusively via our website.

Purpose

The processing of your application data serves the purpose of deciding on the establishment of an employment relationship. A change of this purpose is not intended or planned.

Lawfulness

The processing is therefore carried out in the context of pre-contractual measures for an employment relationship sought with the application.

Erasure and storage

In the case of advertised positions, your personal application data will be deleted – irrespective of the outcome of your application – after six (6) months have elapsed following a decision on filling the position.

After a possible rejection, you have the option to consent to a storage period exceeding the aforementioned erasure period of six (6) months, provided that you are also interested in other positions and thus to be included in our talent pool.

If you give us such consent, we will retain your application data for a period of one (1) additional year, provided that you apply for a position with us. In this case, you may revoke your consent at any time. If you apply for a position to be placed by us, we will retain your documents until you revoke your consent. If you revoke your consent, your application data will be deleted accordingly. The legal basis for processing beyond the usual retention period is your consent.

If you submit an unsolicited application, we will consider this as your consent to be included in our talent pool and will retain your application data for a period of one (1) year if you apply for a position with us, unless you clearly inform us in your application that you do not want this. If you apply to be included in the talent pool as part of the placement process, we will retain your records until you withdraw your consent.

In any case, you can revoke your consent at any time without cause.

Transfer to third countries

We use cloud-based software as part of our recruitment services. The software providers are obligated by means of an agreement on commissioned processing and, (due to the fact that third country-transfers cannot be ruled out), they are additionally bound by EU standard contractual clauses to process your data exclusively within the scope of our instructions and not for their own purposes. The services of the providers enable us to process and manage the applicant data in a uniform and, data-saving manner.

Our service providers

We use service providers for the provision of services, in particular for the provision, maintenance and care of IT systems. Our service providers process your personal data on our behalf and according to our instructions within the UK or the European Union (EU), unless we have explicitly described otherwise in this privacy notice.

We have concluded the EU standard contractual clauses with non-European providers. We point out that these providers thereby agree to comply with the data protection standards of the EU, so that there is an appropriate level of protection for your personal data under data protection law.

Last modified on July 12, 2021