Skip navigation

Information on data protection

This privacy notice informs you about our handling of your personal data and about your rights under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). HafenCity Hamburg GmbH (hereinafter referred to as “we” or “us”) is responsible for data processing.

Contents

I. General Information

  1. Contact
  2. Legal bases
  3. Duration of storage
  4. Categories of recipients of the data
  5. Data transfer to third countries
  6. Processing in the exercise of your rights
  7. Your rights
  8. Right to object
  9. Data protection officer

II. Data processing on our website

  1. Processing of server log files
  2. Job applications
  3. Cookies
  4. Consent management tool
  5. External media and third-party services
    a. Vimeo
    b. Typeform
    c. Matomo

III. Data processing on our social media pages

  1. Visiting a social media page
  2. Communication via social media pages

IV. Further data processing

  1. Contact by e-mail
  2. Business partner and interested party data
  3. Use of the e-mail address for marketing purposes
  4. Job applications
  5. Newsletter
  6. Feedback on our offers

I. General information

1. Contact

If you have any questions or suggestions regarding this notice or would like to contact us to assert your rights, please send your enquiry to

          HafenCity Hamburg GmbH
          Osakaallee 11
          20457 Hamburg
          Phone: +49 (0)40 37 47 26 0
          E-mail: info@hafencity.com

2. Legal bases

The data protection term “personal data” refers to all information that relates to an identified or identifiable person. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the BDSG. Data processing by us only takes place on the basis of legal authorisation. We only process personal data with your consent (Section 25 para. 1 TDDDG or Art. 6 para. 1 lit. a GDPR), to perform a contract to which you are a party or at your request to carry out pre-contractual measures (Art. 6 para. 1 lit. b GDPR), to comply with a legal obligation (Art. 6 para. 1 lit. c GDPR) or if processing is necessary for the purposes of our legitimate interests or the legitimate interests of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (Art. 6 para. 1 lit. f GDPR).

If you apply for an open position in our company, we will also process your personal data to decide on the establishment of an employment relationship (Section 26 para. 1 sentence 1 BDSG).

3. Duration of storage

Unless otherwise stated in the following information, we only store the data for as long as is necessary to achieve the purpose of processing or to fulfil our contractual or legal obligations. Such statutory retention obligations may arise in particular from commercial or tax law regulations. From the end of the calendar year in which the data was collected, we will retain such personal data contained in our accounting data for ten years and retain personal data contained in commercial letters and contracts for six years. In addition, we will retain data in connection with consents requiring proof and with complaints and claims for the duration of the statutory limitation periods. We will delete data stored for advertising purposes if you object to processing for this purpose.

4. Categories of recipients of the data

We use processors in the context of processing your data. The processing operations carried out by such processors include, for example, hosting, e-mail delivery, maintenance and support of IT systems, customer and order management, order processing, accounting and billing, marketing measures or file and data carrier destruction. A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller. Processors do not use the data for their own purposes, but carry out the data processing exclusively for the controller and are contractually obliged to guarantee suitable technical and organisational measures for data protection. We may also transfer your personal data to organisations such as postal and delivery services, our bank, tax consultants/auditors or the tax authorities. Data may be transferred to the responsible public health department for infection tracking purposes. Further recipients may result from the following information.

5. Data transfer to third countries

Visiting our website may involve the transfer of certain personal data to third countries, i.e. countries in which the GDPR is not applicable law. Such a transfer is permitted if the European Commission has determined that an adequate level of data protection is required in such a third country. If there is no such adequacy decision by the European Commission, personal data will only be transferred to a third country if there are suitable guarantees in accordance with Art. 46 GDPR or if one of the requirements of Art. 49 GDPR is met.

Unless otherwise stated below, we use the EU standard data protection clauses as appropriate safeguards for the transfer of personal data to third countries. You have the option of receiving or viewing a copy of these EU standard data protection clauses. Please contact us at the address given under Contact.

If you consent to the transfer of personal data to third countries, the transfer takes place on the legal basis of Art. 49 para. 1 lit. a GDPR.

6. Processing in the exercise of your rights

If you exercise your rights in accordance with Art. 15 to 22 GDPR, we process the personal data transmitted for the purpose of implementing these rights by us and to be able to provide proof of this. We will only process data stored for the purpose of providing and preparing information for this purpose and for the purposes of data protection monitoring and will otherwise restrict processing in accordance with Art. 18 GDPR.

This processing is based on the legal basis of Art. 6 para. 1 lit. c GDPR in conjunction with Art. 15 to 22 GDPR and Section 34 para. 2 BDSG.

