This website was created in accordance with the requirements of the German Telemedia Act (TMG). Personal data is processed on the basis of the Basic Data Protection Regulation and the Federal Data Protection Act (BDSG). Further information is available here.

Thank you for your interest in our online services. Protecting your private sphere is very important to us. The following information will explain to you the ways, scope and purposes of how we process your personal data and the rights which are available to data processing subjects.

1 General Section

1.1 Scope of application

This data protection notice applies for all web pages accessible under www.kompass-nachhaltigkeit.de, including their subpages (hereinafter referred to as “the Website”).

1.2 Legal basis

The legal basis for data protection is provided by the General Data Protection Regulation (GDPR) and German Data Protection Law (BDSG).

1.3 Name and address of Data Controller

Under GDPR and other national data protection legislation of EU member states, and other data protection provisions the following persons are named as Data Controller:

- subsequently referred to as “data controller”/“we”.

1.4 Name and address of Data Protection Officer

We have appointed the following as Data Protection Officer

Ziar Kabir (attorney)
SCO-CON:SULT GmbH
Hauptstraße 27
53604 Bad Honnef
E-mail: dsb@engagement-global.de
www.sco-consult.de

1.5 Contact information for the responsible supervisory authority

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit
Graurheindorfer Str. 153
53117 Bonn, Germany
Phone: +49 (0) 228 997799-0
E-Mail: poststelle@bfdi.bund.de or poststelle@bfdi.de-mail.de

1.6 General principles of data protection and your rights

1.6.1 Terminology

This data protection notice is based on terminology employed by European regulators in enacting the General Data Protection Regulation (GDPR). You can view the definitions of these terms on the official journal of the European Union.

1.6.2 Principles of processing personal data

The following principles apply to all processes described in this data protection notice:

1.6.2.1 Purpose and scope of processing personal data

Personal data is only collected for specific purposes. The scope of how this data is processed is limited to the extent necessary for the purposes of processing.

1.6.2.2 Legal basis for processing personal data

Personal data may be processed when at least one of the following conditions is met:

• Data subject has given consent (GDPR Art. 6 (1.a))
• Processing is necessary for the performance of a contract or for steps prior to entering into a contract (GPDR Art 6 (1.b))
• Processing is necessary for compliance with a legal obligation (GDPR Art 6 (1.c))
• Processing is necessary in order to protect the vital interests (GDPR Art 6 (1.d))
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (GDPR 6 (1.e)).
• Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject (GDPR 6 (1.f)).

1.6.2.3 Period of retention of personal data

Data subjects’ personal data will be erased or restricted as soon as the purpose for its storage no longer applies. Data may be stored beyond this period if permitted under European or German regulations, legislation or other requirements to which the data controller is subject. Data will be erased or restricted at the expiry of the deadline in one of the provisions named above, unless it is necessary to retain the data in order to enter into or perform a contract.

1.6.2.4 Holders of personal data

The holders of personal data of data subjects are essentially only the data controllers and data processors employed by them in compliance with data protection law. Furthermore data may be shared with third parties when the data controllers are required to under a permissive rule or due to legal requirements, or court or administrative law directives.

1.6.2.5 Transfer of personal data to third countries

Where data subjects’ personal data is transferred to countries outside the EU or European Economic Area (EEA), this will only take place where an adequate level of protection is in place (GDPR Art. 45), or where appropriate safeguards are in place (GDPR Art. 46), or under the conditions set out in GDPR article 49 for exceptions in certain cases.

1.6.2.6 Automated decision-making

As a responsible organisation, we do not employ automated decision-making or profiling.

1.6.3 Rights of data subjects

Data subjects enjoy the following rights:

1.6.3.1 Right to withdraw consent (GDPR Art. 7.3)

You can withdraw your consent for future data processing at any time.

1.6.3.2 Right of access to information (GDPR Art. 15)

You can request information about whether your personal data is being processed. Specifically, you can request information about the purposes of the processing, the categories of personal data, the categories of recipients or those to whom your data have been or will be disclosed, and the envisaged period for which data will be stored or the criteria used to determine that period. You may also request information about the rectification, erasure or restriction of data processing, and information about your right to lodge a complaint. You can also request information about the origin of data not collected from you. You may also ask to be informed where automated decision-making takes place, whether data is transferred to a third country or international organisation, and the safeguards in place for these transfers. You may request a copy of the personal data which concerns you, where this does not adversely affect the rights and freedoms of others.

