Privacy Policy

The protection of your personal data (“Data”) is very important to us. Below, we provide information about how we handle your data when you use our website https://esis-medical.de.

Data refers to specific details about the personal or factual circumstances of an identified or identifiable natural person. This includes information such as a person’s legal name, address, phone number, and date of birth.

Our Privacy Policy is based on the General Data Protection Regulation (“GDPR”) and the Federal Data Protection Act (“BDSG”). The technical terms we use correspond in meaning to the GDPR definitions of these terms.

We would like to draw your attention in particular to the definitions of terms in Article 4 of the GDPR.

1. Data Controller

Data controller as defined by the General Data Protection Regulation:

Mr. Frank Michaelis,
, operating under the business name Michaelis Personalberatung and owner of the ESiS Medical brand,
, Thomasiusstraße 5, 10557 Berlin,
, Tel: +49 (0)30 39 06 309-0
Fax: +49 (0)30 39 06 309-29
Email: info[at]esis-medical.de

Tax ID No.: DE237401516

If the processing involves, for example, joint controllership (Art. 26(1) of the GDPR), a note to that effect can be found in the relevant subsection.

2. Data Protection Officer

You can contact our Data Protection Officer at datenschutzbeaufragter@esis-medical.de or via our mailing address.

3. We collect data from the following categories:

• Personal identification data such as names and addresses;
• Electronic identification data such as IP addresses, screen resolution;
• Contact information such as phone numbers and email addresses;
• Contract details, such as the date the contract was entered into and the specific terms of the contract;
• Content data such as submitted documents and text entries.

4. Purposes and Legal Bases for Processing

A detailed description of each purpose can be found in the respective subsection. Processing is based exclusively on the following legal grounds:

• Art. 6(1), sentence 1, subparagraph (a), and Art. 7 of the GDPR regarding consent to the processing of data for one or more specific purposes;
• Art. 6(1), sentence 1, subparagraph (b) of the GDPR for the performance of a contract or the implementation of precontractual measures taken at the request of the data subject;
• Art. 6(1), sentence 1, subparagraph (c) of the GDPR to fulfill our legal obligations;
• Art. 6(1), sentence 1, subparagraph (d) of the GDPR for the protection of the vital interests of the data subject or another natural person;
• Art. 6(1), sentence 1, subparagraph (f) of the GDPR to protect our legitimate interests or those of a third party, or
• Article 88 of the GDPR in conjunction with Section 26 of the BDSG regarding the processing of data related to the initiation or performance of an employment relationship.
• A change in the purpose of processing is governed by Article 6(4) of the GDPR.

5. Rights of Data Subjects

Data subjects have the following rights:

• pursuant to Article 15 of the GDPR, to request information about the data we process about you. In particular, you may request information regarding the purposes of processing, the categories of data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to rectification, erasure, restriction of processing, or objection; the existence of a right to lodge a complaint; the origin of your data, if it was not collected by us; and the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details;
• in accordance with Article 16 of the GDPR, to request without delay the correction of inaccurate data or the completion of your data stored by us;
• to request the erasure of your data stored by us in accordance with Article 17 of the GDPR, unless the processing is necessary for the exercise of the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or to assert, exercise, or defense of legal claims;
• to request the restriction of the processing of your data pursuant to Article 18 of the GDPR, provided that you contest the accuracy of the data or the processing is unlawful;
• In accordance with Article 20 of the GDPR, you have the right to receive the data you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transferred to another controller (“data portability”);

Right to Object
Data subjects may, pursuant to Article 21(1) of the GDPR, object to data processing that we carry out on the basis of Article 6(1), sentence 1, subparagraph (e) (public interest) and (f) of the GDPR (legitimate interest), at any time for reasons arising from their particular situation. Data subjects may, in particular, object at any time to the use of their data for direct marketing purposes, with effect for the future. Unless the objection is specifically against direct marketing, we ask that, when exercising such an objection, you explain the reasons why we should not process your data as we currently do. In the event of a justified objection, we will review the situation and either cease or adjust the data processing, or explain to you our compelling legitimate grounds on the basis of which we will continue processing.

Right of Withdrawal
Data subjects may, pursuant to Article 7(3) of the GDPR, withdraw their consent at any time and without providing a reason. However, such withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal. A withdrawal of consent may be sent by email to datenschutzbeaufragter@esis-medical.de or by mail to ESiS Medical, Thomasiusstraße 5, 10557 Berlin.

You may exercise the aforementioned rights by contacting our company’s data protection officer, whose name and contact information are listed in Section 1.

Please note that we reserve the right to request further proof of your identity as the data subject exercising the rights described here if there is any doubt that you are the data subject exercising these rights.

