Data privacy regulations

1. General

With this privacy policy, we would like to inform you about how we process personal data. We are aware of the importance of processing personal data for the user concerned and therefore comply with all relevant legal requirements. The protection of your privacy is of the utmost importance to us. It therefore goes without saying that we comply with the statutory provisions on data protection.

The name and contact details of the data controller and, if applicable, their representative:

pilot Hamburg GmbH & Co. KG
Neue Rabenstraße 12, 20354 Hamburg
info(at)pilot.de

Phone: +49 40 30 37 66-0
Fax: +49 40 30 37 66-99
E-mail: info(at)pilot.de

HRA 92916 (Hamburg Local Court)

Personally liable partner:

pilot Hamburg Verwaltungs GmbH

Managing Director with power of representation and Chairman of the Management Board:

Kristian Meinken

You can contact our data protection officer at: datenschutz(at)pilot.de

2. Data collected

We collect and process the following personal data about you:

Contact information
Social media identifiers
Online identifiers

We process your personal data for the following purposes

Contacting you (mailings)
advertising
quality assurance
statistics

Your data is processed on the following legal basis:

Your consent, Art. 6 para. 1 lit. a) GDPR
for the performance of a contract with you, Art. 6 para. 1 lit. b) GDPR
legitimate interests, Art. 6 para. 1 lit. f) GDPR (see below)

When processing your data, we pursue the following legitimate interests

Improvement of our offer
Protection against misuse
statistics

3. Recipients or categories of recipients of personal data

When processing your data, we work with the following service providers who have access to your data:

Web hosting provider
Providers of social media platforms
Advertising networks (for advertisements)
Providers of web analysis tools

4. Duration for which the personal data is stored

We store your data,

if you have consented to the processing at most until you withdraw your consent
if we require the data for the performance of a contract, for no longer than the duration of the contractual relationship with you or statutory retention periods,
if we use the data on the basis of a legitimate interest, at most as long as your interest in deletion or anonymization does not prevail.

5. Data sources

We receive the data from you (including via the devices you use).

6. Data transfer to third countries

If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA)) or if the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this will only take place in accordance with the legal requirements.

Subject to express consent or contractually or legally required transfer, we only process or have the data processed in third countries with a recognized level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

7. Right to information and to rectification or erasure or to restriction of processing or a right to object to processing and the right to data portability

You have the right – in some cases under certain conditions – to

to request information about the processing of your data
to rectify your data,
to have your data deleted or blocked
have the processing restricted,
to object to the processing of your data,
to receive your data in a transferable format and to transmit it to a third party
to withdraw your consent to the processing of your data for the future and
to complain to the competent supervisory authority about unauthorized data processing.

The competent supervisory authority is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI).

Requirement or obligation to provide data:

Unless expressly stated at the time of collection, the provision of data is not required or obligatory.

8. Social Media

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This may result in risks for users because, for example, it could make it more difficult to enforce users’ rights.

Furthermore, user data is generally processed within social networks for market research and advertising purposes. For example, user profiles can be created based on user behavior and the resulting interests of users. The user profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are generally stored on the user’s computer, in which the user’s usage behavior and interests are stored. Furthermore, data can also be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

For a detailed description of the respective forms of processing and the opt-out options, please refer to the data protection declarations and information provided by the operators of the respective networks.

In the case of requests for information and the assertion of data subject rights, we would also like to point out that these can be asserted most effectively with the providers. Only the providers have access to the users’ data and can take appropriate measures and provide information directly. If you still need help, you can contact us.

The legal basis is our legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR insofar as cookies are set in this context, the legal basis is also § 25 TDDDG, Art. 6 para. 1 lit. a) GDPR. We have a legitimate interest in presenting our company online in social media, providing information about us and our work and getting in touch with customers, partners and/or interested parties.

Further information can be found below:

Instagram

Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, parent company: Meta Platforms, Inc, 1 Hacker Way, Menlo Park, CA 94025, USA; Website: https://www.instagram.com; Privacy Policy: https://instagram.com/about/legal/privacy.

