CONFIDENTIALITY AND PRIVACY NOTICE

CONFIDENTIALITY OF E-MAILS
The contents of emails sent by and on behalf of HKCF Corporate Finance GmbH are strictly confidential and intended solely for the specified recipient. It is prohibited to forward these emails or their contents to third parties without the sender’s written consent. If you have received an email in error, please notify us so that we can ensure this does not happen again in the future, and delete the message. 

PRIVACY POLICY
The following privacy policy explains which personal data we process and how we process it.

Legal controller and data protection officer
Responsible for this website is
HKCF Corporate Finance GmbH
Vor den Siebenburgen 2
50676 Cologne
info@hkcf.de

You can contact the Data Protection Officer by email:
datenschutz@hkcf.de  

Purposes and legal basis for the processing of your data

Log Data
Whenever you visit a website, your internet browser automatically sends information to our web server for technical reasons (so-called log data). We store some of this information in log files, e.g.
• Date of access
• Time of access
• URL of the referring website
• File accessed
• Amount of data transferred
• Browser type and version
• Operating system
• IP address

We generally analyze log data only to resolve operational issues with our website or to investigate security incidents.

To resolve technical issues or preserve evidence in the event of security incidents, we may need to collect additional personal data along with the log data. In such cases, we base the processing of log data on a legal basis.

This processing is based on Article 6(1)(f) of the GDPR; our interest is the technical provision, security, and optimization of the website.

Contact by e-mail
You can contact us using the email address provided on the website. In this case, the user’s personal data transmitted with the email will be stored. Any additional data you provide to us helps us address you personally or process your request more efficiently and promptly.

This processing is based on Article 6(1)(b) and (f) of the GDPR.

Applicant data
The personal data you provide through your application is collected and processed for recruitment and hiring purposes. This may include the following information:

• Contact information, such as your name, address, phone number, and email address
• Information about your professional experience and skills, as well as your previous employment history, language proficiency, performance evaluations, and references
• Photo (if voluntarily provided)

We do not intend to process special categories of personal data. However, if you provide us with such data, such as health-related information, this data will also be processed.

This processing is based on Article 88 of the GDPR in conjunction with Section 26 of the BDSG, as well as Article 6(1)(b) and (f) of the GDPR.

Suppliers, Customers, and Prospects
We use contact and communication data, as well as other relevant personal data, from our suppliers, customers, prospects, or other individuals with whom we come into contact and exchange information in the course of our business activities, provided that these individuals or their employees are natural persons.

This ranges from exchanging business cards, the automated management of contact data, and sending information and news, to communication in the context of a business collaboration.

We process this data to conduct the business relationship, for communication, advertising, and to maintain contact.

The processing is primarily based on Article 6(1)(f) of the GDPR; our legitimate interest is to establish contact, manage the business collaboration, carry out advertising activities, and maintain relationships.

To the extent that customers themselves are natural persons and a contractual relationship with them exists or is being established, we base the processing on Article 6(1)(b) of the GDPR.

Recipients
To implement and operate our website, we work with service providers who may receive personal data:

• Hosting service providers
• IT service providers
• Programming service providers
• Government agencies and institutions, when required by law

We only transfer your data to these recipients to the extent necessary to fulfill a contract with you, where there is a legitimate interest in the transfer of your data, or where we have your consent for the transfer.

Transfer to recipients outside the EEA
We do not transfer personal data to recipients located outside the European Economic Area (EEA) in so-called third countries.

For further information on this matter, particularly regarding the measures taken, please contact our data protection officer.

Information about external links:

Google Maps
We integrate Google Maps into our website to display interactive maps and provide directions. Google Maps is a mapping service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. When you visit our website, your browser establishes a direct connection to Google’s servers. The map content is transmitted directly from Google to your browser and integrated into the website by it. Therefore, we have no influence over the scope of the data collected by Google in this manner and cannot accept any responsibility for it. To the best of our knowledge, this includes at least the following data:

• Date and time of the visit to the relevant website
• Internet address or URL of the accessed website
• IP address, (starting) address entered as part of route planning

If you do not want Google to collect, process, or use data about you via our website, you can disable JavaScript in your browser settings. In this case, however, you will not be able to use the map display.