Right to File a Complaint with a Supervisory Authority
Data subjects may also contact a data protection supervisory authority with questions or complaints in accordance with Article 77 of the GDPR. The authority responsible for our company is:

Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstr. 219
10969 Berlin

6. Recipients of Data

Under certain circumstances, it may be necessary to share data with, for example, a data processor to ensure that operations run smoothly. In the relevant section for each specific processing activity, you will find information about which recipients receive the data. We use only carefully selected and authorized service providers.

If data is disclosed in the context of data processing on behalf of a client, such disclosure takes place on the basis of a data processing agreement within the meaning of Article 28 of the GDPR. Such an agreement defines how data subject information is to be handled and ensures protection for data subjects.

7. Transfer to a Third Country

When using our online services, data is transferred to third countries. If data is transferred to a third country, this is done in accordance with the GDPR (in particular Art. 44 et seq. of the GDPR). Details regarding data transfers to third countries and the respective recipients of the data are described in the relevant subsections.

8. Policy on Data Retention Periods

We will delete your data when it is no longer necessary for the purpose for which it was processed (e.g., the performance of contracts) and there are no longer any statutory retention requirements or legal grounds for processing. The retention periods stipulated in the German Commercial Code (HGB) and the German Fiscal Code (AO) range from six to ten years. In addition, statutory limitation periods also influence the retention period. According to Sections 195 et seq. of the German Civil Code (BGB), the standard statute of limitations is three years; however, in certain cases, the statute of limitations may be as long as thirty years. Additional information on the retention period can be found in the respective subsection.

9. Automated Decision-Making / Profiling

We do not use automated decision-making or profiling.

10. No Obligation to Provide Data

In principle, you are not legally required to provide us with your personal information. However, if you do not do so, we may not be able to provide you with full access to our website, respond to your inquiries, or enter into or fulfill a contract with you. Fields marked with an “*” are required; all other information you provide is voluntary.

11. Collection and Processing of Anonymous and Pseudonymized Data for the Technical Provision of Our Online Services

Even if you use our online services without logging in, general information is automatically collected on our servers. This includes:

• Referrer (previously visited website)
• Requested Web Page or File
• Browser Type and Browser Version
• Operating System Used
• Type of device used
• Time of Access
• IP address in anonymized form (used only to determine the location of the access)

This information (also known as server log files) is of a general nature and is not used to draw conclusions about the person visiting the website. The IP address is immediately modified by deleting the last three digits. This makes it virtually impossible to identify the connection being used.

This data is processed to ensure the proper functioning of the website (in particular, establishing a connection). Without this data, it would in some cases be technically impossible to deliver and display the website’s content. In addition, we use this data to optimize the website, protect against misuse, conduct statistical analyses, and ensure the security and stability of our systems. This also constitutes our legitimate interest. The legal basis for this processing is Article 6(1)(f) of the GDPR. In certain circumstances, processing may also take place to ensure the initiation or performance of a contract. If the visit to this website is related to a contract concluded or to be concluded between the data subject and us, the processing is based on Article 6(1), first sentence, letter b) of the GDPR.

The recipients of this data are hosting providers; in our case, IONOS SE, Elgendorfer Str. 57, 56410 Montabaur. Privacy Policy: https://www.ionos.de/terms-gtc/terms-privacy

All visitors to our website are affected by this data processing.

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data processing for the purpose of providing the website, this occurs when the respective session ends. In the case of data stored in log files, deletion takes place no later than 8 weeks after collection.

12. Use of Technically Necessary Cookies

We use cookies on our website. In this context, we would like to point out that cookies may also originate from third parties and/or be loaded from third-party servers, even if you are only visiting our website.

Cookies are small files that are stored on the devices used to access online services (computers, cell phones, tablets, TVs, etc.). These files store information related to the use of the online service and the device used to access it. There are “persistent cookies” that store data for a defined period of time even after your visit to the online service has ended. “Non-persistent cookies,” also known as “session cookies,” are deleted immediately after you leave the online service. Cookies may also be used to store various user preferences for marketing purposes; however, such use in connection with our online services occurs exclusively with the user’s consent. For more information, see the section on technically non-essential cookies.

The following technically necessary cookies are used as part of our online service:

Usage	Provider	Purpose / Description	Categories of Personal Data	Validity Period	Third-Country Transfer
Borlabs Cookie	Borlabs	This cookie is used to store the user’s specific consent status, i.e., the cookie settings explicitly selected by the user for using this website	None	365 days	No

These cookies are used exclusively to provide our website and its technical functions. Some features of our website cannot be offered without the use of cookies. For this purpose, it is necessary for the browser to be recognized when you visit our website again. A cookie contains a unique string of characters that allows the browser to be uniquely identified when the website is visited again. We use this information to identify the user across multiple visits. This function also constitutes our legitimate interest.