Twitter

Service provider: Twitter Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Privacy Policy: https://twitter.com/de/privacy, (Settings) https://twitter.com/personalization.

LinkedIn

Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

9. Further information on data protection

The revocation can be made by deactivating the corresponding selection on our Consent Management Platform, which you can reach via this link.

9.1 Automatic storage of access data

Each time you access the pilot website, the access data of the process is automatically stored in a log file. This is general information, such as the page from which the file was requested, the name of the file accessed, the date and time of access, the amount of data transferred, the protocol used and the descriptions sent by the Internet browser and, if applicable, the operating system.

This general information is anonymized, i.e. it is not stored together with any personal data you may have provided to pilot and is not merged with it in any other way. It is only analyzed for statistical purposes and used to improve the content and functionality of the website. This data is not passed on to third parties for other non-commercial or commercial purposes. Access data is stored in the log file for a maximum of 4 weeks.

9.2 Cookies

This website also uses so-called cookies. A cookie is a text file with an identification number that is transmitted to the user’s computer together with the other data actually requested when you use the website and is stored there. The file is stored there for later access and serves to authenticate the user.

Since cookies are only simple files and not executable programs, they do not pose any danger to the computer. Cookies do not contain any directly personal data, so that the protection of your privacy is guaranteed. Depending on the settings you have selected in your Internet browser, it will automatically accept cookies. However, this setting can be changed and the storage of cookies deactivated or set in such a way that you are notified as soon as a cookie is set. However, if you deactivate the use of cookies, some functions of the website may not be available or may only be available to a limited extent.

We may work together with advertising partners who help us to make our website more interesting for you. For this purpose, cookies from partner companies are also stored on your hard disk when you visit our website (third-party cookies). If we work together with the aforementioned advertising partners, you will be informed individually and separately about the use of such cookies and the scope of the information collected in each case within the following paragraphs.

9.3 Mailings (by post and by e-mail)

If you have subscribed to the mailings of the pilot agency group, pilot will process the personal data you have provided to us in order to inform you about news from the agency group.

You consent to the regular sending of newsletters by e-mail or postal mailings to the contact details provided (postal address, e-mail address). With regard to the newsletter by e-mail, we will first check that you are the owner of the e-mail address provided or that the owner agrees to receive the newsletter. The data processing takes place with your consent on the basis of Art. 6 para. 1 lit. a) GDPR

pilot uses a processor to manage the address data and to send the newsletter. The service provider only has access to the personal information required to fulfill the order. The address data will not be used by the service provider or by pilot itself for other purposes. pilot concludes a corresponding order processing contract with the service provider that meets the requirements of Art. 28, 29 GDPR.

You can object to this processing at any time informally by post to pilot Hamburg GmbH & Co. KG, Neue Rabenstraße 12, D-20354 Hamburg, or by e-mail to the electronic mailbox widerruf(at)pilot.de.

9.4 Use of the analytics tool Google Analytics

We use the Google Analytics service of Google Ireland Limited, Gordon House Barrow Street Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as “Google”). This service enables us to analyze the use of our website and uses cookies for this purpose. For this purpose, the information generated by the cookie, such as your anonymized IP address, is transmitted to a Google server on our behalf, stored there and evaluated. Google Analytics has been extended on this website by the code “gat._anonymizeIp();”. This ensures anonymized collection of IP addresses. As a rule, your IP address is anonymized by Google within the European Union or in other contracting states of the European Economic Area (EEA) by shortening your IP address. In exceptional cases, your IP address will be transmitted to a Google LLC server in the USA and anonymized there. Your IP address transmitted in this way will not be merged with other data from Google LLC.

Remarketing and reports on performance according to demographic characteristics and interests are used as part of the Google Analytics advertising function. The purpose of these procedures is to use information about user behavior to align advertising measures more closely with the interests of the respective user. As part of remarketing, personalized advertising can be placed on other websites based on the user’s surfing behavior on this website. The advertising material may contain products that the user has previously viewed on the website. If you have consented to Google linking your web and app browsing history to your Google account and using information from your Google account to personalize ads, Google will use this data for cross-device remarketing.