For information on the purpose and scope of data collection, as well as the further processing and use of the data by Google, and your rights and settings options regarding the protection of your privacy, please refer to Google’s privacy policy.

By using our website, you consent to the processing of data collected about you by the Google Maps route planner in the manner described above and for the purpose stated above.

LinkedIn
Our social media presence is designed to ensure the most comprehensive online presence possible. When you visit our LinkedIn profile, we may be jointly responsible with LinkedIn for the data processing operations triggered by this visit. You may generally exercise your rights against both us and LinkedIn.

Please note that despite our joint responsibility with LinkedIn, we do not have full control over the data processing operations at LinkedIn. Our options are largely determined by their company policy.

We would like to point out that an adequacy decision for the so-called EU-US Data Privacy Framework has been in effect since July 10, 2023. This allows the transfer of personal data from the EU to U.S. companies that have joined the Framework through certification.

This processing is based on Article 6(1)(b) and (f) of the GDPR. The analysis processes initiated by LinkedIn may be based on different legal grounds, which must be specified by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

Retention period
When we store your personal data, we do so only for a limited period of time and no longer than necessary. As a general rule, we delete your data when it is no longer necessary for the purpose for which it was collected, or when other legal grounds require its deletion.
To the extent that we are subject to statutory retention obligations requiring longer storage, we will retain the data for that period, in particular to comply with commercial and tax law retention periods, which are between 2 to 10 years.

Other legal grounds for retention may include the need to retain data for evidentiary purposes for the duration of the applicable statute of limitations. These periods generally range from 2 to 30 years.

Data collected directly by us through our social media presence is deleted from our systems as soon as the purpose for storing it no longer applies, you request that we delete it, you revoke your consent to its storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory legal provisions—in particular retention periods—remain unaffected. We have no influence over the retention period of your data stored by LinkedIn for its own purposes. For details, please contact LinkedIn directly (e.g., in their privacy policy).

Data subject rights:

Right of access
You may request access to your personal data that we process in accordance with Article 15 of the GDPR.

Right to rectification
If the information concerning you is no longer accurate, you may request rectification in accordance with Article 16 of the GDPR. If your data is incomplete, you may request that it be completed.

Right to erasure
You may request the erasure of your personal data pursuant to Article 17 of the GDPR.

Right to restriction of processing
You have the right to request a restriction on the processing of your personal data pursuant to Article 18 of the GDPR.

Right to complain
If you believe that the processing of your personal data violates data protection law, you have the right under Article 77(1) of the GDPR to lodge a complaint with a data protection supervisory authority of your choice. This includes the data protection supervisory authority responsible for the controller:

Die Landesbeauftragte für den Datenschutz Nordrhein-Westfalen,
Kavalleriestraße 2-4
40213 Düsseldorf

E-Mail: poststelle@ldi.nrw.de 

Right to data portability
If the conditions set forth in Article 20(1) of the GDPR are met, you have the right to receive data that we process automatically based on your consent or in fulfillment of a contract, either for yourself or to have it transferred to a third party. The collection of data for the provision of the website and the storage of log files are strictly necessary for the operation of the website. They are therefore not based on consent pursuant to Article 6(1)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR, but are justified pursuant to Article 6(1)(f) of the GDPR. The requirements of Article 20(1) of the GDPR are therefore not met in this respect.

Right to object under Article 21(1) of the GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of Article 6(1)(f) of the GDPR. The controller will then no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing is necessary for the establishment, exercise, or defense of legal claims. The collection of data for the provision of the website and the storage of log files are strictly necessary for the operation of the website.

Withdrawal of consent
If you have given us consent to process your personal data, you may withdraw this consent at any time and without providing reasons, with effect for the future. To do so, please contact the point of contact where you gave your consent or contact the data protection officer directly.