We do not use the user data processed by technically necessary cookies—without the consent of the data subject—for advertising purposes or to create user profiles.

The legal basis for processing data using technically necessary cookies is Article 6(1)(f) of the GDPR and is based on the interests mentioned above. If you visit our online services to obtain specific information about our products or to make a purchase, these actions constitute (pre-)contractual measures within the meaning of Article 6(1), first sentence, letter b) of the GDPR.

Until cookies are disabled through our website or in the settings of the browser being used, all visitors to our online services are subject to this processing.

Users can delete cookies themselves at any time through their browser. The validity period of each cookie is specified separately in our cookie banner and in the table above.

If you do not wish to have cookies stored on your devices, we ask that you disable cookie storage and block the use of cookies in your browser settings. Common browsers also offer the option to delete cookies and website data that have already been stored. If you choose not to allow cookies, please note that this may affect the functionality of our online services.

13. Use of Cookies That Are Not Technically Necessary

Within our online services, we use third-party tools that are not technically necessary. The following cookies, which are set after appropriate consent has been given, are included in this category:

Supergroup	Usage	Provider	Privacy Policy	Purpose / Description	Categories of Personal Data	Validity Period	Third-Country Transfer	Opt Out
Performance	Google Analytics / Google Marketing and Remarketing Services	Google LLC 1600 Amphitheatre Parkway, Mountain View CA 94043 the U.S., or If you have your habitual residence in the European Union (EU), the European Economic Area (EEA), or Switzerland, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland	https://policies.google.com/privacy Detailed information about the cookies used: https://policies.google.com/technologies	Google Analytics identifies website users, analyzes website usage, and generates statistical data about it. In addition, the system identifies which web pages the same user viewed during the same visit. Google Marketing Services allow us to display interest-based ads. This service enables us to do so both on our own websites and on third-party sites.	Electronic identification data, usage behavior on the website	2 years	Possible to the U.S. For more information, see the note below the table.	Possible via browser plugin

We use the following analytical tools:

It is possible that, when using the tools provided by Google LLC (or Google Ireland Ltd.), the personal data listed in the table above may be transferred to the United States. Please note that this transfer entails risks and dangers for the protection of personal data. A level of data protection equivalent to that of the GDPR is not guaranteed.

Google LLC (or Google Ireland Ltd.) uses EU Standard Data Protection Clauses to protect personal data, thereby ensuring the protection of the personal data being processed. Nevertheless, we would like to point out that there is no adequacy decision in place for transfers of personal data to the U.S. In particular, based on your consent, there is a possibility that U.S. law enforcement agencies may have extensive access to your personal data. You cannot oppose the processing of or access to your data in the U.S. We ask that you take this into account when consenting to the use of this tool.

Google Tools
If you have given your consent, we use various services provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043; or, if you are habitually resident in the European Union (EU), the European Economic Area (EEA), or Switzerland, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics and related services
These services use cookies and are designed to help us analyze visitor traffic and behavior, such as peak visit times or testing different versions.

The information generated by the cookie regarding your use of our website is generally transmitted to a Google server in the United States and stored there.

IP anonymization (the “_anonymizeIp()” extension) has been enabled on our website. If IP addresses are forwarded to Google, they are first truncated within member states of the European Union or in other signatory states to the Agreement on the European Economic Area, and are only transmitted in full to Google’s servers in the United States in exceptional cases, where they are then truncated locally.

Google will use the information collected via cookies on our website to evaluate your use of the website, to compile reports on website activity, and to provide other services to the website operator related to website and Internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google.

We process your data for the purpose of statistical analysis of the use of our website on the basis of Article 6(1), first sentence, letter a) of the GDPR.

You can prevent these cookies from being stored by adjusting the settings in your browser or by changing the settings in our cookie banner.

You can prevent Google from collecting the data generated by the cookie and related to your use of our website (including your IP address), as well as from processing this data, by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

As an alternative to the browser plugin, you can click this link to prevent data collection by Google Analytics or similar services on our website in the future. This will place an opt-out cookie on your device. Please note that you must enable the opt-out cookie in every browser you use on all your devices, and you may need to re-enable it if you ever delete all cookies in a browser. You can deselect each individual cookie in the table above.

Please note that our control extends only to the purposes mentioned above. Beyond these purposes, we have no interest in processing the data. For more information on the terms of use and privacy policy of Google Analytics, please visit https://www.google.com/analytics/terms/de.html or https://www.google.de/intl/de/policies/.
The cookie has a duration of 180 days.