7. Your rights

As a data subject, you have the right to assert your data subject rights against us. In particular, you have the following rights:

  • In accordance with Art. 15 GDPR and Section 34 BDSG, you have the right to request information as to whether or not we process personal data relating to you and, if so, to what extent.
  • You have the right to demand that we rectify your data in accordance with Art. 16 GDPR.
  • You have the right to demand that we erase your personal data in accordance with Art. 17 GDPR and Section 35 BDSG.
  • You have the right to restrict the processing of your personal data in accordance with Art. 18 GDPR.
  • In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and to transmit those data to another controller.
  • If you have given us separate consent to process your data, you can withdraw this consent at any time in accordance with Art. 7 para. 3 GDPR. Such a withdrawal does not affect the lawfulness of the processing that was carried out on the basis of the consent until the withdrawal.
  • If you believe that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.

8. Right to object

In accordance with Art. 21 para. 1 GDPR, you have the right to object to processing based on the legal basis of Art. 6 para. 1 lit. e or f GDPR on grounds relating to your particular situation. If we process personal data about you for the purpose of direct marketing, you can object to this processing in accordance with Art. 21 para. 2 and 3 GDPR.

9. Data protection officer

You can reach our data protection officer using the following contact details:

          E-mail: datenschutz@hafencity.com
          Herting Oberbeck Datenschutz GmbH
          Hallerstraße 76, 20146 Hamburg
          https://www.datenschutzkanzlei.de   

II. Data processing on our website

When you use the website, we collect information that you provide yourself. In addition, certain information about your use of the website is automatically collected by us during your visit to the website. In data protection law, the IP address is also considered personal data. An IP address is assigned to every device connected to the Internet by the Internet provider so that it can send and receive data.

1. Processing of server log files

When using our website for purely informational purposes, general information that your browser transmits to our server is initially stored automatically (i.e. not via registration). By default, this includes: browser type/version, operating system used, page accessed, the previously visited page (referrer URL), IP address, date and time of the server request and HTTP status code. The processing is carried out to protect our legitimate interests and is based on the legal basis of Art. 6 para. 1 lit. f GDPR. This processing serves the technical administration and security of the website. The stored data will be deleted after 14 days unless there is a justified suspicion of unlawful use based on concrete evidence and further examination and processing of the information is necessary for this reason. We are not able to identify you as a data subject on the basis of the stored information. Art. 15 to 22 GDPR therefore do not apply in accordance with Art. 11 para. 2 GDPR, unless you provide additional information that enables your identification in order to exercise your rights set out in these articles.

2. Job applications

If you apply to our company, we process your application data exclusively for purposes related to your interest in current or future employment with us and the processing of your application. For this purpose, we collect personal data from you, including in particular your name, your contact details, your CV, your letter of application and other content provided by you. This also applies to applications for internships and traineeships.

For the selection of our applications, we use the service provider Personio, from Personio SE & Co KG (Germany, EU), which works for us solely in accordance with the legal requirements for data processing and is bound by our instructions. Your application will only be processed and acknowledged by the relevant contact persons at our company. All employees entrusted with data processing are obliged to maintain the confidentiality of your data.

If we are unable to offer you employment, we will retain the data you have submitted for up to six months after rejection for the purpose of answering questions in connection with your application and rejection. This does not apply if statutory provisions prevent deletion, if further storage is necessary for the purpose of providing evidence or if you have expressly consented to longer storage.

The legal basis for data processing is Section 26 para. 1 sentence 1 BDSG or Art. 6 para. 1 lit. b GDPR. If we retain your applicant data beyond a period of six months and you have expressly consented to this (Art. 6 para. 1 lit. a GDPR), we would like to point out that this consent can be freely withdrawn at any time in accordance with Art. 7 para. 3 GDPR. Such a withdrawal does not affect the lawfulness of the processing that was carried out on the basis of the consent until the withdrawal. If you are hired by us after completing the application process, we will store your personal data as part of the employment relationship.

3. Cookies

We use cookies and similar technologies (“cookies”) on our website. Cookies are small data records that are stored by your browser when you visit a website. This identifies the browser used and can be recognised by web servers. You have full control over the use of cookies through your browser. You can delete cookies in the security settings of your browser at any time. You can object to the use of cookies through your browser settings in principle or for specific cases.

The use of cookies is in part technically necessary for the operation of our website and is therefore permitted without the user’s consent. We may also use cookies to offer special functions and content and for analysis and marketing purposes. These may also include cookies from third-party providers (so-called third-party cookies). We only use such technically unnecessary cookies with your consent in accordance with Section 25 para. 1 TDDDG and, if applicable, Art. 6 para. 1 lit. a GDPR. Information on the purposes, providers, technologies used, stored data and the storage duration of individual cookies can be found in the cookie settings of our Consent Management Tool.

