Data protection declaration

The following provides information about the collection of personal data when using our website and about the functions provided by it. Personal data is all data that relates to you personally, e.g. name, address, email address, user behaviour.

1. Name and contact details for the person responsible for processing and for the company's data protection officer

Responsible person according to Art. 4 (7) General Data Protection Regulation (GDRP) is:

api GmbH
Robert-Koch-Straße 7-17
52499 Baesweiler

Email: info@api.de
Tel: 0241 / 9170-0

The company data protection officer can be contacted at the above address, for the attention of: Data Protection Officer, or at dsb@api.de.

2 Collection and storage of personal data as well as the type and purpose and use

a. When visiting the website

When using the website "https://www.api.de" for information purposes only, i.e. if you do not register or otherwise provide us with information, the browser used on your device automatically sends information to our website’s server. This information is stored temporarily in a so-called logfile. The following information is recorded without your involvement and is stored until its automatic deletion:

• IP address of the querying computer;
• date and time of access,
• time-zone difference from Greenwich Mean Time (GMT),
• name and URL of the called-up file,
• access status/HTTP status code,
• respective data quantity transmitted,
• website, from which the access was made (referrer URL), browser used,
• operating system of your computer and its user interface,
• name of the access provider, and
• language and version of the browser software.

The stated data is processed by us for the following purposes:

• to guarantee a smooth establishment of the connection to the website,
• to guarantee a convenient use of our website,
• evaluation of the system security and stability, and
• for other administrative purposes.

The legal basis for the data processing is Art. 6 (1) sent. 1 lit. f GDPR. Our legitimate interest derives from the data collection purposes listed above. We never use the collected data for the purpose of drawing conclusions about your person.

In addition, when visiting our website we use cookies and analysis services. We differentiate here between technically necessary cookies and those used for statistical recording and optimisation. The latter are only used if you consent to their use. More information about these is available under No. 4 and 5 of this Data Protection Declaration.

b. When registering for our newsletter

Provided you have expressly consented according to Art. 6 (1) sent. 1 lit. a GDPR, we use your email address to regularly send you our newsletter. Entering an email address is sufficient to receive the newsletter. Providing additional, separately marked data is voluntary and is used to address you personally.

The newsletter is sent by CONTINUE Software GmbH, Grüner Weg 19b, 52070 Aachen, Germany. The newsletters of CONTINUE Software GmbH contain so-called tracking pixels. A tracking pixel is a miniature graphic that is embedded in these emails, which are sent in HTML format, in order to facilitate the logfile recording and logfile analysis. This allows a statistical evaluation of the success or failure of online marketing campaigns to be performed. Based on the embedded tracking pixel, CONTINUE Software GmbH can recognise whether and when an email was opened by a data subject and which links in the email were accessed by the data subject.

Such personal data collected via the tracking pixels contained in the newsletters is stored and evaluated in order to optimise the sending of newsletters and to adapt the content of future newsletters even better to the interests of the data subject. This personal data is not forwarded to third parties. Data subjects reserve the right at all times to revoke the separate declaration of consent given in this regard via the double opt-in procedure. After cancellation, this personal data will be deleted for further processing by the responsible person. Unsubscribing from the newsletter is considered cancellation.

You can unsubscribe at any time, for example via a link at the end of each newsletter Alternatively, you can also unsubscribe at any time on the /newsletter.php page.

c. When using our contact form

If you have any questions, we offer you the option to contact us using the form provided on the website. In addition to the enquiry itself, it is necessary to provide a valid email address and a subject so that we know who sent the enquiry and can assign and respond to it. Additional details can be provided voluntarily.

Data processing for the purpose of contacting us is performed in accordance with Art. 6 (1) sent. 1 lit. a GDPR on the basis of your voluntarily granted consent.

The personal data collected by us for the use of the contact form is automatically deleted after your enquiry has been processed.

d. When using our online shop, including registration with it

You have the possibility to register via our website as a customer. For registration, required mandatory information is marked separately, other details are voluntary. We process the you provided by you to manage your registration. The legal basis for this is Art. 6 (1) sent. 1 lit. b GDPR.

