Privacy policy

1) Introduction and contact details of the controller

1.1 Thank you for visiting our website and for your interest. Below we inform you how we handle your personal data when you use our website. Personal data is any data by which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is ep-cm project management GmbH, Burgplatz 11, 40213 Düsseldorf, Germany, phone: +49 (0)211 5667 7754, fax: +49 (0)211 5667 7323, e-mail: office@ep-cm.com. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data collected when you visit our website

2.1 When you use our website for information only, i.e. if you do not otherwise transmit information to us, we only collect the data that your browser transmits to the server (so-called “server log files”). When you visit our website, we collect the following data, which we need for technical reasons in order to display the website to you:

• Our website visited
• Date and time of access
• Amount of data sent in bytes
• Source/referrer from which you reached the page
• Browser used
• Operating system used
• IP address used (anonymised where applicable)

Processing is based on Art. 6(1)(f) GDPR, on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to check the server log files retrospectively if there are specific indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the string “https://” and the padlock symbol in your browser’s address bar.

3) Hosting

To host our website and display its content, we use a provider that provides its services itself or through selected subcontractors exclusively on servers within the European Union. All data collected on our website is processed on these servers. We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties.

4) Cookies and audience measurement

This website does not set any cookies and does not use any analytics, advertising or tracking services. No audience measurement takes place. For this reason there is no consent banner either.

If you click on a link to the contact or application form, the website adds to the address of the form page which page and which button you came from (see section 5). This information is not stored in your browser and only reaches us if you send the e-mail yourself.

Should this change, we will update this policy beforehand and – where required – obtain your consent.

5) Contacting us

5.1 When you contact us (e.g. via the contact form, by e-mail or by phone), personal data is processed exclusively for the purpose of handling and answering your enquiry and only to the extent necessary for this. The legal basis for processing this data is our legitimate interest in answering your enquiry pursuant to Art. 6(1)(f) GDPR. If your enquiry is aimed at concluding a contract, Art. 6(1)(b) GDPR is an additional legal basis. Your data will be deleted once the circumstances show that the matter has been conclusively resolved and provided that no statutory retention obligations apply.

5.2 The form on the contact page does not transmit your details to our server. The send button opens your own e-mail program with a prepared message; your details only leave your computer when you send the e-mail yourself. The end of the message states which page of our website and which button you used to open the form. This shows us which routes to us are used. You can see this information before sending and can delete it.

6) Applications

6.1 Under “Careers” on our website we list open positions. You can apply by e-mail to jobs@ep-cm.com or via the form on the Apply now page. This form does not transmit any data to our server either, but opens your e-mail program; you attach your documents there yourself. As with the contact form, the end of the message states which page and which button you used to open the form.

6.2 Once an application has been received, the data is stored and evaluated exclusively for the purpose of processing the application. If we have questions, we use the applicant’s e-mail address or phone number. Processing is based on Art. 6(1)(b) GDPR; going through the application process counts as the initiation of an employment contract.

6.3 Where special categories of personal data within the meaning of Art. 9(1) GDPR (e.g. health data such as information on a severe disability) are requested in the application process, they are processed in accordance with Art. 9(2)(b) GDPR so that we can exercise the rights and fulfil the obligations arising from employment law and social security and social protection law. Cumulatively or alternatively, the processing of special categories of data may also be based on Art. 9(2)(h) GDPR where it is carried out for the purposes of preventive or occupational medicine, for the assessment of working capacity, for medical diagnosis, for the provision of health or social care or treatment, or for the management of health or social care systems and services.

6.4 If an applicant is not selected or an application is withdrawn early, the data submitted and all electronic correspondence, including the application e-mail, will be deleted after appropriate notification, at the latest after 6 months. This period is based on our legitimate interest in answering any follow-up questions about the application and, where applicable, in meeting our obligations to provide evidence under the rules on equal treatment of applicants.

6.5 If an application is successful, the data provided will be processed on the basis of Art. 6(1)(b) GDPR for the purpose of carrying out the employment relationship.

7) Fonts and external content

All fonts, graphics, icons and scripts used on this website are delivered via our hosting provider (see section 3). There is no connection to Google Fonts or other font services. On some pages we link to our clients’ websites and to external sources. Only when you click on such a link does the respective provider receive data from you; we have no influence on its processing.

8) Rights of the data subject

8.1 Applicable data protection law grants you the following data subject rights (rights of information and intervention) vis-à-vis the controller with regard to the processing of your personal data; for the respective conditions of exercise, please refer to the legal basis cited:

• Right of access pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to notification pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to withdraw consent pursuant to Art. 7(3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

9) Retention period of personal data

The retention period of personal data depends on the respective legal basis, the purpose of processing and – where relevant – the applicable statutory retention period (e.g. retention periods under commercial and tax law).

Where personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.

Where statutory retention periods exist for data processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods have expired, provided it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in continuing to store it.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(2) GDPR.

Unless the other information in this policy on specific processing situations states otherwise, stored personal data is deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Go to the legal notice