We, iteratec GmbH, believe that you should have control over your data; we therefore take the protection of your personal data very seriously and strictly comply with data protection legislation. The following privacy policy provides an overview of how we ensure this protection, what kind of data we collect and for what purpose, and what your rights are regarding your personal data.

If you have any questions regarding data protection, please feel free to contact us at any time.

Any future changes we make to the ‘Privacy Policy of iteratec GmbH’ will be published on this page.

This privacy policy comes into force on 18 May 2018.

Company:
iteratec GmbH

Street, No.:
St.-Martin-Str. 114

Postcode, Town:
81669 Munich

Company registration number:
HRB 113519

Managing Directors:
Jörg-Stefan Rauch, Michael Schulz, Alexander Youssef, Tessa Pfattheicher

Telephone number:
+49 89 61 45 51 0

Email address:
office@iteratec.com

You can contact our Data Protection Officer at privacy@iteratec.com.

• This privacy policy explains the nature, scope and purpose of the processing of personal data within our web pages, functions and content (hereinafter collectively referred to as the ‘website’). This privacy notice applies regardless of the domains, systems, platforms and devices (e.g. desktop or mobile) on which the online service is provided.
• The terms used, such as ‘personal data’ or its ‘processing’, refer to the definitions set out in Article 4 of the General Data Protection Regulation (GDPR).
• The users’ personal data processed as part of the online service includes usage data (browser type and version, operating system used, URL of the previously visited page, the IP address of the accessing computer and the time of the request) and content details (e.g. entries in the application form).
• The term ‘user’ encompasses all categories of data subjects affected by data processing. These include our business partners, customers, prospective customers and other visitors to our online service. The terms used, such as ‘user’, are to be understood as gender-neutral.
• We process users’ personal data only in compliance with the relevant data protection regulations. This means that users’ data is processed only where there is a legal basis for doing so, in particular where data processing is required by law, where the user has given their consent, or on the basis of our legitimate interests (i.e. an interest in the analysis, optimising and ensuring the economic operation and security of our online service within the meaning of Article 6(1)(f) of the GDPR, in particular in relation to audience measurement, the creation of profiles for advertising and marketing purposes, as well as the collection of access data and the use of third-party services).
• We would like to point out that the legal basis is either consent, processing for the performance of our services and the fulfilment of contractual obligations, processing to comply with our legal obligations, or processing to safeguard our legitimate interests (Article 6(1)(a) and Article 7 of the GDPR).
• What sources and data do we use? We process personal data relating to customers, suppliers, prospective customers, job applicants and employees. We process this data in the context of business relationships, recruitment processes or employment relationships. We also use data from publicly available sources where such processing is permitted. The legal basis is the fulfilment of (pre-)contractual obligations, legitimate interests, statutory provisions or the consent of the data subject themselves.

• We implement state-of-the-art organisational, contractual and technical security measures to ensure compliance with data protection legislation and, in so doing, to protect the data we process against accidental or deliberate manipulation, loss, destruction or unauthorised access.
• These security measures include, in particular, the encrypted transmission of data between your browser and our server.
  Have you discovered a security vulnerability on our site? Please email us at security@iteratec.com. We will then get back to you as soon as possible. You can also use our certificate for encrypted communication.
• As the security team at iteratec, we look after your online security. If you have any complaints regarding the misuse of our or your network access, or if you receive spam from one of our email addresses, please contact us by email at abuse@iteratec.com.

• Data will only be disclosed to third parties in accordance with legal requirements. We will only disclose users’ data to third parties if this is necessary, for example, on the basis of Article 6(1)(b) of the GDPR for contractual purposes, or on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR for the economic and effective running of our business operations.
• Where we engage subcontractors to provide our services, we take appropriate legal precautions as well as corresponding technical and organisational measures to ensure the protection of personal data in accordance with the relevant legal provisions.
• Where content, tools or other resources from other providers (hereinafter collectively referred to as ‘third-party providers’) are used within the scope of this privacy notice, these will only be transferred to countries with an adequate level of data protection and to countries within the scope of the GDPR.

• Candidate management:
  
  For our online application form and applicant tracking system, we use the platform provided by the service provider rexx (rexx systems GmbH, Süderstraße 75–79, D-20097 Hamburg) to ensure the swift and secure processing of the recruitment of new staff. To this end, we have entered into a data processing agreement with the provider, under which they undertake to comply with all data protection requirements and to process the data only in accordance with our instructions and solely for the specified purpose. Further information can be found here.
  