Most browsers accept cookies automatically. However, you can prevent the use of cookies by adjusting your browser settings; in this case, however, you may not be able to use all the functions of the website. You must make the settings separately for each browser you use.
You can also prevent the collection and processing of this data by Google LLC by downloading and installing the browser add-on available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de

Alternatively, or within browsers on mobile devices, please click on the following link: Deactivate Google Analytics. This will place an opt-out cookie on your device for our website with effect for the browser you are currently using. If you delete your cookies in this browser, you must click on this link again.

Further information on terms of use and data protection can be found at http://www.google.com/analytics/terms/de.html or at https://policies.google.com/?hl=de.

9.5 Use of Google Adwords

We use the online advertising program “Google Ads” on our website and in this context conversion tracking (visit action evaluation). Google Conversion Tracking is an analysis service of Google Ireland Limited, Gordon House Barrow Street Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as “Google”).

When you click on an advertisement placed by Google, a cookie for conversion tracking is stored on your computer. These cookies have a limited validity (30 days), do not contain any personal data and are therefore not used for personal identification. If you visit certain pages of our website and the cookie has not yet expired, Google and we can recognize that you have clicked on the ad and have been redirected to this page. Each Google Ads customer receives a different cookie. It is therefore not possible for cookies to be tracked via the websites of Ads customers. The information obtained with the help of the conversion cookie is used to create conversion statistics. This tells us the total number of users who clicked on one of our ads and were redirected to a page with a conversion tracking tag. However, we do not receive any information with which users can be personally identified. Your data may be transferred to the USA.

Data processing, in particular the setting of cookies, is carried out with your consent on the basis of Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. The revocation can be made by deactivating the corresponding selection on our Consent Management Platform, which you can reach via the following link: […]. If you do not wish to participate in the tracking process, you can also refuse the setting of a cookie required for this – for example, via your browser settings, which generally deactivate the automatic setting of cookies. You can also deactivate cookies for conversion tracking by setting your browser to block cookies from the domain “googleadservices.com”.

Further information on data protection at Google can be found at https://www.google.com/policies/?hl=de. Users can also deactivate or object to Google ads in whole or in part at http://www.google.com/settings/ads (opt-out).

9.6 Use of Google remarketing for interest-based advertising

By means of the remarketing technology of Google Ireland Limited, Gordon House Barrow Street Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as “Google”), users who have already visited our website are addressed again through interest-based advertising on the pages of the Google Partner Network. The advertisements may contain the products that the user has previously viewed on our website (remarketing). For this purpose, Google Remarketing tracking pixels are integrated on this page, which record user behavior on the website (e.g. websites viewed), the technical characteristics of the website visit (e.g. the browser used, the IP address) and purchasing behavior (e.g. websites last visited) without personal reference and transmit them to Google. Google uses cookies for the purpose of recognizing and assigning users. If users have consented to their web and app browsing history being linked by Google to their Google account and information from the Google account being used by us to personalize ads they see on the web, Google uses data from these logged-in users together with its own collected data to create and define target group lists for cross-device remarketing. To support this function, Google Analytics collects authenticated IDs of these users. This personal data from Google is temporarily linked with Google Analytics data from us in order to create target groups.

More information and options for deactivating this ad placement can be found at http://www.google.com/settings/u/0/ads/anonymous?hl=de.

9.7 Use of LinkedIn functionalities

On this website, we use LinkedIn social plugins from LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). You can recognize these by the LinkedIn logo.

If you activate such a social plugin integrated on our website, LinkedIn receives the information that your browser has accessed the corresponding page of our website and that you have interacted with the social plugin. LinkedIn uses cookies for this purpose. You can find detailed information on the use of cookies at https://www.linkedin.com/legal/cookie-policy.

