Privacy Policy
General Information
We process personal data insofar as this is necessary for the provision, operation and security of our website, for handling inquiries and for providing the services offered through our website, or insofar as another legal basis exists for such processing.
Pursuant to Article 4 No. 1 GDPR, personal data means any information relating to an identified or identifiable natural person.
Pursuant to Article 4 No. 2 GDPR, processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
With this Privacy Policy, we inform you pursuant to Articles 13 and 14 GDPR about the processing of personal data in connection with our website. The information below applies in each case to those processing operations for which the information stated is actually relevant.
Where we make use of services or providers of third parties for individual processing operations, the respective providers, purposes, legal bases and, where applicable, other information required will be specified in greater detail in the relevant sections of this Privacy Policy.
Information about us as the Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
OndoSense GmbH
Bötzinger Str. 60
D-79111 Freiburg im Breisgau
Germany
Telephone: +49 761 4882 4693
Email: info@ondosense.com
Where a data protection officer has been appointed, they can be contacted using the relevant contact details.
Rights of Users and Data Subjects
As a data subject, you have, subject to the applicable statutory requirements, the following rights in particular:
- Right of access pursuant to Article 15 GDPR: You have the right to request information as to whether personal data concerning you are being processed. If this is the case, you have, subject to the statutory requirements, the right to obtain access to the personal data processed and the further information specified in Article 15 GDPR.
- Right to rectification pursuant to Article 16 GDPR: You have the right to request the rectification of inaccurate personal data and, taking into account the purposes of the processing, the completion of incomplete personal data.
- Right to erasure pursuant to Article 17 GDPR: Subject to the statutory requirements, you have the right to request the erasure of personal data concerning you. The right to erasure does not apply in particular where processing is necessary for the reasons set out in Article 17(3) GDPR.
- Right to restriction of processing pursuant to Article 18 GDPR: Subject to the statutory requirements, you have the right to request the restriction of the processing of your personal data.
- Right to data portability pursuant to Article 20 GDPR: Subject to the statutory requirements, you have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format. This applies in particular where the processing is based on consent pursuant to Article 6(1)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR and the processing is carried out by automated means.
- Right to object pursuant to Article 21 GDPR: Where processing is based on Article 6(1)(e) or (f) GDPR, you have, subject to the statutory requirements, the right to object to the processing on grounds relating to your particular situation. Where personal data are processed for the purposes of direct marketing, you have the right to object to such processing at any time.
- Right to withdraw consent: Where processing is based on your consent, you may withdraw your consent at any time with effect for the future. The lawfulness of processing carried out on the basis of consent prior to its withdrawal shall remain unaffected.
- Right to lodge a complaint with a supervisory authority: Pursuant to Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority, in particular with a supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement.
The applicable statutory requirements and limitations of the aforementioned rights remain unaffected.
Where we have disclosed personal data to recipients, we shall inform those recipients of any rectification, erasure or restriction of processing insofar as and to the extent required under Article 19 GDPR. Such notification shall not be required where this proves impossible or involves disproportionate effort.
You may exercise your rights at any time by contacting us using the contact details stated above.
Information on Data Processing
We process personal data only for as long as this is necessary for the respective processing purpose or as long as statutory retention obligations or other statutory reasons require further storage.
Unless this Privacy Policy specifies a different retention period for individual processing operations, personal data will be erased as soon as the purpose of the processing no longer applies and no statutory retention obligations or other statutory reasons prevent erasure.
Server Data
When our website is accessed and used, data may be processed for technical reasons that are transmitted to the server by the browser you use.
This may include, in particular:
- IP address of the accessing device;
- date and time of access;
- pages and files accessed;
- amount of data transferred;
- information concerning the browser and operating system used;
- where applicable, the website visited previously (referrer URL);
- and other data technically required.
Processing of this data may be necessary to establish the connection to the website, ensure its technical functionality and security, and detect and address errors and security-related incidents.
Where personal data are processed as part of server log files, such processing is generally based on Article 6(1)(f) GDPR. Our legitimate interest lies in particular in ensuring the technical functionality and security of our website and in preventing and investigating misuse and attacks.
