Privacy Policy

Our Privacy Policy

Data processing is an essential part of our work as an IT service provider. Wherever data is stored, processed, and transmitted, data protection and data security must be ensured. This applies equally to data from customers, prospective customers, partners, as well as applicant and employee data. Data protection is the preservation of the personal rights and privacy of every individual and forms the basis for trusting cooperation, thus holding a particularly high value for our company.

The use of the S&N Group AG and its affiliated companies’ websites is generally possible without providing any personal data. However, if you, as a potential data subject, wish to use special services of our company, the processing of personal data may become necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain your consent as the data subject.

The processing of personal data, such as the name, address, email address, or telephone number of a data subject, is carried out in accordance with the requirements of the General Data Protection Regulation (GDPR) and in compliance with applicable national data protection regulations. Through this privacy policy, we aim to inform you about the nature, scope, and purpose of the personal data we process. Furthermore, data subjects are informed about their rights through this privacy policy.

1 Scope and Validity

This privacy policy applies to S&N Group AG and its affiliated companies. These are: S&N Invent GmbH, S&N Abiscon GmbH, 4YOU ABISCON GmbH, S&N Marktsoft GmbH, IT Finance Consulting GmbH, and S&N Marktsoft Kft.

It comes into effect on the date of its publication on the websites of S&N Group AG and its affiliated companies. All previous versions of this privacy policy lose their validity at the time a new version is published.

2 Definitions

The privacy policy of S&N Group AG and its affiliated companies is based on the terms used within the framework of Art. 4 GDPR. Our privacy policy is intended to be readable and understandable for you as a customer or business partner, as well as for all interested parties. For this purpose, we will explain some of the terms used below:

a) Personal Data and Data Subject

Personal data means any information relating to an identified or identifiable natural person (hereinafter ‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Processing

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

c) Restriction of Processing

Restriction of processing means the marking of stored personal data with the aim of limiting their processing in the future.

d) Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

e) Pseudonymisation

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

f) Controller

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

g) Processor

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

h) Recipient

Recipient means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

i) Third Party

Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

j) Consent

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

3 Name and Address of the Controller

The controller within the meaning of the GDPR and other national data protection regulations is:

S&N Group AG
Klingenderstraße 5
33100 Paderborn

Tel.: +49 5251 1581 -0
Fax: +49 5251 1581 71

Internet: www.sn-group.de
Email: info@sn-group.de

4 Address of the Data Protection Officer

The Data Protection Officer of the controller is:

S&N Group AG
Klingenderstraße 5
33100 Paderborn
Email: datenschutz@sn-group.de

For questions and suggestions regarding data protection, we ask data subjects to contact our Data Protection Officer.

5 General Information on Data Processing

5.1 Collection of General Data and Information

The S&N Group website collects a series of general data and information with each access to the website by a data subject or an automated system. This general data and information is stored in the server’s log files. The following may be collected:

• the browser types and versions used,
• the operating system used by the accessing system,
• the website from which an accessing system reaches our website (so-called referrer),
• the sub-websites that are accessed on our website via an accessing system,
• the date and time of an access to the website,
• an Internet Protocol address (IP address),
• the Internet Service Provider of the accessing system, and
• other similar data and information that serve to avert danger in the event of attacks on our information technology systems.

When using this general data and information, S&N Group does not draw conclusions about the data subject. Rather, this information is needed to

• deliver the content of our website correctly,
• optimize the content of our website and its advertising,
• ensure the long-term functionality of our information technology systems and the technology of our website, and
• to provide law enforcement authorities with the information necessary for prosecution in the event of a cyber attack. The anonymously collected data and information are therefore evaluated by S&N Group statistically and furthermore with the aim of increasing data protection and data security in our company, ultimately to ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.

5.1.1 Matomo Web Analytics

This website uses the open-source web analytics service Matomo for statistical analysis of our website usage. Matomo is operated on S&N Group’s own servers. The analysis serves exclusively to evaluate the use of our website and to technically and content-wise improve our information offering. Matomo is used in a data protection-friendly configuration. No cookies are used to recognize visitors. Permanent recognition of individual users does not occur. Processing takes place without the creation of personal user profiles. The IP address is anonymized or shortened before evaluation. The collected data remains exclusively on our own systems and is not passed on to third parties.

5.2 Scope of Processing Personal Data

We collect and process personal data of data subjects only if this is necessary for the provision of services, for the functional maintenance of services, or due to contractual requirements. The processing of personal data only takes place after the consent of the respective data subject, unless a legal basis already exists. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of data is legally permitted or required.

5.3 Legal Basis for Processing Personal Data

Insofar as we obtain the consent of the data subject for processing operations of personal data, Art. 6 para. 1a of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

For the processing of personal data necessary for the performance of a contract to which the data subject is party, Art. 6 para. 1b GDPR serves as the legal basis. This also applies to processing operations necessary for carrying out pre-contractual measures.

Insofar as the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 para. 1c GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1d GDPR serves as the legal basis.

If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and where such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, Art. 6 para. 1f GDPR serves as the legal basis for processing.

