Data Protection and Cookie Policy

I. General

The AtomLeap GmbH (“AtomLeap,” “we” or “our”) cares about your privacy and the security of your information. We want you to be familiar with how we collect, use and disclose information, including personal information. This Data Protection and Cookie Policy describes our practices of personal data in conjunction with your access to our print and digital products and services. These products and services include the AtomLeap Executive Briefing, our websites, email newsletters, social media pages, mobile and other applications owned and operated by us, our offline contacts, and any other services that display this notice (collectively referred to as the “AtomLeap Services”). This Data Protection and Cookie Policy does not apply to certain of our products and services that display a different data protection policy.

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This includes, above all, information that makes it possible to draw conclusions about your identity, such as your name, telephone  number, address or e-mail address. Statistical data that we may collect, for example, when you visit our website and that cannot be associated with your person, is not covered by the term personal data.

You  may print  or save this  Data Protection and Cookie Policy  by using the usual functionality  of your browser. You can also download and archive this Data Protection and Cookie Policy as a PDF file.

II. Responsible Person

The person responsible within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection regulations is:

AtomLeap GmbH
Oranienstraße 183
Aufgang C, 4. Etage links
10999 Berlin
Germany

Websites:
atomleap.com
briefing.atomleap.com
hightechaccelerator.atomleap.com

Email:
contact@atomleap.com

Managing Director: Dr. Robin P. G. Tech

Imprint.

III. Types of data processed

We may process the following types of data from visitors of websites, users and clients of the online offer or applicants:

Inventory data (e.g., names, addresses),
Contact details (e.g., email, telephone numbers),
Content data (e.g., text input, photographs, videos),
Usage data (e.g., visited websites, interest in content, access times),
Meta/communication data (e.g., device information, IP addresses).

IV. Purpose of processing and applicable legal bases

Notwithstanding any other provisions in this Data Protection and Cookies Policy, we process personal data for the following purposes:

  • Provision of the online offers, its functions and contents;
  • Answering contact requests and communication with visitors, users, clients or applicants;
  • Adopting security measures;
  • Conducting marketing; 
  • Execution of order processing in the online shop;
  • Provision of payment services;
  • Administrative, financial accounting, and office organization;
  • Contacting and contact management;
  • Sending newsletters;
  • Hosting and collection of access data and log files;
  • Carrying out an application procedure.

In accordance with Art. 13 GDPR, we inform you of the legal basis of our data processing. If the legal basis is not explicitly mentioned in this Data Protection Policy, the following applies: The legal basis for obtaining consents is Art. 6(1)(a) and Art. 7 GDPR, the legal basis for processing for the performance of our services and performance of contractual measures as well as for answering inquiries is Art. 6(1)(b) GDPR, the legal basis for processing to fulfil our legal obligations is Art. 6(1)(c) GDPR, and the legal basis for processing to protect our legitimate interests is Art. 6(1)(f) GDPR. In the event that the vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(d) DSGVO serves as the legal basis.

A. Business related data processing

Additionally we may process

  • contract data (for example, contract object, term, customer category) and
  • payment data (e.g., bank details, payment history)

from our customers, interested parties and business partners for the purpose of providing contractual services, service and customer care, marketing, advertising and market research.

B. Order processing in the online shop and client account

We process the data of our clients in the context of the order processes in our online shop to enable them to select and order the selected products and services, as well as their payment and delivery, or execution.

The processed data includes inventory data, communication data, contract data, payment data and the persons affected by the processing include our customers, interested parties and other business partners. The processing takes place for the purpose of providing contractual services in the context of operating an online shop, billing, delivery and customer services. We use session cookies for storing the contents of the shopping cart and permanent cookies for storing the login status.

Processing is carried out on the basis of Art. 6 (1)(b) (execution of order processes) and Art. 6(1)(c) (legally required archiving) GDPR. The information marked as necessary is required to establish and perform the contract. We disclose the data to third parties only within the framework of delivery, payment or within the framework of legal permits and obligations to legal advisors and authorities. The data will only be processed in third countries if this is necessary for the performance of the contract (e.g. at the client’s request upon delivery or payment).

Users can optionally create a user account, in particular by viewing their orders. During the registration process, the required information will be communicated to the users. The user accounts are not public and cannot be indexed by search engines. If users have terminated their user account, their data will be deleted with regard to the user account, subject to its storage is necessary for commercial or tax reasons according to Art. 6(1)(b) GDPR. Data in the customer account are stored up to its deletion with subsequent archiving in the case of a legal obligation. It is up to the users to save their data before the end of the contract if they have given notice of termination.