1.6.3.3 Right to rectification (GDPR Art. 16)

You may request the immediate rectification of inaccurate data or that incomplete data held about you be completed, taking into account the purposes of data processing.

1.6.3.4 Right to erasure (GDPR Art. 17)

You may request the erasure of your personal data when the purpose of processing that data has expired or there is no other ground for the processing, when you have withdrawn consent for your data to be processed and there are no overriding legitimate grounds for the processing, when there is no legal ground for processing the data and the processing is not required to perform the right of freedom of expression and information, when there is no requirement for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority, or where processing is not required for the establishment, exercise or defence of legal claims. If we have made your data publicly available, we are required to take adequate steps to inform all recipients that you have requested the erasure of all links to or copies of your personal data.

1.6.3.5 Right to restriction of processing (GDPR Art. 18)

You have a right to request the restriction of processing of your data under the following conditions: if you contest the accuracy of your personal data, you may request a restriction of processing for a period necessary for the data controller to verify the accuracy; if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; if we no longer need your personal data for the purposes of the processing, but if you require your data for the establishment, exercise or defence of legal claims; or if you have objected to processing pursuant to GDPR Article 21 pending the verification whether the legitimate grounds of the controller override those of the data subject.

1.6.3.6 Right to data portability (GDPR Art. 20)

You have the right to receive the personal data concerning you, which you have provided to us with your consent or through a contract concluded with us, in a structured, commonly used and machine-readable format. You may also request that your data be transmitted to another controller where this does not adversely affect the rights and freedoms of others and where this is technically feasible.

1.6.3.7 Right to object (GDPR Art. 21)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data which is based on points (e) or (f) of Article 6(1), except where we have compelling legitimate grounds for the processing which override your interests, rights and freedoms. You have the right to object at any time to processing which we carry out for purposes of direct marketing. In that case your data may no longer be used for these purposes.

1.6.3.8 Right to complaint (GDPR Art. 77)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to him or her infringes GDPR regulations.

1.7 Information on cookies and similar technologies

Cookies are text files created when a browser accesses a web page, in order to save data about a browser during and after a visit to a web page. Cookies regularly store unique character strings by means of which a server can recognise a web browser. Cookies can be stored by the page which was visited (first party) or by third-party providers where their services are used on the page which has been visited. If a third-party service is used across multiple websites, the third-party provider may store user activity data in cookies and follow them across multiple sites. The cookie stores the page domain from which the cookie originates and access is limited to that domain. Cookies are valid either for a single period of use of a web browser (known as “session cookies”) or until a time recorded in the cookie itself (“persistent cookies”). Expired cookies are no longer loaded by the browser when visiting a web page, and are deleted or overwritten, depending on the browser concerned.

You can configure your browser to inform you when cookies are set and only accept cookies in individual cases, accept cookies in certain cases, or decline them for all cases. Browsers can also be configured to delete cookies on closing the browser. However deactivating cookies may under certain circumstances prevent access to the full functionality of our website. You can find information about cookies in the help section of your browser or at the following links:

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge
• Internet Explorer
• Opera

Data for these purposes may also be saved in your browser’s local storage or local session storage.

Please see the section on Cookies in this data protection notice for more information on specific processes involved in the use of cookies and similar technologies.

1.8 Changes to this data protection notice

We reserve the right to update this data protection notice to ensure it remains in line with current legal requirements or to reflect changes in the services we provide. The new data protection notice will apply on your next visit to the site.

2 Specific points

2.1 Website provision

An external contractor provides our website as part of a contractual agreement. This contractor is obliged to comply with data protection regulations to the same extent that we are, and ensures that you can enjoy safe and reliable access to the data on our website. Data subjects’ personal data captured through the website is saved on the contractors’ servers located within the European Economic Area. Data is saved separately from other applications. The contractor processes personal data only in accordance with our instructions and to the extent necessary to fulfil their contractual obligations.

2.2 Collection of access and connection data

Every time our website is accessed, our system automatically collects information about the computer system of the browser accessing our website.

2.2.1 Scope of processing

The following data may be collected if they are transmitted by your browser:

• the type and version of browser you are using
• your operating system
• date and time of accessing the servers
• Address of previously visited referring page of a website.
• Address of the page accessed on our website
• Your IP address

Data is saved in log files, although IP addresses collected are anonymised before data is saved. This data is not saved in connection with the personal data of data subjects.

2.2.2 Legal basis for processing

The legal basis for processing data is GDPR article 6 (1.e).