If you are a registered customer, you can place orders via our online shop. We process the data you provide in order to manage your order. The legal basis for this is Art. 6 (1) sent. 1 lit. b GDPR.

Moreover, we refer to our separate data protection information provided by us as part of the registration.

e. Use of the online applicant portal

(1) You can access our online application portal via our website, which is operated in a technical respect by our service provider Softgarden e-recruiting GmbH, Tauentzienstraße 14, 10789 Berlin, Germany (hereinafter: Softgarden). Softgarden only provides software and computing capacity and does not influence the application process. This involves order processing pursuant to Art. 28 GDPR.

(2) The online application portal is operated with so-called widgets provided by Softgarden. These processing windows of the online application portal establish a direct technical connection to Softgarden as soon as you call up these sites. As a result, automatic data transmission to Softgarden takes place via your internet browser for technical operating and maintenance purposes. The following information is stored by Softgarden:

• Date and time of access
• Browser type and browser version
• Operating system used
• URL of the previously visited website
• Quantity the sent data
• IP address of access

(3) This data is stored by Softgarden exclusively for technical reasons and is not assigned to a specific person at any time. The legal basis for this is Art. 6 (1) sent. 1 lit. f GDPR. Softgarden is contractually obliged to take technical and organisational measures in order to protect your personal data. This means that your data is stored in a secure operating environment that is not accessible to the public. Your data is encrypted for transmission by so-called Transport Layer Security (TLS). This means that the communication between your computer and the data servers used takes place using a recognised encryption method.

(4) In the application process we process personal data that you send us, e.g.:

• Personal data (first name and last name, date of birth, address, level of education)
• Contact details (telephone no., mobile phone no., fax no., email address)
• Information about education (school, professional education, civil/military service, degree, doctorate)
• Information about previous career, training and work certificates
• Information about other qualifications (e.g. language skills, PC skills, voluntary work)
• Application photograph
• Information about the desired salary

(5) We process the personal data provided by you exclusively for the purpose of carrying out the application process for the advertised position and any subsequent employment relationship that may result. The legal basis for this is Art. 6 (1) sent. 1 lit b) GDPR.

(6) The provision of personal data is necessary in order to achieve the stated purposes and is an essential part of pre-contractual and, if applicable, subsequent contractual obligations towards us. Failure to provide personal data may mean that the application process cannot be started or has to be cancelled and it is possible that your application may then not be considered further. In the event that an employment relationship is entered into at a later date, failure to provide contractually necessary data could lead to consequences under labour law, including dismissal.

(7) If we also receive and process personal data on the basis of a declaration of consent given by you, you have the right to revoke your consent at any time for the future without giving reasons. To this extent, the legal basis for this is Art. 6 (1) sent. 1 lit a) GDPR. The lawfulness of the processing performed before revocation of the consent shall remain unaffected.

(8) Our recipients of the personal data are the individuals involved with the application process and any subsequently resulting employment relationship. These are required to keep your data confidential. We do not forward your personal data to third parties unless you have consented to the transfer of data (legal basis Art. 6 (1) sent. 1 a) GDPR) or if we are required to forward data due to legal provisions or official or court orders.

(9) To apply for a job advertised by us, it is not necessary for you to be a Softgarden customer and have a registered user account with www.softgarden.de. However, we offer the option of registering with Softgarden during the online application process and opening a user account there. Registered users of Softgarden can, for example, manage their application directly in the Softgarden portal and thus also access the other Softgarden services at any time. Registered Softgarden users can upload application documents stored with Softgarden to us for the online application processes. The corresponding button with which a connection to the Softgarden portal can be established is included in the online application form.

(10) If you use the services offered via www.softgarden.de as a registered customer of Softgarden, Softgarden is responsible for all personal data processing within this customer relationship. In this case, Softgarden's data protection conditions apply, which can be found at: www.softgarden.de/unternehmen/datenschutzbestimmungen-sg-network

(11) You are referred to these when registering with Softgarden.