5.4 Rights of Data Subjects

If your personal data is processed by us as the controller, you are a data subject within the meaning of the GDPR, and as such, the European legislator of directives and regulations has granted every data subject the following rights vis-à-vis the controller:

5.4.1 Right of Access

• The right to obtain confirmation as to whether or not personal data concerning them are being processed.
• The right to obtain information about the personal data processed concerning them and to receive a free copy of this information.
• The data subject is entitled to the following information:

1. the purposes of the processing
2. the categories of personal data concerned
3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
5. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing concerning the data subject or to object to such processing
6. the right to lodge a complaint with a supervisory authority
7. where the personal data are not collected from the data subject, any available information as to their source
8. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
   Furthermore, the data subject has a right to obtain information as to whether personal data are transferred to a third country or to an international organisation.

In addition, the right to obtain information about the appropriate safeguards relating to the transfer of personal data to a third country or international organisations.

5.4.2 Right to Rectification

• The right to obtain without undue delay the rectification of inaccurate personal data concerning them; and, taking into account the purposes of the processing, the right to have incomplete personal data completed, including by means of providing a supplementary statement.

5.4.3 Right to Erasure (‘Right to be Forgotten’)

• The right to obtain the erasure of personal data concerning them without undue delay, provided that one of the following grounds applies and insofar as the processing is not necessary:

1. The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
2. The data subject withdraws consent on which the processing is based according to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, and where there is no other legal ground for the processing.
3. The data subject objects to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 para. 2 GDPR.
4. The personal data have been unlawfully processed.
5. The erasure of the personal data is necessary for compliance with a legal obligation in Union or Member State law to which the controller is subject.
6. The personal data have been collected in relation to the offer of information society services referred to in Art. 8 para. 1 GDPR.

Where S&N Group has made the personal data public and is obliged pursuant to Art. 17 para. 1 GDPR to erase the personal data, S&N Group, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data, insofar as the processing is not required.

5.4.4 Right to Restriction of Processing

• The right to obtain restriction of processing where one of the following applies:

1. The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
2. The processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use.
3. The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
4. The data subject has objected to processing pursuant to Art. 21 para. 1 GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.
   If one of the aforementioned conditions is met and a data subject requests the restriction of personal data processed by the controller, the controller will initiate appropriate restrictive measures.

5.4.5 Right to Data Portability

• The right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the current controller to which the personal data have been provided, where

1. the processing is based on consent pursuant to Art. 6 para. 1a GDPR or Art. 9 para. 2a GDPR or on a contract pursuant to Art. 6 para. 1b GDPR and
2. the processing is carried out by automated means.

• In exercising their right to data portability pursuant to Art. 20 para. 1 GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible and where this does not adversely affect the rights and freedoms of others.
• This right to data portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

5.4.6 Right to Object

• The right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on Art. 6 para. 1e or f GDPR, including profiling based on those provisions. S&N Group shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
• Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing.
• If the data subject objects to processing for direct marketing purposes, S&N Group shall no longer process the personal data for these purposes.
• Furthermore, the data subject has the right, on grounds relating to their particular situation, to object to processing of personal data concerning them for scientific or historical research purposes or statistical purposes pursuant to Art. 89 para. 1 GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
• In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.

5.4.7 Automated Individual Decision-Making, Including Profiling

• The right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning them or similarly significantly affects them.
• The aforementioned right shall not apply if:

1. the decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, or
2. is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or
3. is based on the data subject’s explicit consent.

If the decision is necessary for entering into, or performance of, a contract between the data subject and the controller, or is based on the data subject’s explicit consent, S&N Group shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

5.4.8 Right to Withdraw Data Protection Consent

The right to withdraw consent to the processing of personal data at any time.

To implement the aforementioned rights of data subjects, any data subject may contact the S&N Group Data Protection Officer or the contact person responsible for processing. If the Data Protection Officer or the contact person responsible for processing cannot directly implement the request, they will comply with the legal claim by initiating the necessary steps.

6 Use of Cookies

The S&N Group websites use cookies. Cookies are small text files that are stored and saved on a computer system via an internet browser.

Numerous internet pages and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a string of characters through which internet pages and servers can be assigned to the specific internet browser in which the cookie was stored. This allows visited internet pages and servers to distinguish the individual browser of the data subject from other internet browsers that contain other cookies. A specific internet browser can be recognized and identified via the unique cookie ID.

Most of the cookies we use are so-called “session cookies”. They are automatically deleted after your visit. Cookies do not cause any damage to your computer and do not contain viruses.

On this website, we use technically necessary cookies and storage data (e.g., from our CMS WordPress) to ensure the functionality, stability, and security of the website. These storage accesses are permissible without prior consent according to § 25 para. 2 no. 2 TDDDG.

Through the use of cookies, S&N Group can provide users of this website with more user-friendly services that would not be possible without the cookie setting. In addition, the information and offers on our website can be optimized in the interest of the user.

Many internet browsers are set to automatically accept cookies. The data subject can prevent the setting of cookies by our website at any time by means of a corresponding setting of the internet browser used and thus permanently object to the setting of cookies. Furthermore, already set cookies can be deleted at any time via an internet browser or other software programs. This is possible in all common internet browsers. If the data subject deactivates the setting of cookies in the internet browser used, not all functions of our website may be fully or optimally usable.

