Data privacy

1.1 The following data privacy statement applies to the use of the website www.rockyourthesis.com and the services offered through it. This website is an offer by Rock your Thesis GmbH, Niederstraße 2, 40789 Monheim am Rhein, responsible according to Art. 4 of the EU General Data Protection Regulation (“GDPR”).

1.2 In accordance with Art. 12 ff. GDPR, this data privacy statement informs you about the handling of your personal data when using our website. It particularly explains which data we collect and for what purpose we use it. Moreover, it informs you about how and for which reason this occurs.

1.3 When you use this website, depending on the type and extent of use, various personal data will be processed. Personal data refers to information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); a natural person is considered identifiable who can be identified, directly or indirectly (e.g., by assignment to an online identifier). This includes information such as name, address, telephone number, and date of birth.

1.4 This page has been translated into several languages. The German version will prevail.

2.1 As with every website, our server automatically and temporarily collects details in the server log files, which are transmitted by the browser unless you have deactivated this:

• IP address of the requesting connection (for IPv4 addresses, the last 16 bits are removed; for IPv6 addresses, the last 32 bits).
• IP address of the requesting computer
• Type of event
• File request of the client
• the HTTP response code
• The internet page from which you visit us (referrer URL),
• Date, time, and duration of the server request
• Browser type and version
• Type of device and operating system used by the requesting computer

2.2 The storage of server log files is technically required to provide a functional website and to ensure system security. This also applies to the storage of your IP address, which necessarily occurs and under further conditions can theoretically allow for an assignment to your person. Beyond the aforementioned purposes, we use server log files exclusively for statistical design and optimization of our internet offerings without drawing any conclusions about your person. The data mentioned in 2.1, excluding the IP address, is also collected and processed by additional programs for statistical evaluation. During this evaluation, no personal data is stored. From the collected data, anonymized usage profiles are created. Cookies or other tracking tools (see generally section 3) may be used for this. Data collected through the statistics program cannot be used to personally identify the user of the website since the data is not merged with personal data. Access data collected during the use of our website is retained only for the period required to achieve the aforementioned purposes. For IT security purposes, your IP address is stored on our web server for a maximum of 7 days.

2.3 As far as you visit our website to inform yourself about our products and services or to use them, the legal basis for the temporary storage and processing of the server log files is Art. 6 Para. 1 S.1 lit. b GDPR (legal basis), which allows for the processing of data to fulfill a contract or to carry out pre-contractual measures. Furthermore, in this context, Art. 6 Para. 1 S. 1 lit. f GDPR serves as a legal basis for the temporary storage of technical access data. Our legitimate interest is to provide you with a technically functional and user-friendly website and to ensure the security of our systems.

3.1 This website uses cookies and other tracking technologies. Cookies are small text files that contain an identification number. When accessing our website, cookies are stored on your computer, tablet, or smartphone. When you visit our website again, your device can be recognized based on this identification number.

3.2 The legal basis for data processing by the programs described in this section 3 is, unless otherwise stated, your consent in accordance with Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 S.1 of the Law regulating data protection and the protection of privacy in telecommunications and telemedia (TTDSG). On your first visit to our website, you will be asked whether you would like to give your consent for cookies, which collect personal data, to be set. You can either give consent for all cookies (button “[Accept]”) or decline using the button “[Decline]”. The consent is voluntary and you can revoke it at any time under “[Cookie Settings]” in the lower area of our website (footer) by deselecting a previously set tick.

3.3 Cookies

3.3.1 Categories of Cookies: Depending on function and purpose of the data processing taking place, the cookies used on our website are classified by us into the following three categories:

3.3.1.1 Necessary: These cookies are required to provide you with features of the website and to fulfill our legal obligations. The legal basis for processing your personal data is our legitimate interest (Art. 6 (1) lit. f GDPR) in making our website available to you and fulfilling our legal obligations (Art. 6 (1) lit. c GDPR). Even if you decline (button “[Decline]”) the cookies, the necessary cookies remain activated.

3.3.1.2 Statistics: We use these cookies for statistical analysis purposes to capture the usage of our website statistically. Statistics cookies help us improve our website and offer you content that is particularly relevant to you. The legal basis for processing your personal data is your consent pursuant to Art. 6 (1) lit. a GDPR and § 25 (1) sentence 1 TTDSG, which you can grant via our cookie banner. Your consent is always voluntary and is not necessary for the use of the website itself.

3.3.1.3 Marketing: We use these cookies for marketing purposes, i.e., for example, to provide you with personalized advertising (esp. recruiting and employer branding initiatives). The legal basis for processing your personal data is your consent pursuant to Art. 6 (1) lit. a GDPR and § 25 (1) sentence 1 TTDSG, which you can grant via our cookie banner. Your consent is always voluntary and is not necessary for the use of the website itself.