(12) If we do not hire you, your personal data is deleted after a period of 6 months from the application date. This does not apply if statutory provisions prevent deletion, if further storage is necessary for the purpose of providing evidence or if you have expressly consented to longer storage until cancellation. The latter may be the case, for example, if you declare to us that we may store your application for an indefinite period after an application procedure has been completed in order to be able to contact you for further job offers that match your applicant profile (talent pool). For this purpose, we would approach you in due course with an appropriately prepared declaration and ask for your consent. If we employ you, your personal data will be stored and processed for the purposes of the employment relationship that then begins (legal basis Art. 6 (1) sent 1 b) GDPR).

f. When using other functions and offers of our website

(1) In addition to the purely informational use of our website, the newsletter and the contact form, we offer various services that you can use if you are interested. To do so, you generally have to provide additional personal data that we require and use in order to provide the respective service.

(2) Sometimes we engage external service providers to process your data. They have been carefully selected and engaged by us, are bound by our instructions and are regularly checked.

(3) We may also forward your personal data to third parties if we offer participation in promotions, competitions, contracts or similar services together with partners. You will receive more detailed information on this when you provide your personal data or below in the description of the offer.

(4) If our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you of the consequences of this fact in the description of the offer.

(5) If you have granted your consent to the processing of your data when using other functions and offers on our website, you can revoke this consent at any time. This revocation shall affect the permissibility of the processing of your personal data after you have declared it to us.

(6) Insofar as we base the processing of your personal data when using other functions and offers on our website on the balancing of interests, you can object to the processing. This is the case if, in particular, the processing is not necessary for the fulfilment of a contract with you, which is described by us in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will review the situation and either discontinue or adapt the data processing or show you our compelling reasons worthy of protection on the basis of which we will continue the processing.

(7) Naturally, you can object to the processing of your personal data when using other functions and offers on our website for the purpose of advertising and data analysis. You can inform us of the withdrawal of your application using the contact data above.

3. Forwarding data

Your personal data will not be forwarded to third parties for purposes other than those listed below.

We only forward your personal data to third parties if:

• you have granted your express consent pursuant to Art. 6 (1) sent. 1 lit. a GDPR,
• the forwarding is necessary according to Art. 6 (1) sent. 1 lit. f GDPR in order to assert, exercise or defend legal claims and there is no reason to assume that you have an overwhelming protective interest in the non-forwarding of your data,
• in the event that there is a statutory obligation to forward the data pursuant to Art. 6 (1) sent. 1 lit. c GDPR, and
• this is statutorily permitted and is necessary according to Art. 6 (1) sent. 1 lit. b GDPR for the management of contractual relationships with you.

4. Cookies

We use cookies on our site. These are small files, which your browser automatically creates and which are saved on your end device (laptop, tablet, smartphone or similar) when you visit our site. Cookies do not damage your end device, do not contain viruses, Trojans or other malware.

Information is stored in the cookie, which is generated in connection with the end device specifically used. However, this does not mean that we are able to directly determine your identity as a result.

On one hand, the use of cookies serves to make the use of our offer more pleasant for you. For example, we use so-called session cookies in order to determine that you have already visited our website. The data stored by session cookies is automatically deleted after leaving our site.

In addition, we also use temporary cookies to optimise user-friendliness; these are stored on your end device for a specified period of time. If you visit our website again to use our services, it is automatically recognised that you have already visited us and which entries and settings you have made so that you do not have to enter them again.

The data processed by cookies is required for the purposes mentioned to safeguard our legitimate interests and those of third parties in accordance with Art. 6 (1) sent. 1 lit. f GDPR.

Most browsers automatically accept cookies. However, you can modify the settings of your browser so that cookies are not saved on your computer or so that a message is always displayed before a new cookie is created. The complete deactivation of cookies, however, can result in you not being able to use all the functions of our website.