When registering, re-registering, and using our online services, we may store the IP address and the time of the respective user action. The data are stored on the basis of our legitimate interests as well as the user’s protection against misuse and other unauthorized use. A passing on of this data to third parties does not take place in principle, unless it is necessary for the pursuit of our claims or there is a legal obligation according to Art. 6(1)(c) GDPR.

The deletion takes place after the expiry of statutory warranty and comparable obligations, the necessity of data storage is reviewed every three years; in the case of statutory archiving obligations, the deletion takes place after their expiry (end of commercial law (6 years) and tax law (10 years) storage obligation).

C. Payment

We use your personal information process payments, and communicate with you about orders, products, services, and promotional offers. We employ external payment service providers on the basis of our legitimate interests in accordance with Art. 6(1)(f) DSGVO to provide our users with effective and secure payment options.  The data processed by the payment service providers includes inventory data such as name and address, bank data such as account numbers or credit card numbers, passwords, TANs, and checksums as well as contract, totals, and recipient information. This information is required to execute the transactions. However, the data entered will only be processed and stored by the payment service providers. This means that we do not receive any account or credit card related information, but only confirmation or negative information about the payment. The data may be transferred by the payment service providers to credit agencies. The purpose of this transmission is to verify identity and creditworthiness. We refer to the terms and conditions and data protection information of the payment service providers. For payment transactions, the terms and conditions and the data protection information of the respective payment service providers, which can be accessed within the respective websites or transaction applications, apply. We refer to these also for the purpose of further information and assertion of rights of revocation, information and other interested parties.

D. Administration, financial accounting, office organization, contact management

We process data within the framework of administrative tasks as well as the organization of our company, financial accounting and compliance with legal obligations, e.g. archiving. We process the same data that we process in the course of providing our contractual services. The respective legal bases for data processing are Art. 6(1)(c) GDPR, Art. 6(1)(f) GDPR. Customers, interested parties, business partners and website users are affected by the processing. The purpose and our interest in the processing lies in the administration, financial accounting, office organization, archiving of data, thus tasks which serve the maintenance of our business activities, perception of our tasks and provision of our services. The deletion of the data with regard to contractual services and contractual communication corresponds to the information provided in these processing activities. 

We disclose or transmit data to the tax authorities, consultants, such as tax consultants or auditors, as well as other fee offices and payment service providers.

Furthermore, we store information on suppliers, event organisers and other business partners on the basis of our business interests, e.g. for the purpose of making contact at a later date. We store this data, which is mainly company-related, permanently.

E. Business analyses and market research

In order to operate our business economically and to identify market trends, customer and user requirements, we analyse the data available to us on business transactions, contracts, enquiries, etc., in order to ensure that we are able to offer our clients the best possible service. We process inventory data, communication data, contract data, payment data, usage data, metadata on the basis of Art. 6(1)(f) GDPR, whereby the persons concerned include clients, interested parties, business partners, visitors, and users of the online offer. The analyses are carried out for the purpose of economic evaluations, marketing and market research. We can take into account the profiles of registered users with information, e.g. on the services they have used. The analyses serve us to increase the user-friendliness, the optimization of our offer and the economic efficiency. The analyses serve us alone and are not disclosed externally, unless they are anonymous analyses with aggregated values. If these analyses or profiles are personal, they will be deleted or made anonymous upon termination of the user, otherwise after two years from the conclusion of the contract. For the rest, macroeconomic analyses and general trend determinations are conducted anonymously wherever possible.

F. Contacting

When contacting us (e.g. via contact form, e-mail, telephone or social media), the contacting person’s details are processed for processing the contact enquiry and its processing in accordance with Art. 6(1)(b) GDPR. User information can be stored in a customer relationship management system (“CRM system”) or comparable request organization. We delete the requests if they are no longer necessary. We review this requirement every two years; the statutory archiving obligations also apply.