4. Consent management tool

This website uses the consent management tool Cookiebot from Usercentrics A/S (Denmark) to control cookies and the processing of personal data.

The consent banner enables users of our website to give their consent to certain data processing operations or to withdraw their consent. By confirming the “I accept” button or by saving individual cookie settings, you consent to the use of the associated cookies. The legal basis under data protection law is your consent within the meaning of Art. 6 para. 1 lit. a GDPR.

The banner also helps us to provide evidence of the declaration of consent. For this purpose, we process information about the declaration of consent and further log data for this declaration. Cookies are also used to collect this data.

The processing of this data is necessary in order to be able to prove that consent has been given. The legal basis arises from our legal obligation to document your consent (Art. 6 para. 1 lit. c in conjunction with Art. 7 para. 1 GDPR).

You can withdraw your consent for cookies here: https://www.hafencity.com/en/privacy-policy#CookieDeclarationUserStatusPanel

5. External media and third-party services

a. Vimeo

We use the Vimeo service of Vimeo, Inc. (Vimeo/USA) on our website to integrate videos. For such integration, it is technically necessary to process your IP address so that the content can be sent to your browser. Your IP address is therefore transmitted to Vimeo and Vimeo may set its own cookies.

Vimeo will only be used with your consent in accordance with Art. 6 para. 1 lit. a GDPR. Further information on this processing activity and the storage period can be found in the settings of our Consent Management Tool.

With Vimeo, the transmission of data to the USA cannot be ruled out. Users can find further information on data protection at Vimeo in Vimeo’s privacy policy: https://vimeo.com/privacy.  Please note the information in the section “Data transfer to third countries”.

b. Typeform

We use the Typeform service (Spain, EU) on our website to provide forms for our customers. These forms help us to collect data that we need to process orders and/or enquiries from our customers. When using these forms, personal customer data is transmitted to Typeform so that we can assign it to your order. Typeform itself acts as our processor and is therefore not authorised to use this information for its own purposes.

When using the service, a transfer of your data to the USA cannot be ruled out. Please note the information in the section “Data transfer to third countries”. Further information on data protection at Typeform can be found in Typeform’s privacy policy at https://admin.typeform.com/to/dwk6gt/.

c. Matomo

We use the Matomo service from the provider InnoCraft Ltd (New Zealand) on our website. Matomo is a web analysis service that enables us to collect and analyse data about the behaviour of users on our website. Matomo uses cookies for this purpose, which enable us to analyse the use of our website. InnoCraft Ltd also processes personal data on our behalf in the form of IP addresses and information about interaction with our website. 

The setting of cookies and the further processing of personal data described here takes place with your consent. The legal basis for data processing in connection with the Matomo service is therefore Art. 6 para. 1 lit. a GDPR. You can withdraw this consent at any time via our Consent Management Tool with effect for the future. Further information on data protection at Matomo can be found in the privacy policy of InnoCraft Ltd at https://matomo.org/matomo-cloud-privacy-policy/.

III. Data processing on our social media pages

We have a company page on several social media platforms. In this way, we would like to offer further opportunities for information about our company and for dialogue. Our company has company pages on the following social media platforms:

  • Facebook of Meta Platforms Ireland Limited, (Ireland, EU), hereinafter referred to as “Meta”
  • LinkedIn of LinkedIn Ireland Unlimited Company, (Ireland, EU), hereinafter referred to as “LinkedIn”

When you visit or interact with a profile on a social media platform, personal data about you may be processed. The information associated with a social media profile used also regularly constitutes personal data. This also includes messages and statements made using the profile. In addition, certain information is often automatically collected during your visit to a social media profile, which may also constitute personal data.

1. Visiting a social media page

When you visit our social media page, which we use to present our company or individual products from our range, certain information about you is processed. The operators of the social media platforms are solely responsible for this processing of personal data. Further information on the processing of personal data can be found in their privacy policies, which we link to below:

The operators of the social media platforms collect and process event data and profile data and provide us with statistics and insights for our pages in anonymised form, with the help of which we gain knowledge about the types of actions that people take on our site (so-called “page insights”). These Page Insights are created on the basis of certain information about people who have visited our site. This processing of personal data is carried out by the social media operators and us as joint controllers. The processing serves our legitimate interest in analysing the types of actions taken on our site and improving our site based on these findings. The legal basis for this processing is Art. 6 para. 1 lit. f GDPR.

We cannot assign the information obtained via Page Insights to individual user profiles that interact with our pages. We have entered into agreements with the operators of the social media platforms on processing as joint controllers, in which the distribution of data protection obligations between us and the operators is specified. Details on the processing of personal data for the creation of Page Insights and the agreement concluded between us and the operators can be found at the following links:

You also have the option of asserting your rights against the operators. You can find further information on this under the following links:

We have agreed with the operators that the Irish Data Protection Commission is the lead supervisory authority overseeing the processing for Page Insights. You always have the right to lodge a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or any other supervisory authority.