If you are logged in to LinkedIn, LinkedIn can assign your visit to our website to your LinkedIn profile. If you do not want LinkedIn to associate the data collected via our website directly with your LinkedIn profile, you can log out of LinkedIn before visiting our website. You can object to the analysis of usage behavior and targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Data processing is carried out with your consent on the basis of Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future via our consent management platform, which you can access here, without affecting the lawfulness of processing based on consent before its withdrawal. In addition, you can withdraw your consent by adjusting your browser settings accordingly or via LinkedIn: https://www.linkedin.com/psettings/. You can also opt out of user-based advertising via the Network Advertising Initiative opt-out page (http://optout.networkadvertising.org/), the US website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/). You can use the archive request function to request information about the data LinkedIn processes about you: https://www.linkedin.com/psettings/member-data.

It cannot be ruled out that LinkedIn may transfer data to the USA for storage and further processing. If such a data transfer to the USA takes place, this is based on the standard contractual clauses of the EU Commission or on the DPF.: https://www.linkedin.com/legal/l/dpa.

For more information on how LinkedIn processes personal data, including how to exercise your data subject rights, please refer to LinkedIn’s privacy policy at https://www.linkedin.com/legal/privacy-policy.

Each time one of our pages containing LinkedIn functions is accessed, a connection to LinkedIn servers is established. LinkedIn is informed that you have visited our website with your IP address. If you are logged into your LinkedIn account, LinkedIn is able to associate your visit to our website with you and your user account. As the provider, we have no knowledge of the content of the transmitted data or its use by LinkedIn. However, the LinkedIn Insight Tag allows us to obtain information about visitors to our website. For example, we can analyze the key professional data (e.g. career level, company size, country, location, industry and job title) of users registered with LinkedIn and better align the pages with target groups. We can also measure whether visitors make purchases or take other actions (conversion measurement), which can also be done across devices. With the retargeting function, we can display targeted advertising to visitors to our websites outside the website; according to LinkedIn, the advertising addressee is not identified. LinkedIn also collects log files (URL, referrer URL, IP address, device and browser properties and time of access). IP addresses are shortened or hashed. The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days, the remaining pseudonymized data within 90 days. As the website operator, we cannot assign the data collected by LinkedIn to specific individuals. LinkedIn may store the personal data of website visitors on its servers in the USA and use it for its own advertising purposes.

Data processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR only with the corresponding consent; consent can be revoked at any time. The revocation can be made by deactivating the corresponding selection on our consent management platform, which you can reach via this link.

You can object to the analysis of usage behavior and targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

In the LinkedIn account settings, logged-in members can control the use of their data for advertising purposes. To prevent data collected on our website from being linked to your LinkedIn account, log out of your LinkedIn account before visiting the websites.

Data transfer to the USA is based on the EU Commission’s standard contractual clauses: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

Further information on this can be found in LinkedIn’s privacy policy at: https://www.linkedin.com/legal/privacy-policy

9.8 Verwendung von Trustpid

This website may show you personalized advertising and content based on a marketing identifier. TrustPid is a service provided by Vodafone Sales and Services Limited whose registered office is at Vodafone House, The Connection Newbury, Berkshire RG14 2FN.

If you have given us your consent to do so, we will receive a marketing identifier (“TrustPID”) from your network operator, which it has generated on the basis of your unique network identifier, and process it so that we can recognize you when you visit our website. This enables us to show you content and product offers that match your interests. For this purpose, we transmit your IP address to your network operator.

The legal basis for data processing is your consent in accordance with Art. 6 para. 1 lit. a) GDPR. You can revoke and manage your consent at any time with effect for the future [here: link to your consent manager] or via the data protection portal [https://trustpid.com].

You can find more information in the Trustpid privacy policy [https://trustpid.com/privacynotice].

9.9 Use of Usercentrics

On this website, we use the Usercentrics Consent Management Platform as a consent management tool in the context of analytics activities. This is a service provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany.

The Usercentrics Consent Management Platform collects log file and consent data using JavaScript. This JavaScript makes it possible to inform users about their consent to certain tags on our website and to obtain, manage and document this consent.