• Applicant data:
  
  Where applicant data is received by us (by post, email or online), technical and organisational measures ensure that your personal data is treated confidentially in accordance with statutory provisions. Once the application process has been completed, your data will be deleted unless you consent to it being stored for a longer period. The data will be deleted after four months (in accordance with the time limits for potential legal claims under the AGG).
  

• Potential analysis as part of the application process (Jobfidence®):

  Purpose and procedure
  Applicants who progress to the next stage of the selection process will be invited to take part in a computer-based assessment. The aim is to assess their potential in relation to the post to be filled. The assessment is conducted via a remote environment provided by the service provider. Access is granted via a connection file sent in advance; during the session, technically controlled remote access to the test environment is possible.

  Data processed
  In the course of the potential assessment, the following categories of personal data may be collected and subject to further processing:

  • Personal details (name, age, gender, most recent professional position and stated educational qualifications)
  • Answers to questions in the assessment process, including the evaluation derived therefrom
  • Technical connection and log data
    

  Evaluation and recipients
  The results collected are assessed by an external specialist with psychological expertise commissioned by iteratec. The aim of this analysis is to assess potential relevant to the role. The results are subsequently made available to the internal departments at iteratec GmbH involved in the selection process (Human Resources, the relevant specialist department, and the management).
  Externally commissioned service providers are granted access to data exclusively within the framework of a lawfully concluded data processing agreement that fully complies with the relevant data protection requirements.

  Scope of technical access
  Access is strictly limited to the test environment itself. Private files, email correspondence, browser history or any other information stored outside this isolated area remain unaffected at all times. Access is not extended to the rest of the workspace.

  Decision-making
  The potential analysis forms one of several components within the holistic assessment framework of the selection process. Recruitment decisions are always made by taking a holistic view of various sources of information – in particular, taking into account the application documents and impressions gained during personal interviews. There is no exclusively automated decision-making within the meaning of Article 22 of the GDPR.

  Legal basis
  Data processing is based on Section 26(1) of the German Federal Data Protection Act (BDSG) in conjunction with Article 6(1)(b) of the GDPR and serves the proper conduct of the recruitment process and the assessment of suitability. Any further processing operations that go beyond the framework laid down by law require explicit consent in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 26(2) of the BDSG.

Maps provided by the ‘Google Maps’ service operated by the third-party provider Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/
Opt-out: https://www.google.com/settings/ads/

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

• Cookies
  Google uses cookies. The information generated by the cookie regarding users’ use of the online service is transmitted to Google’s servers and processed there. This may also involve data being transferred to Google LLC, which is based in the USA.
  Google will use this information on our behalf to evaluate users’ use of our online service, to compile reports on activity within this online service, and to provide us with other services relating to the use of this online service and internet usage. In doing so, pseudonymous user profiles may be created from the processed data. We use the data from Google Analytics to continuously improve our online service.
• IP address
  Google Analytics 4 uses IP addresses at the time of collection to determine location information (country, city, latitude and longitude of the city) and then deletes this information before the data is stored on a server.
• Demographic data and cross-device tracking
  We use the Google Signals service in conjunction with Google Analytics 4. Google Signals consists of data from users who are signed in to their Google Account and have enabled personalised advertising. By linking data to these signed-in users, cross-device reporting, cross-device remarketing, the export of cross-device conversions to Google Ads and the collection of demographic characteristics such as age and gender are made possible.
• Google Tag Manager
  We use Google Tag Manager. Google Tag Manager is a solution that enables marketers to manage website tags via a single interface. The Tag Manager tool itself (which implements the tags) is a cookie-free domain and does not collect any personal data. The tool triggers other tags, which may in turn collect data. Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, this remains in effect for all tracking tags implemented using Google Tag Manager. https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/
• Google Data Studio
  Our website uses Google Data Studio, a tool from Google for managing and visualising data. Google Data Studio helps us to analyse and visualise data efficiently in order to improve our service. All data processed via Google Data Studio is handled in accordance with Google’s privacy policy and applicable data protection laws. We are committed to protecting your privacy and ensuring that your data is treated securely and confidentially.

We have entered into a data processing agreement with Google which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

Further information on Google’s use of data, as well as options for settings and opting out, can be found on Google’s websites: https://www.google.com/intl/de/policies/privacy/partners (‘How Google uses data when you use our partners’ websites or apps’), http://www.google.com/policies/technologies/ads (“Data use for advertising purposes”), http://www.google.de/settings/ads (“Manage the information Google uses to show you adverts”).