Google Tag Manager
On our websites, we use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Tag Manager is a solution that allows marketers to manage website tags via a user interface. The Google Tag Manager service itself (which implements the tags) is a cookie-free domain and does not collect any personal data. The Google Tag Manager service triggers other tags, which may in turn collect data. Google Tag Manager does not access this data. If deactivation has been performed at the domain or cookie level, it remains in effect for all tracking tags implemented using Google Tag Manager. For more information, visit https://marketingplatform.google.com

jQuery
We use the jQuery JavaScript library to operate our online services. This library is hosted on our servers. Data is transferred only between your device and our servers.

14. Making Contact

Our website includes contact forms that can be used to contact us securely. If a user chooses this option, the following data will be stored:

• Name
• Email address for contact
• The message text entered by the user
• Phone number for contact purposes (if provided by the user)
• Date and time of transmission
• IP address of the connection from which the form was submitted
• URL of the page where the contact form is embedded

Alternatively, you can contact us via the email addresses provided or by phone. In this case, the data provided by the person contacting us will be stored.

We process the data you provide and that we retrieve in order to handle your inquiry. This also constitutes our necessary legitimate interest.

The other processing activities carried out in connection with the contact request are intended to prevent misuse of the contact options and to ensure the security of our systems.

The legal basis for processing the data transmitted when contacting us is therefore Article 6(1)(f) of the GDPR. If the purpose of establishing contact is to conclude a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR.

This data processing affects all individuals who have contacted us through the channels listed.

The data will be deleted as soon as the respective conversation with the user has ended and no other legally recognized basis (in particular, statutory retention or archiving obligations) permits further processing. The conversation is considered concluded when the circumstances indicate that the matter in question has been definitively resolved.

15. Recruitment

In order to provide our brokerage services, we need to process some of your data. Below, we explain which of your data we process, how we process it, and for what purpose, provided that you send it to us via the contact methods listed.

As part of the selection process, we may process the following categories of data from you in particular:

• Personal information (e.g., name, gender, date of birth),
• Contact information (e.g., mailing address, email address, phone number),
• Application materials (e.g., transcripts, resume, photo),
• Information on professional development and acquired skills (e.g., education and training, work experience, additional qualifications),
• In the case of online applications, usage and system data (e.g., IP address, name of the file accessed, date and time of access, amount of data transferred, notification of successful access, web browser).
• If applicants voluntarily submit data from special categories of personal data (such as severe disability, pregnancy, or union membership) without being asked to do so, such data will be processed.

This data is processed solely for the purpose of matching you with job openings and exclusively within the scope of your consent pursuant to Article 6(1)(a) of the GDPR. This data will not be disclosed to third parties without your consent.

Your data will also be shared only to the extent necessary, unless we are legally required to share your data with other parties.

Your application information will be stored for four months after the placement is complete and then deleted.

16. Marketing

If you have provided consent pursuant to Article 6(1), first sentence, (a) of the GDPR, we process data for marketing purposes. This applies exclusively to the data for which consent has been provided in each case. This applies exclusively to individuals who have given their consent. In this context, no transfer of data to third countries is planned. The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected.

17. Compliance with Legal Requirements

We also process your data to comply with other legal obligations that apply to us in connection with your use of our services. These include, in particular, retention periods under commercial, business, or tax law.

The legal basis for this processing is therefore Article 6(1), first sentence, subparagraph (c) of the GDPR, in conjunction with commercial, business, or tax law, to the extent that we are required to record and retain your data.

18. Law Enforcement

Furthermore, we may process your data for the purpose of asserting our rights and enforcing our legal claims. We also process your data to defend ourselves against legal claims. Finally, we process your data to the extent necessary to prevent or investigate criminal offenses. The legal basis for this is Article 6(1)(f) of the GDPR, insofar as we assert legal claims, defend ourselves in legal disputes, or prevent or investigate criminal offenses.

19. Data Security

In accordance with Article 32 of the GDPR, we use appropriate technical and organizational security measures to protect data against tampering, unauthorized processing, and accidental loss of any kind. In particular, our website is SSL/TLS-encrypted. In addition, we use privacy-friendly default settings and software that is generally designed with privacy in mind. We stay up to date with the latest technology and regularly improve our services to ensure the continued security of data within our services.

20. Links

Some sections of our website contain links to third-party websites. These websites are subject to their own privacy policies. We are not responsible for their operation, including their data handling practices. If you submit information to or through such third-party websites, you should review their privacy policies before providing them with any information that can be linked to you personally.

21. Changes

We reserve the right to amend this Privacy Policy at any time based on legitimate interests, particularly in the event of changes in the legal landscape. Any changes will be announced by publishing the revised Privacy Policy on our website. Unless otherwise specified, such changes will take effect immediately. Therefore, please review this Privacy Policy regularly to view the most current version.

Last updated in December 2021