Privacy - Klinik Sanssouci Potsdam near Berlin (Germany)

Privacy Policy

We take the protection of your personal data very seriously and strictly comply with all applicable statutory and regulatory data protection requirements.

We treat your personal data confidentially and process it in accordance with the applicable data protection legislation and this Privacy Policy.

Data Controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other applicable national data protection laws of the Member States, and other data protection provisions is:

Klinik Sanssouci Potsdam GmbH
Helene-Lange-Straße 13
14469 Potsdam
Germany

Telephone: +49 (0)331 28087-0

Represented by the Managing Director:
Mathias Mielke, M.Sc., MBA

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses or similar information).

Data Protection Officer

kraussfirmengruppe GmbH & Co. KG
Haldenloh E 10
86465 Welden
Germany

Telephone: +49 8293 95080-0
Fax: +49 8293 95080-29
Email: info@kraussfirmengruppe.de

Website: kraussfirmengruppe.de

Legal Basis for Processing

Where we obtain your consent for a specific processing activity, the legal basis for processing your personal data is Article 6(1)(a) GDPR.

Where the processing of personal data is necessary for the performance of a contract to which you are a party—for example, where processing is required for the delivery of goods or the provision of services—the processing is based on Article 6(1)(b) GDPR. The same applies where processing is necessary in order to take steps at your request prior to entering into a contract, such as responding to enquiries regarding our products or services.

Where we are subject to a legal obligation requiring the processing of personal data, for example to comply with tax or other statutory obligations, the processing is based on Article 6(1)(c) GDPR.

In rare cases, the processing of personal data may be necessary in order to protect the vital interests of the data subject or another natural person. In such cases, the legal basis is Article 6(1)(d) GDPR.

Processing may also be based on Article 6(1)(f) GDPR where it is necessary for the purposes of the legitimate interests pursued by our company or by a third party, provided that such interests are not overridden by your interests or your fundamental rights and freedoms requiring the protection of personal data.

Disclosure of Data

Your personal data will not be transferred to third parties for purposes other than those listed below.

We only disclose your personal data if:

you have given your explicit consent in accordance with Article 6(1)(a) GDPR;
disclosure is necessary pursuant to Article 6(1)(f) GDPR for the establishment, exercise or defence of legal claims, provided there is no reason to assume that you have an overriding legitimate interest in preventing such disclosure;
disclosure is required by law pursuant to Article 6(1)(c) GDPR; or
disclosure is legally permissible and necessary pursuant to Article 6(1)(b) GDPR for the performance of a contract with you.

Rights of Data Subjects

Under the GDPR, you have the following rights:

Right of access (Article 15 GDPR): You have the right to obtain information about the personal data we process concerning you. This includes information about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of the right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data where it was not collected directly from you, and the existence of automated decision-making, including profiling, together with meaningful information about the logic involved.
Right to rectification (Article 16 GDPR): You have the right to request the immediate correction of inaccurate personal data concerning you or the completion of incomplete personal data stored by us.
Right to erasure (Article 17 GDPR): You have the right to request the deletion of your personal data stored by us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.
Right to restriction of processing (Article 18 GDPR): You have the right to request restriction of the processing of your personal data if you contest the accuracy of the data, if the processing is unlawful but you oppose its erasure, if we no longer need the data but you require it for the establishment, exercise or defence of legal claims, or if you have objected to processing pursuant to Article 21 GDPR.
Right to data portability (Article 20 GDPR): You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller.
Right not to be subject to automated decision-making (Article 22 GDPR): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
Right to withdraw consent (Article 7(3) GDPR): You may withdraw any consent you have previously given at any time with effect for the future. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint (Article 77 GDPR): Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or the place of the alleged infringement.

Competent Supervisory Authority

State Commissioner for Data Protection and the Right of Access to Files
Dagmar Hartge

Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany

Telephone: +49 33203 356-0
Fax: +49 33203 356-49
Email: Poststelle@LDA.Brandenburg.de

Cookies

Our website uses so-called cookies in part. Cookies do not cause any damage to your device and do not contain viruses. Cookies serve to make our website more user-friendly, effective and secure. Cookies are small text files that are stored on your device and saved by your browser.

Most of the cookies we use are so-called “session cookies”. They are automatically deleted at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies enable us to recognise your browser when you next visit our website.