You can also prevent Google Analytics from collecting your data by withdrawing your consent to the use of cookies here: https://www.iteratec.com/en/cookies/. Users can also prevent Google from collecting the data generated by the cookie and relating to their use of the online service, as well as prevent Google from processing this data, by downloading and installing the browser plug-in available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

Below you will find explanations of the individual services:

• X (formerly Twitter):
  Features of the X service may be integrated into our online offering. These features are provided by X Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. By using X and the ‘Follow’ function, the websites you visit are linked to your X account and disclosed to other users. Data is also transferred to X in the process. Please note that, as the provider of these pages, we have no knowledge of the content of the data transmitted or how it is used by X . X’s privacy policy can be found at https://x.com/de/privacy. You can change your privacy settings on X in your account settings at https://x.com/account/settings.
  
• Facebook:
  A ‘Follow’ button for the social network Facebook (Facebook Inc., 1601 Willow Road, Menlo Park, California, 94025, USA) is integrated into our pages.
  When you visit our pages, the button establishes a direct connection between your browser and the Facebook server. Facebook thereby receives the information that you have visited our page using your IP address. Please note that, as the provider of these pages, we have no knowledge of the content of the data transmitted or how it is used by Facebook. Further information on this can be found in Facebook’s privacy policy at http://de-de.facebook.com/policy.php. If you do not wish Facebook to be able to associate your visit to our pages with your Facebook user account, please log out of your Facebook account.
  
• XING:
  We use features provided by the XING network. The provider is XING AG, Dammtorstraße 29–32, 20354 Hamburg, Germany. Each time one of our pages containing XING features is accessed, a connection is established with XING’s servers. To the best of our knowledge, no personal data is stored in the process. In particular, no IP addresses are stored, nor is usage behaviour analysed. Privacy policy: https://www.xing.com/app/share?op=data_protection
  
• LinkedIn:
  Our website uses features from the LinkedIn network. The provider is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. Whenever you visit one of our pages that contains LinkedIn features, a connection is established with LinkedIn’s servers. LinkedIn is informed that you have visited our website using your IP address. If you click on the LinkedIn ‘Recommend’ button whilst logged into your LinkedIn account, LinkedIn is able to associate your visit to our website with you and your user account. Please note that, as the provider of this website, we have no knowledge of the content of the data transmitted or how it is used by LinkedIn. Privacy policy: https://www.linkedin.com/legal/privacy-policy.
  
• Kununu
  is operated by kununu GmbH, Fischhof 3 Top 7, A-1010 Vienna. Your browser establishes a direct connection to the Kununu servers as soon as you click the button. We have no influence over the data subsequently collected by Kununu. For information on the purpose and scope of data collection, as well as the further processing and use of the data by Kununu, and your rights and settings options regarding the protection of your privacy, please refer to Kununu’s privacy policy: https://www.kununu.com/info/datenschutz
  
• YouTube
  Embedded videos from the “YouTube” platform provided by the third-party provider Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/ – Opt-out: https://www.google.com/settings/ads/. When you click on a link to a video, we merely facilitate your connection to YouTube’s service.
  
• Instagram:
  This website uses features from the social network Instagram. The provider is Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. When you visit one of our pages that incorporates Instagram features, a connection is established with Instagram’s servers. In doing so, the Instagram server is informed which of our pages you have visited. If you are logged into your Instagram account, you allow Instagram to link your browsing behaviour directly to your personal profile. You can prevent this by logging out of your Instagram account. Further information on the handling of user data can be found in Instagram’s privacy policy: https://instagram.com/about/legal/privacy/.

When you visit our Facebook page, certain information about you is processed. Facebook Ireland Ltd (Ireland/EU) is solely responsible for this processing of personal data. Further information on Facebook’s processing of personal data can be found here.

Facebook provides us with statistics and insights for our Facebook page in anonymised form, which help us to gain an understanding of the types of actions people take on our page (known as ‘Page Insights’). These Page Insights are generated on the basis of certain information about people who have visited our page. This processing of personal data is carried out by Facebook and us as joint controllers. The processing serves our legitimate interest in analysing the types of actions taken on our page and improving our page based on these insights. The legal basis for this processing is Article 6(1)(f) of the GDPR. Under no circumstances will we link the information obtained via Page Insights to a specific Facebook profile based on ‘Likes’ for our page.
We have entered into an agreement with Facebook regarding processing as joint controllers, which sets out the allocation of data protection obligations between us and Facebook. Details regarding the processing of personal data for the generation of Page Insights and the agreement concluded between us and Facebook can be found here.

