In addition to Google Ireland Limited, the data may also be transmitted to the following recipients in the USA in the frame of processing:

Google LLC.

Alphabet Inc.

Insofar as personal data is transferred to Google servers in the USA and stored and processed there, the EU Commission's adequacy decision for the USA serves as the basis for the transfer of data to a third country. This certifies that the USA has an equivalent level of data protection to the EU standard.

Further information on the use of data by Google can be found at

http://www.support.google.com/analytics/answer/6004245 and at

http://www.google.com/policies/privacy/partners/.

You can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=de ).

As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent Google Analytics from collecting data by clicking on https://tools.google.com/dlpage/gaoptout. An opt-out cookie will be set to prevent the future collection of your data when you visit this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie again.

Google Adwords conversion tracking

We also use Google Conversion Tracking to statistically record the use of our website and to evaluate it for the purpose of optimizing our website for you. Google Adwords places a cookie (see section 4) on your computer if you have reached our website via a Google ad. These cookies lose their validity after 30 days and are not used for personal identification. If the user visits certain pages of the Adwords customer's website and the cookie has not yet expired, Google and the customer can recognize that the user clicked on the ad and was redirected to this page.
Each Adwords customer receives a different cookie. Cookies can therefore not be tracked via the websites of Adwords customers. The information collected using the conversion cookie is used to generate conversion statistics for Adwords customers who have opted for conversion tracking. Adwords customers are told the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information with which users can be personally identified.

Insofar as personal data is transferred to Google servers in the USA and stored and processed there, the EU Commission's adequacy decision for the USA serves as the basis for the transfer of data to a third country. This certifies that the USA has an equivalent level of data protection to the EU standard.

If you do not wish to participate in the tracking process, you can alternatively reject the setting of a cookie required for this - for example, by using a browser setting that generally deactivates the automatic setting of cookies. You can also deactivate cookies for conversion tracking by setting your browser to block cookies from the domain "www.googleadservices.com". You can find Google's privacy policy on conversion tracking here: https://services.google.com/sitestats/de.html

HubSpot

In the frame of our marketing and communication efforts, we use various services of HubSpot Germany GmbH, located at Am Postbahnhof 17, 10243 Berlin ("HubSpot"), the German branch of HubSpot, Inc. headquartered in the USA. These services are used to optimize the functionality of our website and to offer, provide and continuously improve our services. We have taken particular care in selecting this third-party provider, taking into account the applicable data protection regulations.

HubSpot processes personal data in the frame of our order and on the basis of an order processing contract. This data is stored by HubSpot Germany GmbH in a data center within the EU. You can find more information on this at: Link to HubSpot's notes on the EU data center.

It is stipulated that HubSpot is contractually obliged to comply with European data protection regulations even if personal data is transferred to countries outside the EU.

Since a transfer to companies outside the EU is possible, additional protective measures are taken to ensure the data protection level of the GDPR. For the USA, an adequacy decision of the EU Commission is available if the company is certified according to the EU-U.S. Data Privacy Framework. HubSpot, Inc. fulfills this certification and undertakes to comply with appropriate data protection standards, as can be viewed at www.dataprivacyframework.gov/s/participant-search. For transfers to third countries, standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR are agreed to ensure adequate data protection. Further information on data processing by HubSpot can be found here: https://legal.hubspot.com/de/privacy-policy

Further information on the processing of personal data by HubSpot can be found in HubSpot's privacy policy: https://www.hubspot.de/data-privacy/gdpr

HubSpot Analytics

We use HubSpot Analytics from HubSpot as an analysis service for the statistical evaluation of our website. HubSpot uses cookies and other browser technologies that enable an analysis of user behavior and recognize the respective user. The information collected, such as the IP address, geographical location, type of browser, duration of the visit and pages accessed, is analyzed by HubSpot on our behalf in order to compile reports on your activities on our website.

Data is processed with the help of HubSpot Analytics for the purpose of optimizing our website and for marketing purposes, based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG.

We only process your personal data for as long as there is a legal basis for doing so. Processing generally takes place for the duration required to achieve the purpose of processing. Additional information on the storage period can be found in HubSpot's privacy policy, which you received as part of your consent and is also available at the following link: https://www.hubspot.de/data-privacy/gdpr

Microsoft Clarity

We work with Microsoft Clarity and Microsoft Advertising to track how you use and interact with our website using behavioral metrics, heatmaps and session recordings to improve and market our products and services. Microsoft Clarity collects data about the behavior of website users that may contain potentially personally identifiable information. This includes, for example, IP addresses, click paths, mouse movements, etc. Website usage data is collected using first- and third-party cookies and other tracking technologies to determine the popularity of products/services and online activities. We also use this information to optimize the website, for fraud/security purposes and for advertising. For more information about how Microsoft collects and uses your data, please refer to the Microsoft Privacy Statement

6. presence on social media platforms

We operate publicly accessible profiles on social networks. You can find the individual social networks we use below. No social media elements are embedded on this website. We only link to our presence on social media.