You can configure your browser so that you are informed whenever cookies are set and allow cookies only in individual cases, exclude the acceptance of cookies for specific cases or in general, and activate the automatic deletion of cookies when closing your browser.

Please note that disabling cookies may limit the functionality of this website.

Server Log Files (General Collection of Data)

Each time this website is accessed, data and information are automatically collected by our systems. These data are stored in the server log files for a period of six weeks.

The following data may be collected:

Browser type and browser version
Operating system used
Internet service provider
IP address
Date and time of the server request
Websites from which your system accesses our website
Websites accessed by your system via our website

The processing of these data serves to deliver the content of our website, ensure the functionality of our information technology systems, and optimise our website.

The data contained in the server log files are always stored separately from any other personal data of the user.

We reserve the right to review these data retrospectively if we become aware of specific indications of unlawful use.

External Hosting

This website is hosted by an external service provider. The personal data collected on this website are stored on the servers of the hosting provider(s). This may include, in particular, IP addresses, contact requests, metadata and communication data, contract data, contact details, names, website access data and other data generated through a website.

External hosting is carried out for the purpose of fulfilling contractual obligations towards our prospective and existing customers (Article 6(1)(b) GDPR) and in the interest of providing our online services securely, efficiently and reliably through a professional hosting provider (Article 6(1)(f) GDPR).

Where corresponding consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR, insofar as such consent includes the storage of cookies or access to information stored on the user’s device (e.g. device fingerprinting). Consent may be withdrawn at any time with effect for the future.

Our hosting provider will process your personal data only to the extent necessary to fulfil its contractual obligations and will act solely in accordance with our instructions regarding such data.

We use the following hosting provider:

IONOS Group SE
Elgendorfer Straße 57
56410 Montabaur
Germany

Telephone: +49 721 170 5522

Email: info@ionos-group.com

Data Processing Agreement

We have concluded a Data Processing Agreement (DPA) with the above-mentioned service provider.

This is a contract required under data protection law to ensure that the service provider processes the personal data of our website visitors solely on our behalf, in accordance with our instructions and in compliance with the GDPR.

Links to Other Websites

Our website and/or app may, from time to time, contain links to third-party websites or to other websites operated by us.

If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we accept no responsibility or liability for those policies.

Please review the applicable privacy policies before submitting any personal data to those websites.

References to Third-Party Websites

This website contains references to third-party websites in the form of hyperlinks.

Links to third-party websites are identified accordingly. Personal data are transferred to the destination website only after you click on such a link. This is technically necessary.

The data transferred include, in particular:

your IP address;
the time at which you clicked the link;
the page on which you clicked the link; and
information about your internet browser.

If you do not wish these data to be transmitted to the destination website, please do not click on the respective link.

Objection to Promotional Emails

The use of contact details published as part of our legal notice obligations for the purpose of sending unsolicited advertising or informational material is hereby expressly prohibited.

We expressly reserve the right to take legal action in the event of the unsolicited sending of advertising material, including spam emails.

Contact by Email, Telephone or Fax

If you contact us by email, telephone or fax, your enquiry, including all personal data arising from it (e.g. your name and the content of your enquiry), will be stored and processed by us for the purpose of handling your request.

We will not disclose these data without your consent.

Contact Forms

If you submit enquiries to us via a contact form, the information you provide in the contact form, including the contact details you enter, will be stored and processed for the purpose of handling your enquiry and any subsequent questions.

Your data will be used exclusively for the purpose of responding to and processing your enquiry.

The processing of your data is carried out on the basis of your voluntarily given consent in accordance with Article 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future.

Processing of Applicant Data

We offer you the opportunity to apply for positions with our company (e.g. by email, post or via our online application form). In the following, we inform you about the scope, purpose and use of the personal data collected during the application process.

We assure you that the collection, processing and use of your data are carried out in accordance with the applicable data protection legislation and all other statutory provisions and that your data are treated in strict confidence.

Scope and Purpose of Data Collection

If you submit an application to us, we process the personal data associated with your application (e.g. contact and communication data, application documents, notes taken during interviews, etc.) to the extent necessary for deciding whether to establish an employment relationship.