We also process information that you have provided to us via our Facebook page. Such information may include your Facebook name, contact details or a message sent to us. We process this personal data only if we have expressly asked you to provide it to us beforehand. We carry out this processing as the sole data controller. Where your enquiry relates to the conclusion or performance of a contract with us, the legal basis for the data processing is Article 6(1)(b) of the GDPR. Otherwise, we process the data on the basis of our legitimate interest in contacting enquirers. The legal basis for data processing in such cases is then Article 6(1)(f) of the GDPR.

We use the LinkedIn Insight Tag on our websites. This tool places a cookie in your browser, which enables the collection of the following data, amongst other things

• URL,
• referrer URL
• device properties,
• browser properties,
• IP address and
• demographic data from LinkedIn, if the user is an active LinkedIn member.

LinkedIn does not share any personal data with iteratec, but provides anonymised reports on the website’s target audience and ad performance. In addition, LinkedIn offers the option of retargeting via the Insight Tag. Iteratec can use this data to display targeted advertising outside its website without you, as a website visitor, being identified in the process

The use of LinkedIn Insights is based on Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time.

The data collected by LinkedIn is encrypted, anonymised within seven days, and the anonymised data is deleted within 90 days. Further information can be found in the LinkedIn Privacy Policy, as well as here in the LinkedIn Opt-Out section.

The service on the securecodebox.io website is hosted on the third-party platform Netlify. A Data Processing Agreement in accordance with the GDPR has been concluded. Accordingly, Netlify’s terms and conditions apply:

• https://www.netlify.com/legal/terms-of-use/
• https://www.netlify.com/privacy/
• https://www.netlify.com/legal/subprocessors/
• https://www.netlify.com/legal/netlify-cookie-policy/

Our website uses the Cookiebot cookie consent tool to obtain your consent to the storage of certain cookies in your browser and to document this in accordance with data protection regulations. Cookiebot is operated by Cybot A/S, 1058 Copenhagen, Denmark.

When you visit our website, a Cookiebot cookie is stored in your browser, which records the consents you have given or any withdrawal of those consents.

Cookiebot’s consent technology is used to obtain the legally required consents for the use of cookies. Data processing is carried out in accordance with Article 6(1)(f) of the GDPR on the basis of our legitimate interest in providing a cookie consent management service for website visitors.

Further information on the handling of the data transferred can be found in the privacy policy of cookiebot.com: https://www.cookiebot.com/de/privacy-policy/

Further information, including details on how cookies work, the purpose, scope and legal basis of data processing, and how to withdraw your consent, can be found here.

We use HubSpot on our website for marketing activities. We use this integrated software solution for our own marketing, lead generation and customer service purposes, based on our legitimate interest under Article 6(1)(f) of the GDPR in economically efficient customer communication.

HubSpot’s functions include, amongst others:

• Email marketing (sending newsletters and automated emails)
• Social media publishing and reporting
• Contact management (user segmentation and CRM)
• Lead generation
• Landing pages and contact forms
• Appointment bookings on our website

We have entered into a data processing agreement with HubSpot, under which HubSpot processes your data solely on our behalf: Data Processing Agreement.

HubSpot is a US-based software company with a branch in Ireland.
Contact: HubSpot, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland; Telephone: +353 1 5187500. The processing of personal data therefore generally takes place within the EEA. For data transfers to third countries, in particular the USA, the EU Standard Contractual Clauses have been contractually agreed, which, in accordance with Article 46 of the GDPR, provide a guarantee of an adequate level of data protection in the EU.

Hapily add-on

We use the ‘Hapily’ add-on to organise our events and optimise the associated processes. Hapily is a tool that works closely with our HubSpot CRM system and supports us in managing events.