If our website contains icons from social media providers such as Facebook, Instagram, we use these to passively link to the pages of the respective providers. If you click on these links, you will leave our website. Data processing on the websites of social media providers is subject to the data protection provisions available there.

Social networks such as Facebook, LinkedIn, etc. can comprehensively analyze your user behavior. When you visit our social media presences, the following data protection-relevant processing operations are triggered:

If you are logged into your social media account and visit our profile, the operator of this social medium can track this visit.

Irrespective of this, the operator may also process your data (e.g. IP address) under certain circumstances if you are not logged into your account or do not have an account at all. The operator summarizes this data in user profiles in which your preferences and interests are stored. These profiles are used to display personalized advertising within and outside the respective social media presence. If you have an account with the respective social network, the personalized advertising can be displayed on all devices on which you were or are logged in. Further processing operations may be carried out by the operators of the social media portals, depending on the platform, and we have no influence on this. For details, please refer to the terms of use and privacy policies of the respective social media portals.

Our presence on social media is intended to ensure the broadest possible presence on the Internet within the meaning of Art. 6 para. 1 lit. f GDPR. The analysis processes carried out by the operators of the social networks may be based on different legal bases, which are to be specified by the respective providers.

If you visit one of our social media pages (e.g. Instagram, Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. In principle, you can assert your rights (information, rectification, erasure, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal. Despite the shared responsibility with the operators of the social media portals, we do not have complete influence on the data processing operations of the portals. Our options are largely determined by the corporate policy of the respective provider.

The data collected by us directly via the social media presence will be deleted from our systems as soon as you request us to do so, revoke your consent to storage or the purpose for data storage no longer exists. Mandatory statutory provisions - in particular retention periods - remain unaffected. We have no influence on the storage period of the data collected by the social networks. For details, please contact the operators of the social networks directly.

We use the following social networks: Facebook & Instagram

For details on the collection and storage of your personal data as well as the type, scope and purpose of its use by the operator of the respective social network, please refer to the privacy policy of the respective operator.

Facebook: the joint controller is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. You can view the data protection provisions for Facebook at https://www.facebook.com/about/privacy/update?ref=old_policy

Instagram: the joint controller is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. You can view the privacy policy for Instagram at https://help.instagram.com/155833707900388

a.) YouTube

Our website uses plugins from the video platform YouTube, which belongs to Google. The operator of the service and the plugins is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA.

When you visit one of our pages equipped with a YouTube plugin, a connection to the YouTube servers is established. This tells the YouTube server which of our pages you have visited.

If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.

The use of YouTube is necessary for an appealing and technically functioning presentation of the video content of our online offer.

You can give your consent to the use of YouTube by activating the function in our Consent Manager. The legal basis for the processing of your personal data is therefore your consent in accordance with Article 6(1)(a) GDPR.

We would like to point out that without your consent, you may not be able to use all the functions of our website - in particular the display of video content - to their full extent.

Further information on the handling of user data can be found in YouTube's privacy policy at: https://www.google.de/intl/de/policies/privacy.

b.) LinkedIn

We also use social plug-ins of the social network LinkedIn on our website on the basis of your consent in the Consent Manager in accordance with Art. 6 para. 1 lit. a GDPR in order to make our company better known. For the same reason, we operate Facebook fan pages and Instagram accounts that are linked to from this website. Responsibility for data protection-compliant operation must be guaranteed by their respective providers.

The processing of your personal data in the frame of LinkedIn is based on your consent in accordance with Art. 6 para. 1 lit. a) GDPR if the function is activated in the Consent Manager. Insofar as personal data is transferred to LinkedIn servers in the USA and stored and processed there, the EU Commission's adequacy decision for the USA serves as the basis for the transfer of data to a third country. This certifies that the USA has an equivalent level of data protection to the EU standard.

LinkedIn is a service of the LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. Each time you visit our website, which contains social plug-ins from LinkedIn, your browser downloads a representation of this component from LinkedIn Corporation servers. This tells LinkedIn which page of our website is currently being visited and the calling IP address and any cookies stored in the browser as a result of LinkedIn membership are also transmitted and may be able to identify you directly or make you identifiable.

If you click on elements such as the LinkedIn "Recommend button" while you are logged into your LinkedIn account, LinkedIn is also able to assign your visit to our pages to your LinkedIn user account and thus collect information about your interests and user behavior.

For more information about LinkedIn's data collection and your rights and settings options, please refer to LinkedIn's privacy policy. You can find this information at http://www.linkedin.com/legal/privacy-policy

c.) WhatsApp

Privacy policy on the use of the WhatsApp appointment scheduling function in the application process

If the applicant wishes to make an appointment during the application process via the chat function, this can be done via WhatsApp.
Purpose of processing: For communication purposes, we offer the option of using the WhatsApp messenger to make it easier to contact us.
When using this function, real-time communication takes place via an online chat. We process all data that you share with us during the chat exclusively for the purpose of coordinating appointments and improving our online offering.