G. Newsletters

With the following information we inform you about the contents of our newsletter as well as the registration, dispatch and statistical evaluation procedure and your rights to object. By subscribing to our newsletter you agree to the receipt and the described procedures. Content of the newsletter: We send newsletters, e-mails and other electronic notifications containing advertising information (hereinafter “newsletters”) only with the consent of the recipients or a legal permission. If the contents of a newsletter are specifically described within the scope of a registration, they are decisive for the consent of the users. In addition, our newsletters contain information about our services and us. Double opt-in and logging: Subscription to our newsletter takes place in a so-called double opt-in procedure. This means that after registration you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can log in with other email addresses. Subscriptions to the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes the storage of the login and confirmation time, as well as the IP address. The changes to your data stored with the shipping service provider are also logged. Credentials: To subscribe to the newsletter, simply enter your e-mail address. Optionally, we ask you to enter a name in the newsletter in order to be addressed by us personally. The dispatch of the newsletter and the performance measurement associated with it is based on the recipient’s consent pursuant to Art. 6(1)(a), Art. 7 GDPR in conjunction with Section 7 para. 2 no. 3 German Act Against Unfair Competition or on the basis of the legal permission pursuant to Section 7 para. 3 German Act Against Unfair Competition.

The registration procedure is recorded on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR. We are interested in the use of a user-friendly and secure newsletter system that serves both our business interests and the expectations of users and also allows us to provide proof of consent. Cancellation/Revocation: You can cancel the newsletter service at any time, i.e. revoke your consent. You will find a link to cancel the newsletter at the end of each newsletter. We may store the email addresses of users that have unsubscribed for up to three years on the basis of our legitimate interests before we delete them in order to be able to prove a previously given consent. The processing of these data is limited to the purpose of a possible defence against claims. An individual application for cancellation is possible at any time, provided that at the same time the former existence of a consent is confirmed.

H. Hosting

The hosting services we use provide: infrastructure and platform services, computing capacity, storage space and database services, security services, and technical maintenance services that we use for the purpose of operating this online offering. We, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta- and communication data of customers, interested parties, and visitors of this online offer on the basis of our legitimate interests in an efficient and secure provision of this online service and offer according to Art. 6(1)(f) GDPR in conjunction with. Art. 28 GDPR (conclusion of order processing contract).

I. Collection of access data and log files

We, or our hosting provider, collect the following data on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR data on each access to the server on which this service is located (so-called server log files). Access data includes the name of the accessed website, file, date and time of access, transferred data volume, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider. Log file data will be stored for security reasons (e.g., to investigate misuse or fraud) and deleted after a reasonable time, typically within 8 weeks. Data needed for security incident handling are excluded from deletion until the respective incident has been finally clarified.

J. Job Applications

If you apply for an open position or send us an unsolicited application we may process, among other things:

  • Names
  • Birth data
  • Contact details
  • Country
  • Application documents (CV, certificates, letter of motivation, etc.)
  • Will to get informed in future

The legal basis for the processing of data in the context of job applications is Art. 6(1)(b) GDPR. The purpose of data processing is the electronic submission and examination of applications, application documents, and, if applicable, to inform applicants in future about job opportunities. If the application is for employment within the scope of a project, the data will be deleted three months after the end of the project if the application is rejected, and six months after the end of the application procedure if the application is not project-related.  Upon request, we will delete the stored data before the end of the storage period, provided there is no longer storage due to commercial, tax or social security law storage obligations. In the event of employment, the application documents will be deleted three years after termination of employment, provided that there is no longer retention due to commercial, tax or social security retention obligations.

V. Data security

We have implemented appropriate technical and organizational controls to protect your personal data against unauthorised processing and against accidental loss, damage, or destruction. You are responsible for choosing a secure password when we ask you to set up a password to access parts of our sites or apps. You should keep this password confidential and you should choose a password that you do not use on any other site. You should not share your password with anyone else, including anyone who works for us. Unfortunately, sending information via the internet is not completely secure. Although we will do our best to protect your personal data once with us, we cannot guarantee the security of any personal data sent to our site while still in transit and so you provide it at your own risk.

VI. Cooperation with processors and third parties

If we disclose data to other persons and companies (contract processors or third parties) within the scope of our processing, transmit it to them or otherwise grant them access to the data, this shall only take place on the basis of a legal permission (e.g. if a transmission of the data to third parties, such as payment service providers, in accordance with Art. 6(1)(b) GDPR for contract performance is necessary), if you have consented, if a legal obligation provides for this or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.). If we commission third parties with the processing of data on the basis of a so-called “data processing agreement”, this is done on the basis of Art. 28 GDPR.

VII. Transfers of personal data to third countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of the use of third-party services or disclosure or transfer of data to third parties, this only takes place if it occurs for the performance of our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or leave the data in a third country only if the special requirements of Art. 44 et seq. GDPR. This means, for example, processing is carried out on the basis of special guarantees, such as the officially recognised determination of a data protection level corresponding to the EU (e.g. for the USA by the “Privacy Shield”) or compliance with officially recognised special contractual obligations (so-called “standard contractual clauses”).