5. Presence on social media platforms

a. We maintain so-called fan pages or accounts or channels on the networks listed below in order to provide you with information and offers within social networks and to offer you further ways to contact us and find out about our offers. We inform you below about the data we or the respective social network process in connection with your access and use of our fan pages/accounts.

b. If you would like to contact us via Messenger or via Direct Message using the respective social network, we generally process your user name, which you use to contact us, and may store other data provided by you insofar as this is necessary to process/answer your request.

c. The legal basis for this is Art. 6 (1) sent. 1 f) GDPR (processing is necessary in order to safeguard the responsible person's legitimate interests).

d. We receive automated statistics about our accounts via insights functionalities. The statistics include the total number of page views, likes, information on page activity and post interactions, reach, video views/views and information on the proportion of men/women among our fans/followers.

e. The statistics merely include aggregated data rather than data that cannot be attributed to individuals. You are not identifiable to us as a result.

f. In order to view the content of our fan pages or accounts, you do not need to be a member of the respective social network and therefore no user account is required for the respective social network.

g. Please note, however, that the social networks also collect and store data from website visitors without a user account when the respective social network is accessed (e.g. technical data in order to display the website to you) and use cookies and similar technologies, over which we have no influence whatsoever. Details on this can be found in the privacy policy of the respective social network.

h. If you want to interact with the content on our fan pages/accounts, e.g. comment on, share or like our posts/contributions and/or wish to contact us via messenger functions, you must first register with the respective social network and provide personal data.

i. We have no influence on the data processing by the social networks in the context of your use. To the best of our knowledge, your data is stored and processed in particular in connection with the provision of the services of the respective social network, as well as for the analysis of user behaviour (using cookies, pixels/web beacons and similar technologies) on the basis of which advertising based on your interests is displayed both within and outside the respective social network. It cannot be ruled out that your data will also be stored by the social networks outside the EU/EEA and passed on to third parties.

j. Information on the precise extent and purposes of the processing of your personal data, the storage period/deletion and guidelines on the use of cookies and similar technologies in the context of registration and use of the social networks can be found in the data protection provisions/cookie guidelines of the social networks. This is where you will also find information on your rights and possibilities to object.

k. Facebook page

(1) When visiting our Facebook page, Facebook collects, among other things, your IP address and other information that exists in the form of cookies on your PC. This information is used in order to provide us as operator of the Facebook pages with statistical information about the use of the Facebook page. Facebook provides more information about this under the following link: facebook.com/help/pages/insights

(2) It is not possible for use to identify individual users from the statistical information provided. We only use it to respond to the interests of our users and to continuously improve our online presence and ensure its quality.

(2) We only collect your data via our fan page in order to realise possible provision of communication and interaction with us. This collection generally includes your name, message content, comment content and the profile information you provide "publicly".

(4) The processing of your personal data for the above-mentioned purposes is based on our legitimate business and communicative interest in offering an information and communication channel in accordance with Art. 6 (1) f) GDPR. If you as a user have given your consent for data processing to the respective provider of the social network, the legal basis for processing extends to Art. 6 (1) a) GDPR.

(5) Based on the fact that the actual data processing is performed by the provider of the social network, our access possibilities to your data are limited. Only the provider of the social network is authorised to access your data fully. Because of this, only the provider can directly take and implement appropriate measures to fulfil your user rights (request for information, request for deletion, objection, etc.). The assertion of corresponding rights is therefore most effectively carried out directly against the respective provider.

(6) Together with Facebook we are responsible for the personal content of the fan site. Data subject rights can be asserted against Facebook Ireland and against us.

(7) The primary responsibility for the processing of Insights data lies with Facebook in accordance with the GDPR and Facebook fulfils all obligations under the GDPR with regard to the processing of Insights data, Facebook Ireland provides the essence of the site Insights Supplement to the data subjects.

(8) We do not make any decisions regarding the processing of Insights data and all other information resulting from Art. 13 GDPR, including the legal basis, identity of the responsible person and storage duration of cookies on user end devices.

(9) You can find more information directly from Facebook (supplemental agreement with Facebook): www.facebook.com/legal/terms/page_controller_addendum

l. LinkedIn page

(1) LinkedIn is a social network of LinkedIn Inc. based in Sunnyvale, California, USA, which facilitates the creation of private and professional profiles. User can update their existing contacts and make new ones. Companies can create profiles, to which photos and other corporate information is uploaded. Other LinkedIn users have access to this information and can write their own articles and share this content with others.