3.3.2 Cookie storage duration: Session cookies (from here on: “Session-Cookies) are deleted after closing the browser. In addition, we use persistent (“permanent”) cookies. Details on the storage duration can be found in the subsequent sections and the cookie overview.

3.3.3 Individual Cookies

3.3.3.1 Necessary

3.3.3.2 Statistics

3.3.3.3 Marketing

3.4 Tools for analyzing the use of our website: On our website, we use programs that allow us to analyze the behavior of visitors in order to offer you a flawless user experience. In this section, you will find more detailed information about the programs used and the respective provider.

4.1 Contact form or general contact: If you contact us via the contact form or any of the specified contact methods, your message/notification (comment) including the contact details you provided there will be stored by us for the purpose of processing and responding to the inquiry as well as for the possibility of follow-up questions. We do not share this data with third parties unless it's necessary for processing and answering your contact request or you have given us your corresponding consent. If you contact us within the framework of an existing contractual relationship or for information about our service offerings or other services, the data and information you provide will be processed for the purpose of processing and responding to your contact request according to Art 6 (1) sentence 1 lit. b GDPR (legal basis), otherwise in accordance with our legitimate interests under Art. 6 (1) sentence 1 lit. f GDPR for the proper response to customer/contact inquiries. The data you entered in the contact form remains with us until the purpose for data storage/processing no longer applies (e.g., after completed processing of your request). Mandatory statutory provisions - especially retention periods - remain unaffected.

4.2 Newsletter: With your consent, you can subscribe to our newsletter, with which we inform you about our current attractive offers. We store the IP addresses you use and the times of registration and confirmation. The purpose of storage is to prove your registration and possibly to clarify any misuse of your personal data. Mandatory information for sending the newsletter is your first name, last name, and email address. After your confirmation, we store the data you provided for the purpose of sending the newsletter (the legal basis is Art. 6 Para. 1 S. 1 lit. a GDPR and § 25 Para. 1 S. 1 TTDSG). You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare the revocation by clicking on the link provided in every newsletter email.

4.3 We would like to point out that we evaluate your user behavior when sending the newsletter. For this evaluation, the sent emails contain so-called web beacons or tracking pixels, which are one-pixel image files stored on our website. For the evaluations, we link the data mentioned in paragraph 2 and the web beacons with your email address and an individual ID. With the data obtained in this way, we create a user profile to tailor the newsletter to your individual interests. We record when you read our newsletters, which links you click in them, and deduce your personal interests from this. We link this data with actions you take on our website. You can object to this tracking at any time by clicking on the separate link provided in each email or by informing us via another contact channel. The information is stored as long as you have subscribed to the newsletter. After unsubscribing, we store the data purely statistically and anonymously.

4.4 The newsletters are sent using the shipping service provider Mailchimp. The shipping service provider can use the recipient data in pseudonymous form, i.e., without assignment to a user, to optimize or improve their services, e.g., for technical optimization of the shipping and presentation of the newsletters or for statistical purposes. However, the shipping service provider does not use the data of our newsletter recipients to write to them themselves or to pass the data on to third parties.

4.5 Competitions: Within the framework of competitions, we use your data (name, contact details) for the purpose of notifying the winner (Art. 6 Para. 1 lit. b) GDPR) and for advertising our offers by post (Art. 6 Para. 1 lit. f) GDPR) or by email with your consent (Art. 6 Para. 1 lit. a) GDPR). Additional information can be found in the terms of participation for the respective competition.

4.6 Direct advertising by email: We use your email address, which we have received in connection with the sale of a good or service, for direct advertising by email for our own similar goods or services, such as those you ordered, and for sending recruiting and employer branding initiatives from third-party providers cooperating with us. You will receive these emails regardless of whether you have subscribed to the newsletter. The legal basis for this is § 7 Para. 3 UWG. You can object to these email transmissions at any time. For direct advertising by email, we evaluate your user behavior. Information on evaluating user behavior can be found in the section of this declaration on newsletters.

5.1 We pass on at least some of your data that we collect according to the aforementioned paragraphs to processors. They process your data only on our instruction and not for their purposes (Art. 28, 19, GDPR). These are the following companies:

5.2 In certain cases, we pass on some of your data to other recipients. This can be the case if you have agreed to it (Art. 6 Para. 1 lit. a GDPR), we are legally obliged to do so (Art. 6 Para. 1 lit. c GDPR), or it is necessary to protect legitimate interests (Art. 6 Para. 1 lit. f GDPR).