The legal basis for this processing is Section 26 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) (initiation of an employment relationship), Article 6(1)(b) GDPR (pre-contractual measures) and—where you have given your consent—Article 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future.

Within our company, your personal data will only be made available to those persons who are involved in processing your application.

If your application is successful, the data you have submitted will be stored in our data processing systems on the basis of Section 26 BDSG and Article 6(1)(b) GDPR for the purpose of implementing the employment relationship.

Data Retention Period

If we are unable to offer you a position, if you decline a job offer or if you withdraw your application, we reserve the right to retain the data you have submitted on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR for up to six months following the conclusion of the application process (rejection or withdrawal of the application).

After this period, the data will be deleted and any physical application documents will be destroyed.

The retention of the data serves, in particular, as evidence in the event of legal proceedings.

Where it is apparent that the data will continue to be required after expiry of the six-month retention period (e.g. due to pending or anticipated legal proceedings), deletion will take place only once the purpose for the extended retention no longer applies.

A longer retention period may also apply where you have given your consent pursuant to Article 6(1)(a) GDPR or where statutory retention obligations prevent deletion.

Inclusion in the Applicant Pool

If we are unable to offer you a position, you may be offered the opportunity to be included in our applicant pool.

If you are included in the applicant pool, all documents and information from your application will be transferred to the applicant pool so that we may contact you should a suitable vacancy arise.

Inclusion in the applicant pool takes place solely on the basis of your explicit consent pursuant to Article 6(1)(a) GDPR.

Giving your consent is voluntary and is not related to the ongoing application process.

You may withdraw your consent at any time. In this case, your data will be permanently deleted from the applicant pool unless statutory retention obligations require otherwise.

The data stored in the applicant pool will be permanently deleted no later than two years after your consent has been given.

In addition, your application data may be disclosed to processors pursuant to Article 28 GDPR.

The following processor has been engaged for the application process:

coveto ATS GmbH
Alois-Thums-Straße 11
63667 Nidda
Germany

Cloudflare

We use the service “Cloudflare” on our website to improve security, performance and reliability. The provider is Cloudflare, Inc. (“Cloudflare”), 101 Townsend St., San Francisco, CA 94107, USA.

The legal basis for the use of Cloudflare is our legitimate interest pursuant to Article 6(1)(f) GDPR in improving the performance of our website, enhancing security and protecting our website against malicious attacks.

The data processed by Cloudflare include your IP address, browser and device information, the time and location of your visit, information about your interaction with the website, and Cloudflare may set cookies.

The purpose of the data processing is to improve website security, optimise performance and protect against malicious traffic.

Cloudflare states that log files are stored for up to 12 months by default. This information can be found in Cloudflare’s Privacy Policy under the section “Data Retention”.

It cannot be ruled out that personal data may be transferred to third countries where an adequate level of data protection cannot be guaranteed. Cloudflare is certified under the EU–US Data Privacy Framework, which governs the secure processing of personal data of EU citizens in the United States.

We have concluded a Data Processing Agreement (DPA) with Cloudflare to ensure that personal data are processed solely in accordance with our instructions and in compliance with the GDPR.

Further information on Cloudflare’s privacy policy is available at:
https://www.cloudflare.com/privacypolicy/

Information about the cookies used is available at:
https://www.cloudflare.com/cookie-policy/

CookieYes

We use the service “CookieYes” on our website to manage and display the cookie consent banner. The provider is CookieYes Limited (“CookieYes”), 3rd Floor, 86–90 Paul Street, London, England, EC2A 4NE.

The legal basis for the use of CookieYes is compliance with a legal obligation pursuant to Article 6(1)(c) GDPR.

The data processed by CookieYes include your IP address, your consent preferences and information about the cookies stored on your device. The service uses cookies to store your consent status.

The purpose of the data processing is to manage users’ cookie consent and to document and display the use of cookies in accordance with the applicable legal requirements.

Further information on CookieYes’ privacy policy is available at:
https://www.webtoffee.com/privacy-policy/

Information about the cookies used is available at:
https://www.cookielawinfo.com/cookie-policy/

Google Fonts

We use the service “Google Fonts” on our website to integrate external fonts for an improved visual presentation. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

The legal basis for the use of Google Fonts is your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

The data processed by Google Fonts include your IP address, browser and device information, as well as the time of the request.