2.2.3 Purpose of processing

Our system needs to process IP addresses in order to transmit our website to the data subject’s computer. Anonymised log files are saved to monitor system stability and security.

2.2.4 Data retention period

No personal data is saved.

2.2.5 Rights to object and request erasure

The rules of GDPR article 21 apply as regards the right to object against processing which takes place on the basis of article 6 (1.e). However, as this processing is essential to ensure the functionality and security of our IT systems, there is generally no possibility of objecting to data processing.

2.3 Session allocation

Session cookies may be stored in your browser when you use our website.

2.3.1 Scope of processing

Our system assigns your browser a unique identifier and saves it for the duration of your session. This identifier is saved in a cookie and is transmitted to our system when you access pages of our website. This identifier may be linked to other data which we collect through our website. The cookie is only valid for our website can cannot be used to track your activities on third-party websites.

2.3." Saving and accessing data in your browser

The following sessions may be saved and uploaded from your browser in order to allocate sessions:

2.3.3 Legal basis for processing

The legal basis for processing data is GDPR article 6 (1.e).

2.3.4 Purpose of processing

Session identifiers are used to identify requests from a browser system-side. Our servers need to identify requests from browsers for purposes such as protecting against the misuse of forms.

2.3.5 Data retention period

Session data is deleted at the end of a session or after a time limit appropriate to the purposes.

2.3.6 Rights to object and request erasure

The rules of GDPR article 21 apply as regards the right to object against processing which takes place on the basis of article 6 (1.e). However, as this processing is essential to ensure the functionality and security of our IT systems, there is generally no possibility of objecting to data processing.

2.4 Administering consent

Our website uses cookies to save certain settings and/or the status of your consent for services used on our website. Resources for managing user settings are provided by our services and no personal data is processed.

The following entries are created and read in your browser to manage settings and consent. Deleting these entries will delete all saved settings and may revoke consent that has been granted. Our website will then use the standard settings for the service concerned.

2.5 YouTube videos

Our website includes embedded videos which are served from the YouTube platform. YouTube is a platform of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (henceforth “Google”). Google acts as a third party in this service relationship.

2.5.1 Scope of processing

If you have consented to videos from YouTube and access a page on our website which includes embedded videos from YouTube, your browser connects to Google servers in the USA in order to load resources for video components, preview images and fonts. Doing this will transmit your IP address, the address of the page you are visiting and information about your browser and operating system. Google can link this information with your personal Google account if you are logged in to Google at the time of visiting our website. Configuration data is saved on your device with which YouTube can recognise the browser you are using and apply any user settings you have configured.

On our website YouTube videos are embedded in “privacy-enhanced” mode. This instructs YouTube not to set cookies with advertising profiles or user behaviour data. This setting only applies to YouTube videos we have embedded and has no effect on other videos or links which you may be able to access through a video shown on our website. You can find more information on Google’s website:

• Privacy-enhanced mode
• Google privacy policy and terms of service

2.5.2 Saving and accessing data in your browser

Embedded YouTube videos can cause the following data to be saved and uploaded from your browser:

2.5.3 Legal basis for processing

The legal basis for processing data is GDPR article 6 (1.a).

2.5.4 Purpose of processing

Embedding is used to make it possible to show YouTube videos on our website. YouTube provides the necessary storage and technical infrastructure to serve video content. Uploading video content to YouTube for users to watch on that platform makes it possible to reach a wider audience.

2.5.5 Data transfer to third countries

Google processes and transfers its data to third countries such as the USA, for which no adequacy decision exists with the EU. No equivalent safeguards exist for the transmission of your IP address in embedded YouTube videos, so it is not possible to guarantee that data protection legislation applicable in the EU will be complied with or that your rights will be upheld. If you nevertheless consent to being shown YouTube videos, your data will be processed on the basis of your consent in the absence of an adequacy decision (see GDPR Art. 49 (1.a)).

2.5.6 Data retention period

We do not save any personal data as part of embedding YouTube videos. You can find information about Google’s criteria for retaining data it collects in Google’s data retention policy.

2.5.7 Rights to object and request erasure

You can inspect the status of your consent in our consent manager and revoke consent at any time.

2.6 OpenStreetMap

On our website we use the OpenStreetMap service from OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom (henceforth: “OSMF”). OSMF acts as a third party in this service relationship.

2.6.1 Scope of processing

If you have consented to OpenStreetMap maps and access a page on our website which includes embedded OpenStreetMap maps, your browser connects to OSMF servers in order to load resources for video components, preview images and fonts. Doing this will transmit your IP address, the address of the page you are visiting and information about your browser and operating system. To the best of our knowledge this data is only processed to show maps and is not shared with third parties. You can find more details on how OSMR processes data in their privacy policy.