5.3 If we transmit data to recipients in a third country (location outside the European Economic Area), you can find this in the information about the processors and the underlying legal basis according to Art. 46 Para. 2 GDPR in the description of the respective data processing. Some third countries are certified by the European Commission through so-called adequacy decisions as having a data protection standard comparable to the level in the European Economic Area. You can find a list of these countries at ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_de. If a country does not have a comparable data protection standard, we ensure that data protection is adequately guaranteed by other measures. This is possible, for example, through binding corporate rules (Binding Corporate Rules), standard contractual clauses of the European Commission for the protection of personal data, certificates, or recognized codes of conduct. Otherwise, we do not transfer your personal data to countries outside the EU or the EEA or to international organizations unless expressly stated otherwise in this data protection declaration.

On our website, you will find social plugins from the following social networks: Instagram, TikToK, LinkedIn, WhatsApp, Telegram, X (formerly Twitter), Xing, Facebook, and YouTube. Upon activation of the social plugins, your browser establishes a direct connection to the servers of the provider of the social network. The content of the social plugin is transmitted directly to your browser by the provider. Simultaneously, certain data from your browser is transferred to the provider. This occurs regardless of whether you click on the social plugins or not. We have no influence over the scope of the data that the provider collects in this way. To our current knowledge, this typically involves the following data: i. the page visited on our website containing the social plugin, ii. general data transmitted by your browser (IP address, browser type and version, operating system, time), iii. for registered and logged-in users, the respective identification number of the social network. This applies similarly to directly embedded YouTube videos.

As part of our offered services, you can communicate with us via the messenger service WhatsApp. The associated data processing is based on Art. 6 para. 1 lit. b) GDPR, as the communication is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. The collected information is stored on servers of the provider, including outside of Europe (see below for the conditions for transferring personal data to third countries). For more information on the purpose and scope of data collection and its processing by the messenger provider, please refer to the privacy policy provided by the provider: https://www.whatsapp.com/legal/privacy-policy-eea#privacy-policy-legal-basis-for-processing-data.

Unless otherwise stated, we process and store your personal data initially for the duration required for the respective purpose of use. This includes potentially the periods for initiating a contract (pre-contractual legal relationship) and for processing a contract. Based on this, personal data is regularly deleted in the context of fulfilling our contractual and/or legal obligations, unless their temporary further processing is necessary for the following purposes: i. Compliance with legal storage obligations, which arise, for example, from the Commercial Code (§§ 238, 257 para. 4 HGB) and the Tax Code (§147 para. 3, 4 AO). The storage or documentation periods specified there can be up to ten years. ii. Preservation of evidence considering the statute of limitations. According to §§ 194 ff. of the Civil Code (BGB), these limitation periods can be up to 30 years, with the regular limitation period being three years.

Insofar as we process personal data of our contractors, for example within the context of the contractor profile published on our website, or communicate via WhatsApp chats with our contractors and customers, this is part of the freelance contract concluded with the contractors. The legal basis for processing is Art. 6 para. 1 lit b GDPR, as processing is necessary for the fulfillment of this contract. Any further processing of personal data of the coaches is based on the consent of the respective tutor according to Art. 6 para. 1 lit. a GDPR, § 22 KUG.

10.1 Under the legal requirements, the following rights apply to you as an affected person: You can, under the conditions of Art. 15 GDPR, ask us if we process your data. If this is the case, you have the right to obtain information about this data. In the event that your data stored with us is incorrect or incomplete, you can request a correction and possibly completion of this data (Art. 16 GDPR). If the legal requirements are met, you can request the deletion (Art. 17 GDPR) or 'blocking' (Art. 18 GDPR) of your data. For automatically processed data, which we received from you based on your consent or a contract, you can claim the right to data portability (Art. 20 GDPR). We will then send you your data in a machine-readable format. If you wish and it is technically possible, we will transmit this data to a third party. All the aforementioned rights can be restricted or excluded by law in certain cases.

10.2 Revocation of consent: If you have given us consent to process personal data for specific purposes, the legality of processing is based on your consent. A given consent can be revoked. You can address the revocation to: hello@rockyourthesis.com. Please note that your revocation only affects the future. Processes that took place before the revocation are not affected.

10.3 Objection to processing based on a legitimate interest: We collect and process your personal data also to protect our legitimate interests or the legitimate interests of third parties, provided that data processing is necessary for these legitimate interests. In these cases, you have the right to object to processing in the future. You can direct this objection to hello@rockyourthesis.com.

10.4 Right to complain to a supervisory authority: Under the conditions of Art. 77 GDPR, you have the right to lodge a complaint with a competent supervisory authority. In particular, you can submit a complaint to the supervisory authority responsible for us or another competent supervisory authority. A list of data protection supervisory authorities and their contact details can be found at the following link: www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html

10.5 Other concerns: For further data protection questions and concerns, our data protection officer is available. Relevant requests and the exercise of your aforementioned rights should preferably be sent in writing to our above address or by email to hello@rockyourthesis.com.