A. Stripe

We use external payment service providers through whose platforms the users and we can carry out payment transactions.  This includes Stripe Payments Europe, Ltd., a company incorporated in Ireland and with offices at 1 Grand Canal Street Lower, Grand Canal Dock, Dublin (hereinafter referred to as “Stripe”). Payments are subject to the Stripe Terms and Conditions, which can be read at https://stripe.com/de/legal. You can read Stripe’s Privacy Policy at https://stripe.com/de/privacy. Within the scope of the performance of contracts, we use the payment service providers on the basis of Art. 6(1)(b) GDPR. Furthermore, we employ external payment service providers on the basis of our legitimate interests in accordance with Art. 6(1)(f) DSGVO to provide our users with effective and secure payment options. The data processed by the payment service providers includes inventory data such as name and address, bank data such as account numbers or credit card numbers, passwords, TANs and checksums as well as contract, totals and recipient information. This information is required to execute the transactions. However, the data entered will only be processed and stored by the payment service providers. This means that we do not receive any account or credit card related information, but only information with confirmation or negative information about the payment. The data may be transferred by the payment service providers to credit agencies. The purpose of this transmission is to verify identity and creditworthiness. For this we refer to the terms and conditions and data protection information of the payment service providers.  For payment transactions, the terms and conditions and the data protection information of the respective payment service providers, which can be accessed within the respective websites or transaction applications, apply. We refer to these also for the purpose of further information and assertion of rights of revocation, information and other interested parties.

B. PayPal

If you decide to pay with the online payment service PayPal, your personal data will be transmitted to PayPal. The PayPal service is offered by PayPal (Europe) S.à.r.l. & Cie . S.C.A., 22 – 24 Boulevard Royal, L – 2449 Luxembourg. In the context of payment, the following personal data will usually be processed in accordance with Article 6(1.)(b) GDPR for the performance of the contract: First and last name, gender, address, start and destination coordinates of your ride, country, language, email address, mobile phone number, credit card holder’s first and last name, credit card issuer, first six and last four digits of the credit card number, credit card’s expiry date, the email address of your PayPal account if applicable, information about your terminal equipment (device ID, etc.), or other data required for order  processing. The transfer of data is necessary to process your order using the payment method you have selected, in particular to confirm your identity, to administer your payment and the customer relationship. Please note, however, that PayPal may also pass on personal data to service providers, subcontractors or other affiliated companies if this is necessary to fulfil the contractual obligations arising from your order or if the personal data is to be processed on behalf of PayPal. Depending on the payment method selected via PayPal, e.g., invoice or direct debit, the personal data transmitted to PayPal is transmitted by PayPal to credit agencies. This transfer serves to verify your identity and creditworthiness with regard to the order you have placed. You can find out which credit agencies are involved and which data are generally collected, processed, stored and passed on by PayPal in the PayPal data protection declaration at  https://www.paypal.com/ie/webapps/mpp/ua/privacy-full?locale.x=en_IE.

C. Copper

For our contact management (e.g., customer relationship management, email marketing) we use the US Company Copper CRM, Inc (“Copper”). When using their platform, Copper collects the information we submit to our account including names, titles, email addresses, mailing addresses, and phone numbers of our customers, leads, and contacts. Copper also collects other information when we use their platform including operating system, system model, and IP address. Copper’s platform may enable us to import contacts included in our email accounts. We do not collect the login credentials for such email accounts. Copper uses personal data to conduct business, provide information and support for products and services, better understand customer needs and interests, refine and develop their business, improve services, personalize communications and ensure a quality experience for users of their services. Your personal data may be stored on the servers of Copper. Copper is certified under the terms of the “EU – U.S. Privacy Shield Frameworks” as well as “U.S. – Swiss Safe Harbor” framework. This means that any processing of personal data by certified companies in the non-European region conforms to European data protection standards. You can contact Copper by email at privacy_questions@copper.com or by mail to Copper CRM, Inc. 301 Howard St. #600  San Francisco, CA 94105, Attn: Privacy Policy.

D. WordPress

For our contact management we also use WordPress. Contact details required and asked for during the registration for the AtomLeap Executive Briefing are processed by WordPress. You can find WordPress’ privacy policy at https://wordpress.org/about/privacy/ and their terms of service at https://en.wordpress.com/tos/.