2.6.2 Legal basis for processing

The legal basis for processing data is GDPR article 6 (1.a).

2.6.3 Purpose of processing

Embedding is used to make it possible to show OpenStreetMap geographical maps on our website. Showing maps in connection with addresses improves the user-friendliness of our service.

2.6.4 Data retention period

We do not save any personal data as part of embedding OpenStreetMap maps.

2.6.5 Rights to object and request erasure

You can inspect the status of your consent in our consent manager and revoke consent at any time.

2.7 Using our service forms

Municipalities and businesses can use our website to publish examples of good practice for sustainable municipal procurement and be listed as providers of demonstrably sustainable products in our supplier list.

2.7.1 Scope of processing

The forms collect data for communication with you and data intended for publication. While data collected for communicating with you are only processed by responsible offices of the data controller, data collected for publication may be used in the following ways:

• Publication as part of the Kompass Nachhaltigkeit service
• Use at seminars
• Use in strategy consultations, including by third parties.

If you consent and submit examples of good municipal practice, we will share your data intended for publication with the bodies which can be selected in the form.

If you upload for publication any documents including personal data, you must ensure that the persons affected have agreed to the publication of their data. If this is not possible, you must redact their personal data.

2.7.2 Legal basis for processing

The legal basis for processing data collected through our service forms is GDPR article 6 (1.a). Delivery of emails with links to change entries is carried out on the basis of GDPR article 6 (1.e).

2.7.3 Purpose of processing

We use your data to communicate with you if we have any questions about your example, your business, the product you are advertising or demonstrating, and to assess and (where appropriate) publish your example, business, products and associated public contact information.

2.7.4 Data retention period

Your data is saved until you withdraw consent. We reserve the right to erase data if the information is no longer relevant to our service or if providers do not update their data annually as required.

2.7.5 Rights to object and request erasure

You can withdraw your consent for future data processing at any time. If you would like to request changes to or the erasure of data you have submitted for Kompass Nachhaltigkeit, please contact us at info[at]kompass-nachhaltigkeit.de.

Providers can use this form to update their data by entering their email address (under “Communication with Kompass Nachhaltigkeit”).

2.8 Publishing experts’ contact information

If you are an expert in the field of a product group and are interested in sharing your knowledge, we would be very happy to list you as a point of contact in the corresponding page area.

2.8.1 Scope of processing

With your consent we usually publish the following data on our service:

• Organisation
• Name
• Phone number
• E-mail address
• Photo

2.8.2 Legal basis for processing

The legal basis for processing data is GDPR article 6 (1.a).

2.8.3 Purpose of processing

This data is processed in order to publish your contact data as part of our service, so that interested persons can contact you as an expert on a product or product group.

2.8.4 Data retention period

We save your data until you withdraw your consent. We reserve the right to erase it if your information is no longer relevant to our service.

2.8.5 Rights to object and request erasure

You can withdraw your consent for future data processing at any time. If you would like to request changes to or the erasure of data you have submitted for Kompass Nachhaltigkeit, please contact us at info[at]kompass-nachhaltigkeit.de.

2.9 Contact

Our website lists contact information such as addresses, phone numbers and e-mail addresses which make it easy for users to directly contact us and the contacts who work with us. Our website includes a contact form.

2.9.1 Scope of processing

We process the personal data that you share with us, depending on the type of communication method you choose. This could include your full name, address, phone number, e-mail address and other personal data which you share with us in the course of communicating with us. The recipients of this data are those persons who work in our area of responsibility and contractors we employ in compliance with data protection law. Subject to general data protection regulations, your data will not be shared with third parties without your consent.

2.9.2 Legal basis for processing

The legal basis for processing personal data in conjunction with communicating with you is GPDR article 6 (1.e). If the contact is connected with the aim of initiating or fulfilling a contract, the legal basis for this processing is GDPR article 6 (1.b).

2.9.3 Purpose of processing

We process your data for the purpose of making contact, communicating and following up communications with you.

2.9.4 Data retention period

Your data will be erased as soon as it is no longer required to achieve the purpose of storing it. This judgement will be made on a case-by-case basis. In all other respects, the general terms for the period of data retention apply.

2.9.5 Rights to object and request erasure

The rules of GDPR article 21 apply as regards the right to object against processing which takes place on the basis of article 6 (1.e). An objection may be opposed on the grounds that processing the data is necessary to initiate or fulfil a contract, or provide evidence.