2. Communication via social media pages

We also process information that you have made available to us via our company page on the respective social media platform. Such information may be the username used, contact details or a message to us. This processing is carried out by us as the sole controller. We process this data on the basis of our legitimate interest in contacting enquiring persons. The legal basis for data processing is Art. 6 para. 1 lit. f GDPR. Further data processing may take place if you have given your consent (Art. 6 para. 1 lit. a GDPR) or if this is necessary to fulfil a legal obligation (Art. 6 para. 1 lit. c GDPR).

IV. Further data processing

1. Contact by e-mail

If you send us a message via the contact email provided, we will process the data transmitted for the purpose of responding to your enquiry. We process this data on the basis of our legitimate interest in contacting enquirers. The legal basis for data processing is Art. 6 para. 1 lit. f GDPR.

2. Business partner and interested party data

If you contact our company as a business partner or interested party, we process your data to the extent necessary to establish or fulfil the contractual relationship. This regularly includes the processing of the personal master data, contract data and payment data provided to us as well as contact and communication data of our contact persons for commercial customers and business partners. The legal basis for this processing is Art. 6 para. 1 lit. f GDPR.

We also process business partner and interested party data for evaluation and marketing purposes. This processing is carried out on the legal basis of Art. 6 para. 1 lit. f GDPR and serves our interest in further developing our offer and informing you specifically about our offers. Further data processing may take place if you have given your consent (Art. 6 para. 1 lit. a GDPR) or if this is necessary to fulfil a legal obligation (Art. 6 para. 1 lit. c GDPR).

3. Use of the e-mail address for marketing purposes

We may use the email address you provide when registering or ordering to inform you about our own similar products and services. The legal basis for this is Art. 6 para. 1 lit. f GDPR in conjunction with Section 7 para. 3 UWG. You can object to this at any time without incurring any costs other than the transmission costs according to the basic tariffs. To do so, you can unsubscribe by clicking on the unsubscribe link contained in each mailing or by sending an e-mail to info@hafencity.com

4. Job applications

If you apply to our company, we will process your application data exclusively for purposes related to your interest in current or future employment with us and the processing of your application. Your application will only be processed and acknowledged by the relevant contact persons at our company. All employees entrusted with data processing are obliged to maintain the confidentiality of your data. If we are unable to offer you employment, we will retain the data you have submitted for up to six months after any rejection for the purpose of answering questions in connection with your application and rejection. This does not apply if statutory provisions prevent deletion, if further storage is necessary for the purpose of providing evidence or if you have expressly consented to longer storage. The legal basis for data processing is Section 26 para. 1 sentence 1 BDSG. If we store your applicant data for longer than six months and you have expressly consented to this, we would like to point out that this consent can be freely withdrawn at any time in accordance with Art. 7 para. 3 GDPR. Such a withdrawal does not affect the lawfulness of the processing that was carried out on the basis of the consent until the withdrawal.

5. Newsletter

You have the option of subscribing to our newsletter mailing list by e-mail. Once you have registered, we will inform you regularly about the latest news on our offers and events (e.g. trade fairs). A valid e-mail address is required to register for the newsletter. If you register for our newsletter by sending an email, we will process personal data such as your email address and your name on the basis of your consent. The processing is based on the legal basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future by contacting us via the above-mentioned channels. The lawfulness of the data processing operations that have already taken place remains unaffected by the withdrawal.

When you register for the newsletter, we save your e-mail address for inclusion in the newsletter mailing list. This is necessary in order to be able to prove that you have given your consent. The legal basis arises from our legal obligation to document your consent (Art. 6 para. 1 lit. c in conjunction with Art. 7 para. 1 GDPR).

6. Feedback on our offers

You have the opportunity to give us feedback on our various offers in digital or analogue form. Participation in these surveys is voluntary and is pseudonymised. For technical reasons, we collect your IP address by default when you participate digitally. In the case of analogue participation, we do not collect any personal data from you unless you provide us with information about yourself in the free text fields.

The processing of personal data is based on our legitimate interest in ensuring and improving the quality of our services. The legal basis is therefore Art. 6 para. 1 lit. f GDPR.

We use the service provider Microsoft Forms from Microsoft Ireland Operations Limited (Ireland, EU) to conduct the digital surveys. When using Microsoft, a transfer of data to the USA cannot be ruled out. Please also note the information in the section “Data transfer to third countries”.

Stand: 2024-08-14

Renew or change your cookie consent
No content