(2) The focus is on the professional discussion of specialist subjects with people who have the same professional interests. In addition, LinkedIn is often used by companies and other organisations to recruit employees and present themselves as an interesting employer.

(3) You can find more information about LinkedIn at: about.linkedin.com

(4) You can find more information about data protection at LinkedIn at: www.linkedin.com/legal/privacy-policy

(5) We do not collect or process any personal data via our LinkedIn company page.

m. XING page

(1) XING is a social network of XING SE based in Hamburg, Germany, which facilitates the creation of private and professional profiles. User can update their existing contacts and make new ones. Companies can create profiles, to which photos and other corporate information is uploaded. Other XING users have access to this information and can write their own articles and share this content with others.

(2) The focus is on the professional discussion of specialist subjects with people who have the same professional interests. In addition, XING is often used by companies and other organisations to recruit employees and present themselves as an interesting employer.

(3) You can find more information about XING at: corporate.xing.com/de/unternehmen

(4) You can find more information about data protection at XING at: privacy.xing.com/de/datenschutzerklaerung

(5) We do not collect or process any personal data via our XING company site.

n. Instagram page

(1) Instagram is a product of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. In particular, you can access information about the processing of data by Instagram when interacting with the Instagram site, information about the legal basis and purposes of the processing of personal data, as well as information about data deletion and storage duration at Instagram here: help.instagram.com/519522125107875. In order to assert data subject rights against Instagram, please follow this link: help.instagram.com/contact/1845713985721890

(2) When the user interacts with the Instagram site, the following personal data is processed: public profile information of the user; in the case of comments, the personal data specified therein; in the case of replies to posts, the personal data specified therein. Instagram Insights (analytics services for use and interaction with Instagram pages) is used to process further statistical data on Instagram users. Instagram does not provide us with any personal data. We only receive numerical analyses from Instagram on the use and interaction of users with the Instagram site.

(3) Legal basis for the processing of personal data is Art. 6 (1) lit. f GDPR (safeguarding legitimate interests). Our legitimate interests arise from the purpose of evaluating the analyses and statistics of the Instagram page created and provided by Instagram with regard to interaction by users with the Instagram page, communication and interaction via the Instagram page and the development of the number of subscribers to the Instagram page. We do not have access here to the personal data processed by Instagram within the framework of Insights.

6. Newsletter distribution

This website uses ActiveCampaign to send newsletters. The provider is ActiveCampaign, Inc., 1 N Dearborn, 5th Floor Chicago, Illinois 60602, USA.

ActiveCampaign is a service with which, among other things, the sending of newsletters can be organised, analysed and evaluated. The data you enter for the purpose of subscribing to the newsletter is stored on ActiveCampaign's servers in the USA.

Type and extent of data processing

If you register on our website in order to receive our newsletter, we collect your email address and any other data you provide voluntarily and store this information together with the date of registration and your IP address. You then receive an email, in which you have to confirm your subscription to the  newsletter (double opt-in). If you do not confirm your registration, it will expire automatically and the data will not be processed for the newsletter mailing.

Data analysis by ActiveCampaign

By using ActiveCampaign it is possible for use to analyse our newsletter campaigns. For example, we are able to see whether a newsletter message has been opened and which links, if any, were clicked. In this way we are able to determine, inter alia, which links have been clicked particularly often.

Additionally, we are able to recognise whether certain previously defined actions were carried out after opening/clicking (conversion rate). For example, we can recognise whether you made a purchase after clicking on the newsletter.