2.10 “Mein Kompass” area

Our website includes functionality to create individual areas for individual municipalities within the “Mein Kompass section”, which allows specified employees of the municipality concerned to log in through their user profiles.

2.10.1 Scope of processing

The “Mein Kompass” area is aimed at municipalities and their members. For a municipality and individuals from that municipality to use the service, the municipality must first register with a municipality administrator. The privileged rights held by this user require that our staff check the user’s identity. This checks that the person named as the municipality administrator actually works for the municipality and is allowed to carry out this role on behalf of the municipality. The verification process checks the person’s contact data (name and e-mail address) by following up with the municipality, such as its human resources officer, human resources manager or line manager. Once verification is complete, the municipality administrator can add additional users to the municipality. This collects the following information, with compulsory fields marked with an asterisk:

• Title
• First name*
• Surname*
• City*
• Phone number
• E-mail address*
• Profile picture

Their data is stored in our system and used for access to the “Mein Kompass” area.

If you use our service as a municipality administrator, we use your contact information to inform you of technical changes, for questions about your municipality, and other questions connected with how your municipality uses our service.

2.10.2 Legal basis for processing

The legal basis for processing data is GDPR article 6 (1.a).

2.10.3 Purpose of processing

The data is processed to provide our service, in particular to support municipalities with sustainable procurement, and producing evidence of sustainable procurement. This requires verification of the person registered with administrator rights and the person registered as the municipality administrator. Data for users of the “Mein Kompass” area is compared with user data from our e-learning platform in order to evaluate the effectiveness and usage of this service. User data is also summarised in anonymised form and used to evaluate service use.

2.10.4 Data retention period

We retain the data we collect from you for as long as your user account exists. You can request the deletion of your user account at any time by contacting us at info[at]kompass-nachhaltigkeit.de.

2.10.5 Rights to object and request erasure

The conditions of GDPR article 21 apply to objections. If you would like to object to the processing of your data, please send your reasons to info[at]kompass-nachhaltigkeit.de.

2.11 Website usage measurement with Google Analytics

This website uses Google Analytics, a service for analysing visitor flows provided by Google. Google acts as data processor in this service relationship.

2.11.1 Scope of processing

If you have consented to the use of Google Analytics, accessing our page on our website opens a connection to Google servers in order to load the script required for Google Analytics. Doing this will transmit your IP address, the address of the page you are visiting and information about your browser and operating system. At the point when Google Analytics is initialised, cookies are saved which include unique identifiers which allow your browser to be recognised when it accesses pages on our website. These cookies are only valid for our website can cannot be used to track your activities on third-party websites.

Accessing a page on our website causes the processing and transmission of other data about the impression to Google’s servers in the USA. This data includes the page from which you navigated to our page and the page you requested, browser and system information such as your browser, operating system and IP address, and data from cookies, including identifiers stored in cookies.

This website employs IP masking to anonymise IP addresses. If you access our website from a location within an EU member state or the European Economic Area, your IP address will be shortened to remove the individual identifying element. You can find more information about the data which is transmitted in the following articles by Google:

• Tracking Code Overview
• IP masking
• Safeguarding your data

2.11.2   Saving and accessing data in your browser

The following cookies may be stored and uploaded from your browser to measure visitor flows and advertising reach. You can find more information in the Google articles on cookie types and cookies used for Google Analytics.

2.11.3 Legal basis for processing

The legal basis for processing data is GDPR article 6 (1.a).

2.11.4 Purpose of processing

We use Google Analytics to measure and evaluate visitor flows to our website. Google processes the data we collect to evaluate usage of our website and produce reports on usage of our website.

2.11.5 Data transfer to third countries

Google processes and transfers its data to third countries such as the USA, for which no adequacy decision exists with the EU. Google’s standard contractual clauses require it to comply with European data protection law in third countries and these therefore provide an adequate safeguard for the protection of personal data as per GDPR article 46 (2.c).

2.11.6 Data retention period

Entries in the statistics supplied to us by Google are deleted after 26 months. You can find information about Google’s criteria for retaining data it collects in Google’s data retention policy.

2.11.7 Rights to object and request erasure

You can inspect the status of your consent in our consent manager and revoke consent at any time. This does not affect the legality of processing carried out before consent is withdrawn. A cookie stores your decision about the use of this service. It only applies to that browser and must be renewed once the stated period of validity has expired.