The purpose of the data processing is the optimised and consistent display of fonts on the website.

It cannot be ruled out that personal data may be transferred to third countries where an adequate level of data protection cannot be guaranteed. Google is certified under the EU–US Data Privacy Framework, which governs the secure processing of personal data of EU citizens in the United States.

Further information on Google Fonts’ privacy policy is available at:
https://policies.google.com/privacy

Information about the cookies used is available at:
https://policies.google.com/technologies/cookies

You can prevent the processing of your data by following this link:
https://policies.google.com/privacy#infochoices

Google reCAPTCHA

We use the service “Google reCAPTCHA” on our website to protect against spam and automated misuse. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

The legal basis for the use of Google reCAPTCHA is your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

The data processed by Google reCAPTCHA include your IP address, browser information, operating system, cookies set by Google and user interactions required to distinguish humans from bots.

The purpose of the data processing is to verify user interactions and protect the website against spam and misuse.

It cannot be ruled out that personal data may be transferred to third countries where an adequate level of data protection cannot be guaranteed.

We have concluded a Data Processing Agreement (DPA) with Google to ensure that personal data are processed solely in accordance with our instructions and in compliance with the GDPR.

Google is certified under the EU–US Data Privacy Framework, which governs the secure processing of personal data of EU citizens in the United States.

Withgoogle Websites

We use the “Withgoogle Websites” service on our website to create and manage web content. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

The legal basis for the use of Withgoogle Websites is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

The data processed by Withgoogle Websites includes your IP address, device information, browser type and information about your interaction with the website. Cookies may also be placed to improve the user experience and analyse website usage.

The purpose of the data processing is to provide services for the creation, hosting and management of websites, enabling users to create and manage their own websites.

It cannot be ruled out that personal data may be transferred to third countries where an adequate level of data protection cannot be guaranteed (USA), where the level of data protection may be lower than within the European Union. Google is certified under the EU-US Data Privacy Framework, which provides a recognised basis for the secure processing of data of EU citizens in the USA. We have entered into a Data Processing Agreement (DPA) with Google, ensuring that personal data is processed only in accordance with our instructions and in compliance with the GDPR.

Further information on Withgoogle’s privacy policy can be found at:
https://policies.google.com/privacy

YouTube

We use the video service “YouTube” on our website. The provider of the service is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

The legal basis for the use of YouTube is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

Google collects and processes your IP address, browser and operating system information and location data. In addition, actions such as watching videos or creating playlists are processed. Cookies are also placed in this context. YouTube integrates further Google services, such as Google Fonts, Google Photos and Google Ads (formerly DoubleClick).

If you are logged into a Google account, this data may be associated with your user profile. Your usage behaviour may be recorded and analysed for advertising purposes.

The purpose of the data processing is to provide video content and integrate it into our website.

According to Google’s privacy policy, the retention period for data processed by YouTube varies depending on the type of data and user settings. By default, activity data (such as watched videos, search history, etc.) for new accounts or users who have not previously specified a retention period is automatically deleted after 36 months (3 years). Users can manually set the retention period to 3 months or 18 months, or choose to retain the data indefinitely. Detailed information can be found at:
https://policies.google.com/privacy?hl=en#inforetaining

Further information on YouTube’s privacy policy can be found at:
https://policies.google.com/privacy

Information on the cookies used can be found at:
https://policies.google.com/technologies/cookies

You can prevent the processing of your data by clicking on this link:
https://myaccount.google.com/data-and-privacy

Plausible Analytics

We use the “Plausible Analytics” service on our website to analyse visitor statistics in a privacy-friendly manner. The provider is Plausible Insights OÜ (“Plausible”), Västriku tn 2, 50403 Tartu, Estonia.

The legal basis for the use of Plausible is our legitimate interest pursuant to Art. 6(1)(f) GDPR in analysing and optimising our website by understanding visitor behaviour and improving the user experience while protecting users’ privacy.

The data processed by Plausible Analytics includes page URLs, HTTP referrer information, browser information, operating system, device type and country. Plausible does not use cookies or collect IP addresses.

The purpose of the data processing is the privacy-friendly statistical analysis of website usage and visitor behaviour without collecting personal data or creating identifiable user profiles.