E. Google G Suite

For external and internal communication and collaboration we use services from Google G Suite from Google LLC (Google), Amphitheatre Parkway, Mountain View, CA 94043, USA, including Gmail, Google Calendar, Google Drive as well as Google Docs, Sheets, Slides, and Forms. You can find Google’s Terms of Service and Privacy Policy at https://policies.google.com/.

F. One.com

All websites are hosted at our hosting provider One.com. You can contact the european representative of One.com at European representative One.com, A/S Kalvebod Brygge 24, 1560 Copenhagen V, Denmark or via email at privacy@one.com. You can access the Data Processor Agreement at https://www.one.com/static/info/data-processing-agreement-en.pdf and the One.com Privacy Notice at https://www.one.com/static/info-privacy-notice.do#DATACONTROL.

VIII. Rights of data subjects

You have the right to request confirmation as to whether the data concerned are being processed and to request information about these data as well as further information and a copy of the data in accordance with Art. 15 GDPR. In accordance with Art. 16 GDPR, you have the right to request the completion of data concerning you or the correction of incorrect data concerning you. In accordance with Art. 17 GDPR, you have the right to demand that relevant data be deleted immediately or, alternatively, to demand a restriction on the processing of the data in accordance with Art. 18 GDPR. You have the right to request that the data concerning you that you have provided to us be received in accordance with Art. 20 GDPR and to request its transmission to other persons responsible. In accordance with Art. 77 GDPR, they also have the right to file a complaint with the competent supervisory authority. The “Berlin Commissioner for Data Protection and Freedom of Information” (https://www.datenschutz-berlin.de/kontakt.html) is responsible for this.

A. Right to withdraw consent

You have the right to withdraw your consent pursuant to Art. 7(3) GDPR at any time with future effect. The withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

B. Right to object

You can object to the future processing of the data concerning you in accordance with Art. 21 GDPR at any time. You may object in particular against processing for direct marketing purposes.

C. Cookies and right to object to processing related to direct marketing

“Cookies” are small files that are stored on the user’s computer. Different data can be stored within the cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after his or her visit to an online offer. Temporary cookies, or “session cookies” or “transient cookies”, are cookies that are deleted after a user leaves an online offer and closes his browser. In such a cookie, for example, the content of a shopping basket in an online shop or a login status can be stored. Cookies are referred to as “permanent” or “persistent” and remain stored even after the browser is closed. For example, the login status can be saved when users visit it after several days. Likewise, the interests of users used for range measurement or marketing purposes may be stored in such a cookie. “Third-party cookies” are cookies that are offered by providers other than the person responsible for operating the online offer (otherwise, if they are only its cookies, they are referred to as “first-party cookies”). We may use temporary and permanent cookies and clarify this within the framework of our Data Protection and Cookies Policy. If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of this online offer. You can object to the future processing of the data concerning you in accordance with Art. 21 GDPR at any time. You may object in particular against processing for direct marketing purposes. A general objection to the use of cookies used for online marketing purposes can be declared for many of the services, especially in the case of tracking, via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. Furthermore, the storage of cookies can be achieved by deactivating them in the browser settings. Please note that in this case not all functions of this online offer can be used.

D. Erasure of personal data

The data processed by us will be deleted or their processing restricted in accordance with Articles 17 and 18 GDPR. Unless expressly stated in this Data Protection and Cookies Policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and the deletion does not conflict with any statutory storage obligations. If the data are not deleted because they are necessary for other and legally permissible purposes, their processing is restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons. According to legal requirements in Germany, the storage is carried out in particular for 10 years in accordance with Section 147 para. 1 AO, Section 257 para. 1 no. 1 and 4, para. 4 HGB (books, records, management reports, accounting documents, trading books, documents relevant for taxation, etc.) and 6 years in accordance with Section 257 para. 1 no. 2 and 3, para. 4 HGB (commercial letters).

E. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with any supervisory authority if you believe that the processing of data relating to you is illegal. The data protection supervisory authority responsible for AtomLeap is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin, Germany; email: mailbox@datenschutz-berlin.de.

IX. Changes to this policy

From time to time, we may make changes to the privacy policy. This may be in relation to changes in the law, best practice or changes in our services. If we decide to change our privacy policy we will post the changes here. If the changes are significant, we may also choose to email all our registered users with the new details. If required by law, we will get your permission or give you the opportunity to opt out of any new uses of your data.

Last updated: July 2019