ActiveCampaign also enables us to categorise newsletter recipients according to various categories ("clustering"). Newsletter recipients can be categorised by age, gender or place of residence, for example. In this way, the newsletters can be better customised to the respective target groups

Extensive information about the functions of ActiveCampaign can be found under the following link: www.activecampaign.com/email-marketing

The ActiveCampaign data protection declaration is available at: www.activecampaign.com/privacy-policy

Legal basis

The data processing is performed on the basis of your sent (Art. 6 (1) lit. a DSGVO). You can revoke this consent at any time with effect for the future. In addition, you can unsubscribe at any time, for example via a link at the end of each newsletter

The lawfulness of the data processing operations performed before revocation of the consent shall remain unaffected.

Data transmission to the USA is based on the standard contractual clauses of the EU Commission. Details are available here: www.activecampaign.com/legal/newscc

Storage duration

The data you provide us with for the purpose of subscribing to the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and deleted from the newsletter distribution list after you unsubscribe from the newsletter. Data stored for other purposes shall remain unaffected hereby.

After you unsubscribe from the newsletter distribution list, your email address may be stored by us or the newsletter service provider in a blacklist to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest as defined in Art. 6 (1) lit. f GDPR). Storage in the blacklist is not time-limited. You can object to the storage provided that your interests exceed our legitimate interest.

Conclusion of an agreement for contract processing

We have concluded an agreement with the provider ActiveCampaign for contract processing and fully apply the strict requirements of the German data protection authorities when using ActiveCampaign.

7. CRM system

We use the CRM system from the provider Salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, so that we can process user enquiries faster and more effectively (legitimate interest according to Art. 6 (1) lit. f. GDPR).

Salesforce is certified under the EU-US Data Privacy Framework and as a result offers an additional guarantee to comply with European data protection legislation, provided that the data is processed in the USA:
Data protection framework (dataprivacyframework.gov)

Salesforce uses the users’ data only for technical processing of enquiries and never forwards it to third parties. To use Salesforce, it is necessary to provide at least a correct email address Anonymised use is possible. In the course of processing service requests, it may be necessary to collect further data (name, address).

If users do not consent to data being collected via and stored in Salesforce's external system, we offer you alternative contact options for submitting service requests by e-mail, telephone, fax or post.

The users can find more information in Salesforce's data protection declaration: www.salesforce.com/de/company/privacy/

8. Subject rights

You have the right:

• according to Art. 15 GDPR, to demand information about your personal data processed by us In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to correction, erasure, restriction of processing or objection, the existence of a right of appeal, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information on its details;
• according to Art. 16 GDPR, to demand the immediate correction of incorrect data or the completion of your personal data stored by us
• according to Art. 17 GDPR, to demand the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
• according to Art. 18 GDPR, to demand the restriction of the processing of your personal data if the accuracy of the data is disputed by you, the processing is unlawful, but you refuse to delete it and we no longer need the data, but you need it for the assertion, exercise or defence of legal claims or you have lodged an objection to the processing in accordance with Art. 21 GDPR;
• according to Art. 20 GDPR, to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format or to request the transmission to another controller;
• according to Art. 7 (3) GDPR, to revoke your consent once given to us at any time. This means that we are no longer permitted to continue the data processing that was based on this consent in the future, and
• according to Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or at our registered office.

9. Right to object

If your personal data is processed on the basis of legitimate interests in accordance with Art. 6 (1) sent. 1 lit. f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, provided that there are reasons for this arising from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right to object, which will be implemented by us without specifying a particular situation.

If you would like to assert your right of revocation or objection, an email is sufficient: dsb@api.de

10. Data security

As part of your visit to the website, we use the widespread SSL (Secure Socket Layer) method in conjunction with the highest level of encryption supported by your browser. Typically, this is 256 bit encryption. If your browser does not support 256 bit encryption, we instead use 128 bit v3 technology. You can tell if an individual page of our website is transmitted in encrypted form by the closed display of the key or padlock symbol in the address or lower status bar of your browser.

We also use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are being continuously improved in line with technological developments.

11. Currentness of and change to this data protection declaration

This data protection declaration is currently valid as from April 2024.

Due to the further development of our website and offers on it or due to changed legal or official requirements, it may become necessary to change this data protection declaration. The respective current data protection declaration can be access and printed out at any time on the website under /flatpage.php?page=/datenschutz/.