Further information on Plausible’s privacy policy can be found at:
https://plausible.io/data-policy

jsDelivr

We use the “jsDelivr” service on our website to provide and optimise static content such as JavaScript libraries and CSS files. The provider is Volentio JSD Limited (“Volentio”), Suite 2a1, Northside House, Mount Pleasant, Barnet, England, EN4 9EB, United Kingdom.

The legal basis for the use of jsDelivr is our legitimate interest pursuant to Art. 6(1)(f) GDPR in ensuring the fast and reliable provision of website resources and improving the performance and user experience of our website.

The data processed by jsDelivr includes your IP address, browser type, operating system and request details such as the time of the request and the requested content. jsDelivr does not use cookies.

The purpose of the data processing is the efficient provision of website resources, such as JavaScript libraries, via a Content Delivery Network (CDN).

Further information on jsDelivr’s privacy policy can be found at:
https://www.jsdelivr.com/terms/privacy-policy

coveto

We use the “coveto” service on our website to advertise vacancies and manage and process applications. The provider is coveto ATS GmbH, Alois-Thums-Straße 11, 63667 Nidda, Germany.

The legal basis for the use of coveto in the careers section of our website is our legitimate interest pursuant to Art. 6(1)(f) GDPR in attracting potential applicants.

If you apply for a position with us, we process your personal data on the basis of Art. 6(1)(b) GDPR in connection with pre-contractual measures. If your data is required after completion of the recruitment process to defend against legal claims, processing is carried out on the basis of our legitimate interest in fulfilling our obligation to provide evidence pursuant to Art. 6(1)(f) GDPR, for example in connection with equal treatment legislation.

The purposes of the processing are advertising vacancies, managing your application, assessing your suitability for the position and contacting you in connection with your application or possible alternative positions.

The data processed by coveto includes personal identification data, contact details, employment-related information, application documents and usage data. Cookies may also be placed to improve the user experience and for analysis purposes.

We delete your data after six months. If you have consented to being included in our applicant pool, we delete your data after two years. If your application results in an employment relationship, we store your data for the duration of your employment with us.

Further information on coveto’s privacy policy can be found at:
https://www.coveto.de/datenschutz

Google (Google Ireland Limited)

We use Google services on our website (e.g. for integrating web content, libraries or fonts, such as Google Fonts or Google APIs) to improve the presentation, stability, functionality and performance of our website. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

The legal basis for the use of Google services is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

The data processed by Google may include, in particular, your IP address, technical device and browser information, usage data (e.g. accessed content, time of access, referrer URL) and, where applicable, cookie or identifier data. Depending on the Google service integrated, further categories of data may also be affected.

If you are logged into a Google account, the data processed by the respective Google service may be associated with your user profile.

The purpose of the data processing is to provide and optimise the integrated functions (e.g. loading external resources, improving loading times, ensuring consistent presentation and technical security).

It cannot be ruled out that personal data may be transferred to third countries (in particular the USA) where an adequate level of data protection cannot be guaranteed. We have entered into a Data Processing Agreement (DPA) with Google, ensuring that personal data is processed only in accordance with our instructions and in compliance with the GDPR. Google is also certified under the EU-US Data Privacy Framework, which provides a recognised basis for the processing of data of EU citizens in the USA.

Further information on Google’s privacy policy can be found at:
https://policies.google.com/privacy#infocollect

TLS Encryption

This website uses TLS encryption in accordance with current standards for the transmission of data from your browser to our server and to servers providing files that we integrate into our website.

TLS ensures that data is transmitted in encrypted form. The data cannot be altered during transmission and the sender can be authenticated.

You can recognise TLS encryption by the “https” prefix displayed before the website address in your browser.

Security Notice

We protect our website and other IT systems against loss, destruction, unauthorised access, unauthorised modification or unauthorised disclosure of your data through appropriate technical and organisational measures. However, despite all due care, complete protection against all risks cannot always be guaranteed.

As complete data security cannot be guaranteed when communicating by email, we recommend using postal mail for transmitting confidential information.

Amendments to this Privacy Policy

We reserve the right to amend this privacy policy if the legal situation, this online service or the manner in which data is collected changes.

However, this applies only to statements regarding data processing. If your consent is required or if parts of this privacy policy contain provisions governing the contractual relationship with users, amendments to this privacy policy will only be made with the users’ consent.