• Provider: Hapily, Inc., 228 Park Ave S, PMB 76598, New York, New York 10003-1502, USA.
• Purpose of data processing: Hapily is used to ensure the efficient planning and execution of our events.
• Legal basis: The legal basis for the use of Hapily is our legitimate interest in the efficient organisation of our events and the professional management of participant data, in accordance with Article 6(1)(f) of the GDPR. Where registration takes place within the context of a contractual relationship, the legal basis is Article 6(1)(b) of the GDPR. We have entered into a data processing agreement (DPA) with the provider Hapily, Inc. in accordance with Article 28 of the GDPR, which ensures that your data is processed exclusively in accordance with our instructions and in compliance with applicable data protection laws.
• Data processed: Hapily generally processes the same categories of data that are also stored in our HubSpot system. When you register for an event, these include, in particular:
  • Master data (e.g. names, company names, job titles)
  • Contact details (e.g. email addresses, telephone numbers)
  • Event-related data (e.g. name of the event, registration status)
  • Meta/communication data (e.g. registration timestamps)
• Data subjects: Participants and prospective attendees of our events, as well as other communication partners whose data is stored in our HubSpot CRM system.
• Data transfers to third countries: As Hapily, Inc. is a US-based provider, personal data may be transferred to the US. Such transfers are permitted as we have put in place appropriate safeguards to protect your data. The data transfer is based on the European Commission’s Standard Contractual Clauses (SCCs). These clauses oblige the recipient of the data in the USA to process the data in accordance with European data protection standards. We also ensure that an adequate level of data protection is guaranteed through the conclusion of the data processing agreement and, where necessary, further measures.

On our job portal, jobs.iteratec.com, the open-source web analytics service Matomo (www.matomo.org) is used for statistical analysis and the ongoing optimisation of technical functionality. The implementation and technical operation are carried out by our partner, rexx systems GmbH, as part of data processing on our behalf. The data collected is stored and processed exclusively on servers belonging to our partner, noris network AG, in Germany. Apart from iteratec as the client and rexx (in connection with hosting and support), no third party has access to this data; Matomo processes and stores the data exclusively on the aforementioned servers.

The data collected is used solely to analyse usage behaviour and to continuously improve our website. Your IP address is immediately truncated (anonymised) by technical means, so that it is not possible to identify you personally. No cookies or similar technologies are stored that could be used to uniquely identify your device. Individual users are therefore not identified. No data is passed on to third parties, nor is any information transferred to third countries.

Matomo is used solely for the purpose of optimising and analysing errors on our job portal, as well as to improve its stability and user-friendliness. The analysis data is processed in a fully anonymised manner without any personally identifiable identifiers.

The legal basis for this processing is our legitimate interest, in accordance with Article 6(1)(f) of the GDPR, in analysing and continuously improving our service in compliance with data protection regulations.

Data processing is carried out on the basis of a data processing agreement (DPA) between iteratec and rexx systems GmbH in accordance with Article 28 of the GDPR. rexx systems GmbH processes the data exclusively in accordance with our instructions and has undertaken to comply with appropriate technical and organisational measures. Appropriate contractual provisions are in place for subcontracting arrangements (in particular with our hosting partner, noris network AG) to ensure data security.

For further information on Matomo’s privacy settings, please see:
https://matomo.org/docs/privacy/

Prospective users can access the secureCodeBox as a Service application via our website as a free SaaS (Software as a Service) solution.

When a scan is carried out, the following data is stored:

• the client’s IP address,
• the date and time of the scan,
• a unique scan session ID,
• domain validation token,
• acceptance of the terms of use (https://scb.iteratec.de/terms) and
• the domain to be scanned.

To prevent misuse, the data is stored for a maximum of 3 years.

secureCodeBox as a Service is hosted by iteratec and Hetzner.

Information on how Hetzner uses your data can be found at:

www.hetzner.com/de/legal/privacy-policy/

Right of access:
Users have the right, upon request and free of charge, to receive information about the personal data we hold about them.

Right to rectification:
In addition, users have the right to have inaccurate data rectified, to restrict the processing of their personal data, to have it erased and, where applicable, to exercise their right to data portability.

Right to withdraw consent:
Users may also withdraw their consent, generally with effect for the future. The withdrawal must be addressed to the Data Protection Officer.

Right to lodge a complaint:
In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority. This right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

The data stored by us is deleted as soon as it is no longer required for its intended purpose and there are no statutory retention obligations preventing its deletion. Where users’ data is not deleted because it is required for other, legally permissible purposes, its processing is restricted. This means that the data will be blocked and will not be processed for any other purposes. This applies, for example, to users’ data which must be retained for commercial or tax law reasons.

Users may object at any time to the future processing of their personal data in accordance with the statutory requirements. In particular, they may object to the processing of their data for the purposes of direct marketing. The objection must be addressed to the data controller.

We reserve the right to amend the privacy policy to bring it into line with changes in the legal framework, or in the event of changes to the service or to data processing. However, this applies only in respect of statements concerning data processing. Where users’ consent is required, or where parts of the Privacy Policy contain provisions relating to a contractual relationship with users, any changes will only be made with the users’ consent.

Users are asked to familiarise themselves with the content of this Privacy Policy on a regular basis.

Munich, 23 June 2026
The Management