We take the protection and security of your (hereinafter the “user”) personal data (hereinafter “pd”) as defined by Art. 4 no. 1 General Data Protection Regulation (hereinafter “GDPR”) seriously. Consequently, we comply with the statutory provisions to ensure adequate protection of the pd of every single user. We would like to inform you hereinafter about the nature, scope and purpose of the processing of pd.
1. Contact data of the controller (Art. 13 subs. 1 a) GDPR)
The controller responsible for the operation of the website and all sub-pages and thus for the handling of pd that is processed in this context is Chelsea Ranger, PA, MHs, C.Ranger Consulting, Oslo, Norway. email address: Chelsea@crangerconsulting.com.
2. Contact data of the data protection officer (Art. 13 subs. 1 b) GDPR)
Our data protection officer is Chelsea Ranger.
Types of pd: No log files of the respective user are collected automatically.
3. Contact by email via the email addresses of C.Ranger stated on the website (other than for application purposes, for this see sec. 5)
We offer you the possibility at different points on our website where the applicable email addresses are stated, to contact us directly by email.
a. Types of pd: These types are email address, log files containing information on the quality and attributes of the email and the time of receipt as well as all pd that, for instance, has been disclosed by the sender in his/her email.
b. Purposes of the processing (Art. 13 subs. 1 c) GDPR): The purpose of the processing is to answer the user’s request, and, subsequently, perhaps the initiation (taking steps prior to entering into a business relationship), the establishment and performance of a business relationship, depending of the kind of request made from time to time.
c. Legal basis for the processing (Art. 13 subs. 1 c) GDPR): The legal basis for the processing of the pd which the user transfers to us in the context of an email transmission is Art. 6 subs. 1 f) GDPR when the sender is not our customer yet or does not otherwise maintain a business relationship with us or is involved in the initiation of such a business relationship. If there is already a contractual relationship with the user or such a relationship is intended to be established on the sender’s initiative, the legal basis for the processing is Art. 6 subs. 1 b) GDPR.
d. Legitimate interests in the case of processing based on Art. 6 subs. 1 f) GDPR (Art. 13 subs. 1 d) GDPR): Our legitimate interests consist in informing you and answering your request, or, as the case may be, in entering into a business relationship with you where this is part of your request.
e. Recipients/ Third parties/Transfer to third countries (Art. 13 subs. 1 e) and f) GDPR): The pd is not transferred to third parties (Art. 4 no. 10 GDPR) unless the user has explicitly consented to the transfer. All emails are processed on our own server in Munich and thus, on computers within the European Union. The pd is not transferred to a third country and there is no intention to do so either. Transfer of pd to government bodies or authorities is made only within the limits of the law.
f. Periods until erasure (Art. 13 subs. 2 a) GDPR): The pd is erased upon expiry of 12 months from the time when the request was settled in technical respect (we know by experience and in consideration of the types of services we offer, that this is the typical request-answer cycle on the part of the user in the case of potential orders for service performance or other requests relating to our services) unless the specific nature of the request requires different handling (e.g. rendering of advice in advance). Where the request leads to a contractual relationship or prepares such a contractual relationship, the pd will be erased in accordance with the statutory provisions when the desired contractual or pre-contractual relationship has ended, that is after expiry of 12 months from the end of the said relationship unless Art. 17 subs. 3 GDPR applies, in particular where legal obligations to retain the pd must be complied with and/or the data is necessary for the establishment, exercise or defence of or against legal claims.
4. Transfer of job application documents
If you file a job application by email.
Types of pd: These types are email address including the logging of the email on our computers as well as all pd contained in your email that pertain to your application, e.g. title, last name, first name, details from the curriculum vitae, references/ certificates or the like.
a. Purposes of the processing (Art. 13 subs. 1 c) GDPR): The purpose of the processing is to select applicants and possibly establish an employment/service/freelance relationship with them.
b. Legal basis for the processing (Art. 13 subs. 1 c) GDPR): The legal basis for the processing is § 26 BDSG (German Federal Data Protection Act), and, as the case may be, Art. 6 subs. 1 b) GDPR (e.g. in the case of an application for freelance work).
c. Recipients/Third parties/Transfer to third countries (Art. 13 subs. 1 e) and f) GDPR): The pd is not transferred to third parties (Art. 4 no. 10 GDPR). All emails are processed on computers within the European Union, and we have concluded with the emails hoster a contract for data processing on behalf according to Art. 28 GDPR. The pd is not transferred to a third country and there is no intention to do so either. Transfer of pd to government bodies or authorities is made only within the limits of the law.
d. Periods until erasure (Art. 13 subs. 2 a) GDPR): The pd is erased within three months from termination of the application procedure (decision on whether or not your application is accepted) unless (i) the application was successful and the entire application documents are added to the personnel file (§ 26 BDSG – German Federal Data Protection Act), (ii) you as the applicant have explicitly consented that your data is entered in a “talent pool” or the like for a certain period of time (after expiry of which the pd will be erased) and/or (iii) Art. 17 subs. 3 GDPR applies, in particular where legal obligations to retain the pd must be complied with and/or the data is necessary for the establishment, exercise or defence of or against legal claims.
6. Rights of the user (Art. 13 subs. 2 b) – e), Art. 7 subs. 3 GDPR)
The user, subject to the statutory conditions being fulfilled, has the right at any time to request information which pb relating to him or her we have stored, Art. 15 GDPR, as well as the right to rectification of this data, Art. 16 GDPR, the right to restriction of the processing, Art. 18 GDPR, and the right to erasure of his or her data, Art. 17 GDPR. These rights may be modified due to national data protection law. Where the user has asserted a right to rectification, erasure or restriction of the processing against C.Ranger, C.Ranger will communicate any such rectification or erasure of pb or restriction of processing to each recipient to whom the relevant pd has been disclosed, unless this proves impossible or involves disproportionate effort. Moreover, the user has the right to withdraw any consent he/ she has given (Art. 7, Art. 6 subs. 1 a) GDPR), see Art. 7 subs. 3 GDPR. The withdrawal of consent does however not affect the lawfulness of processing based on consent before its withdrawal.
In addition, the user has the right to object, on grounds relating to his or her particular situation, at any time to processing of pd concerning him or her which is based on Art. 6 subs. 1 e) or f) GDPR, see Art. 21 GDPR. Moreover, the user has the right to receive the pd concerning him or her, which he or she has provided to C.Ranger, in a structured, commonly used and machine-readable format provided that the statutory conditions are fulfilled (right to data portability under the terms of Art. 20 GDPR) When the user wants to exercise any of the aforesaid rights, he/she must address to the bodies/ persons designated in sec. 1 or 2.