The following personal data is collected when the chat is started and carried out:

• Date and time of the call,
• Browser type/version,
• IP address,
• operating system used,
• URL of the previously visited website,
• Amount of data sent,
• Your name, telephone number and desired occupation,
• Content of the communication.

The use of WhatsApp to coordinate appointments is voluntary. Alternatively, you can make the appointment by conventional means (by post or e-mail). Please note that no application documents such as CVs or references may be sent via WhatsApp.

Legal basis for the processing of your data:
If you use this service, the processing of your data is based on your consent, which you can revoke at any time with effect for the future (Art. 6 para. 1 lit. a GDPR). The data processing carried out until the revocation remains lawful.
Please send the revocation to your contact person at Hengst. The saved chats will then be deleted immediately.

Recipients of your data:
Userlike: The service is provided to us by the IT service provider Userlike (Probsteigasse 44-46, 50670 Cologne, Germany), which processes your data for us as a processor. You can find more information here: https://www.userlike.com/de/privacy-policy.
As soon as WhatsApp Business API Provider transfers your data to Userlike, it is processed exclusively on servers in Germany. Communication via WhatsApp is protected by end-to-end encryption. However, WhatsApp has access to communication metadata such as sender, recipient, time and size.

WhatsApp Business:
The controller for the WhatsApp messenger service within the meaning of the GDPR is WhatsApp Ireland; the competent supervisory authority under the GDPR is the Irish Data Protection Authority. We would like to point out that WhatsApp stores data in third countries outside the EU in the frame of use and exchanges it with other services of the provider. We have no influence over this. You can find WhatsApp's data protection information, for example on its processing or on exercising your data protection rights against WhatsApp, here: https://www.whatsapp.com/privacy

Hengst:
Your personal data will be transmitted to the HR department of Hengst by entering it in the WhatsApp chat.
A Hengst employee who contacts you based on your application will conduct a real-time dialog to coordinate an appointment. Any follow-up questions regarding the appointment will also be forwarded to us.

Deletion of your data:
In the event of a rejection, your personal data will be deleted after 6 months.
Further information on the deletion of your data in connection with the application process can be found on our website under the 'Careers' tab: https://www.hengst.com/de/karriere/stellenangebote.

Your rights as a data subject in the application process:
Upon request, we will inform you in writing or electronically whether and which of your personal data is stored by us (right to information in accordance with Art. 15 GDPR) as well as check your submissions for deletion (Art. 17 GDPR), correction (Art. 16 GDPR), restriction of processing (Art. 18 GDPR) and transfer (Art. 20 GDPR) of your personal data and, if the requirements are met, implement them.

Please get in touch with your contact person if you have any queries regarding your applicant data. You can find the relevant information here: https://www.hengst.com/de/karriere/ansprechpartner

For all other data protection-related inquiries, please contact our data protection officer: datenschutz@hengst.de

Right to lodge a complaint
If you believe that your personal data is being processed unlawfully, you can lodge a complaint with a supervisory authority. A list of the respective data protection supervisory authorities and their contact details can be found at the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html

The supervisory authority responsible for us is
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestr. 2-4
40213 Düsseldorf
Telephone: 0211/38424-0
Fax: 0211/38424-999
E-mail: poststelle@ldi.nrw.

7. duration of storage

Unless otherwise stated in the frame of this declaration in individual cases, we only store personal data for as long as is necessary to fulfill the purposes pursued.

Your personal data will be deleted as soon as the purpose of the data processing no longer applies.

If there are legitimate reasons for deletion within the meaning of Art. 17 para. 3 GDPR, such as a legal obligation to retain data, the processing of the data will be restricted during this period. A statutory retention obligation exists, for example, due to documentation obligations under tax and commercial law. In these cases, the data will be deleted when the reason for further storage no longer applies, e.g. when the legally prescribed storage period expires

8. rights of data subjects

You have the right:

- in accordance with Art. 15 GDPR, to request information about your personal data processed by us. In particular, you can request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of appeal, the origin of your data if it was not collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information on its details;
- in accordance with Art. 16 GDPR, to immediately request the correction of incorrect or incomplete personal data stored by us
- in accordance with Art. 17 GDPR, to request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims
- in accordance with Art. 18 GDPR, to demand the restriction of the processing of your personal data if the accuracy of the data is disputed by you, the processing is unlawful, but you refuse to delete it and we no longer need the data, but you need it to assert, exercise or defend legal claims or you have lodged an objection to the processing in accordance with Art. 21 GDPR;
- in accordance with Art. 20 GDPR, your personal data that you have provided to us.