We process the following data:

(1) Consent data (anonymized logbook data (consent ID, service ID, controller ID), consent status, timestamp)

(2) Device information (including truncated IP addresses, device information, timestamps)
(3) User data (including e-mail, ID, browser information, settings ID, changelog)

The consent ID (contains the above-mentioned data) and the consent status with time stamp are stored in the local memory of your browser and simultaneously on the cloud servers used. Further processing will only take place if you submit a request for information or revoke your consent. In this case, the corresponding information is provided in a compact data format in an easily readable text form for the purpose of data exchange (JSON file).

No user information is stored for the statistics on the use of the consent given or not given. Only the frequency and locations of clicks are stored.

The purpose of data processing is to analyze, manage and verify the consents given in order to comply with our obligation to manage consents in accordance with the GDPR.

The specific purposes of processing personal data are
(1) Obtaining and providing consent
(2) Providing proof of which device you used to provide consent and at what time
(3) Ensuring access to settings and documenting changes

The legal basis for the management of your consent to the processing of your personal data is Art. 6 para. 1 lit. c and f GDPR. Our legitimate interest lies in the legally compliant documentation and verifiability of consent, the management of marketing measures based on the consent given and the optimization of consent rates.

The data is always deleted as soon as it is no longer required. The cookie used has a duration of 60 days. The data relating to revoked consent is stored for a period of three years. This retention period is based, on the one hand, on our accountability obligation pursuant to Art. 5 para. 2 GDPR and, on the other hand, on the limitation period pursuant to Section 195 BGB. This begins at the end of the year of consent or revocation and ends three years later.

You can find the current privacy policy of Usercentrics at: https://usercentrics.com/de/datenschutzerklaerung/

The function can be switched on and off in our “Privacy settings” by selecting the checkbox.

9.10 Use of Hubspot

We use HubSpot for marketing activities on our website. HubSpot is a software company from the USA with a branch office HubSpot Ireland Limited in 2nd Floor 30 North Wall Quay, Dublin 1, Ireland.

We use this integrated software solution for analysis purposes. HubSpot uses cookies, small text files that are stored locally in the cache of your web browser on your end device and enable us to analyze your use of the website. HubSpot evaluates the information collected (e.g. IP address, geographical location, type of browser, duration of the visit and pages accessed) on our behalf so that we can generate reports on the visit and the pages visited.

Information collected by HubSpot and the content of our website is stored on the servers of HubSpot’s service providers. If you have given your consent to this in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, the processing on this website is carried out for the purpose of website analysis.

Since HubSpot may transfer personal data to affiliated companies and subcontractors in countries outside the EU and the EEA, further protective mechanisms are required to ensure the level of data protection required by the GDPR. For the USA, there is an adequacy decision of the EU Commission pursuant to Art. 45 para. 1 GDPR with regard to companies with certification under the EU-U.S. Data Privacy Framework. HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework and is therefore committed to complying with appropriate data protection standards, which can be viewed at the following link: www.dataprivacyframework.gov/s/participant-search. For potential transfers to other third countries outside the EU and the EEA for which there is no adequacy decision by the EU Commission, standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR are also agreed. These oblige the recipient of the data in the third country to process the data in accordance with the level of protection in Europe.

The data will be deleted as soon as it is no longer required for the purpose for which it was collected.

You can permanently object to the collection of data by HubSpot and the setting of cookies by preventing the storage of cookies through your browser settings. You can object to the processing of your personal data at any time with effect for the future.

9.11 Use of Reddit

We use the tracking pixel of the provider Reddit, Inc. (USA) on our website to display interest-based advertising on the Reddit platform. We use Reddit Inc. cookies on our website for conversion measurement and retargeting purposes so that our advertisements on the Reddit platform are displayed as accurately as possible and we receive feedback on the success of our advertisements.

This use of cookies and comparable technologies and the further use of the data only takes place with your consent. The legal basis is Art. 6 (1) (a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

You can find more information about the processing of data when using Reddit at https://www.redditinc.com/policies/privacy-policy.

Would you like more information on this topic?

Then please contact us directly: datenschutz(at)pilot.de