7 Registration

S&N Group offers the possibility for you to register with us by providing personal data. Which personal data will be transmitted for further use and processing depends on the respective requirement and the purpose of registration. The personal data entered by you, the data subject, will be collected and stored exclusively for internal use by us, the controller, and for our own purposes. A transfer to one or more processors (third parties) will only take place if they also use the personal data exclusively for internal use attributable to us (the controller).

If registration takes place on our website, the IP address of the data subject, the date, and the time of registration will be stored. The storage of this data serves to protect against misuse. In the event of a criminal offense or other legal violation, the data can be used for tracking and clarification upon legal order. This data will generally not be passed on to third parties, unless there is a legal obligation to do so or the transfer serves criminal prosecution or legal enforcement.

The registration of the data subject with voluntary provision of personal data enables us to offer you, as the data subject, content or services that, by their nature, can only be offered to registered users. In addition, we use the information for further marketing purposes, which include telephone contact, sending information and promotional material by post and email.

The rights listed in the chapter “Rights of Data Subjects” remain unaffected and apply to all registered and thus affected persons.

8 Data Processing in the Application and Employment Procedure

S&N Group collects and processes the personal data of applicants for the purpose of handling the application process. Processing can also take place electronically. This is particularly the case if an applicant submits corresponding application documents electronically, for example by email, to the controller.

If the controller concludes an employment contract with an applicant, the transmitted data will be stored for the purpose of handling the employment relationship in compliance with legal regulations.

If no employment contract is concluded, the application documents will be automatically deleted six months after notification of the rejection decision, unless other legitimate interests of the controller prevent deletion. Other legitimate interests in this sense include, for example, a burden of proof in proceedings under the General Equal Treatment Act (AGG).

9 Data of Customers, Prospective Customers, and External Service Providers

S&N Group collects and processes the personal data of customers and prospective customers, as well as external consultants, for the performance of a contract or for carrying out pre-contractual measures in accordance with Article 6 b) GDPR. For external consultants, this includes the use of data for joint project acquisition. If no contractual relationship has been established, data processing for contact and maintenance of contact is possible in accordance with Article 6 f). Furthermore, data may be stored due to legal obligations under Article 6 c).

Only data that we have received from you and that is related to the aforementioned purposes will be processed.

10 Use of Social Media

The S&N Group website uses plug-ins from social media networks such as Instagram, Xing, LinkedIn, Facebook, Twitter, and YouTube. These plug-ins are recognizable by logos or other appropriate indications of the respective platform and can be used to address our external “sites”.

When you select one of the plug-ins, direct connections are established between your browser and the chosen social media provider. As the controller of our website, we have no access to the data sent and received during this communication.

If you log in to the previously selected social media network simultaneously or at a later time, the plug-ins can link the previously obtained information with your user account there. This means that the information is assigned to you as an individual. An active plug-in input (confirmation in the sense of “like” or comments, messages also results in a personal assignment. Depending on the social media network, for example, the following data can be transferred and stored:

• IP address
• Browser and operating system information
• Installed browser add-ons / plug-ins
• Visitor origin (e.g., whether a link was followed) “Referrer”
• Visited pages (URLs)

S&N Group has neither knowledge nor control over the data in the respective social media network. Your personal data and related content in social media networks are not subject to the scope of this privacy policy. At this point, reference must be made to the respective privacy policies of the network operators. In the following table, we inform you about the social media network operators (URLs and links to the privacy policy) whose plug-ins are used on the S&N Group website.

Social Media Network	Web Address	Privacy Policy
Facebook (Meta)	www.facebook.com	Facebook Privacy Policy
Google	www.google.com	Google Privacy Policy
LinkedIn	www.linkedin.com	LinkedIn Privacy Policy
Xing	www.xing.com	Xing Privacy Policy
YouTube	www.youtube.com	YouTube Privacy Policy
Instagram	www.instagram.com	Instagram Privacy Policy

10.1.1 Linking to Google Maps

On our website, we use links to Google Maps to help you find your way to our locations. When you click on such a link, you leave our website and are redirected to Google Maps.

The Google privacy policy applies to the processing of personal data by Google when visiting Google Maps.

10.1.2 Linking to YouTube

Videos from the YouTube platform are embedded on our website. YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The YouTube videos are provided via a privacy-friendly embedding. When a page with an embedded YouTube video is accessed, no connection to YouTube’s servers is established initially. Only when you actively start playing the video or activate the embedding, a connection to YouTube is established.

11 Information or Questions about the Privacy Policy

Your trust is important to us. Therefore, we want to be available to answer your questions regarding the processing of your personal data at any time. If you have questions that this privacy policy could not answer, or if you would like more in-depth information on a specific point, please contact the Data Protection Officer of S&N Group AG at any time.

Please note that only questions regarding data protection and its understanding with respect to this privacy policy will be accepted, processed, and answered.

Questions about our services or topics not relevant to data protection will not be answered here. For such questions, please use the contact addresses provided on our website.