Server log files are generally stored only for as long as necessary for the purposes stated above. Where storage for a longer period is necessary to investigate or document a specific security incident or for other statutory reasons, the data may be stored for the period required for that purpose.
Cookies and Other Information on the End Device
Our website may use cookies or comparable technologies. These are pieces of information that are stored on your end device or that access information already stored on your end device.
Section 25 of the German Telecommunications and Telemedia Data Protection Act (TDDDG) applies to the storage of information in the end device of the end user or access to information already stored in the end device. Accordingly, consent is generally required unless a statutory exception applies.
Consent is not required in particular where the storage of information or access to information already stored is strictly necessary to provide the digital service expressly requested by you, or where another statutory exception pursuant to Section 25(2) TDDDG applies.
Where consent is required for the storage of information on your end device or access to information already stored there, processing will only take place after you have given your consent.
Where personal data are processed through cookies or comparable technologies, the lawfulness of such processing is additionally governed by the provisions of the GDPR.
Session Cookies
Where technically necessary session cookies are used on our website, they serve in particular to provide the website functions requested by you and to enable technically proper use.
Session cookies are generally deleted at the end of the respective session or after the browser is closed, unless a longer storage period is technically provided for.
Cookies and Technologies from Third-Party Providers
Where cookies or comparable technologies provided by third parties are used on our website, the respective providers, purposes and legal bases for processing are specified in the relevant sections of this Privacy Policy or in the consent management system used.
The use of cookies or comparable technologies for analytics, marketing or other purposes that are not strictly necessary generally takes place only after the relevant consent has been obtained, insofar as consent is required for such use.
Management of Cookies and Consent
Where a consent management system is used on our website, you may review the settings you have made there at any time and, where provided for, change or withdraw them using the relevant function.
In addition, you may manage or delete cookies through your browser settings. The specific procedure depends on the browser used and its settings.
Disabling or deleting certain cookies may result in individual functions of our website not being available or only being available to a limited extent.
Newsletter
Where we offer a newsletter and you subscribe to it, we process the personal data you provide as part of the subscription for the purpose of sending the newsletter.
Which information is required as part of the subscription is indicated by the respective fields in the subscription form. Where additional information may be provided voluntarily, such information will only be processed for the purposes specified in each case.
Your consent will be obtained for sending the newsletter. The legal basis for processing is Article 6(1)(a) GDPR.
Where additional technical data are processed as part of the subscription or dispatch, for example to document consent, prevent abusive subscriptions or technically facilitate the dispatch of the newsletter, this will only take place where an appropriate legal basis exists.
You may withdraw your consent to receiving the newsletter at any time with effect for the future. In particular, you may use the unsubscribe link contained in the newsletters or contact us using the contact details stated above.
The lawfulness of processing carried out on the basis of consent prior to its withdrawal shall remain unaffected.
Following withdrawal of consent or unsubscribing, the data processed for sending the newsletter will generally be deleted or blocked from further dispatch, unless statutory retention obligations or other statutory reasons prevent further storage.
Where proof of consent having been given or withdrawn is required, the information necessary for this purpose may, to the extent permitted by law, be stored beyond the termination of the newsletter subscription.
Contact Inquiries / Contact Options
If you contact us via the contact form or by email, we process the personal data you provide insofar as this is necessary to process and respond to your inquiry.
Providing the data marked as mandatory in the contact form is necessary for processing and responding to your inquiry. Without this information, we may be unable to process your inquiry or may only be able to do so to a limited extent.
The data transmitted via the contact form are processed and stored as part of the technical provision and use of the contact form. The processing serves the purpose of processing and responding to your inquiry.
We use SiteGround to host our website and for the associated processing of personal data. Where SiteGround processes personal data on our behalf, such processing is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR.
Where communication by email takes place as part of processing your inquiry, Microsoft 365 may be used for this purpose. The personal data required to process and respond to your inquiry may be processed in this context.
The legal basis for processing is generally Article 6(1)(f) GDPR. Our legitimate interest consists in processing and responding to inquiries addressed to us and in the associated communication.
Where contacting us is aimed at taking pre-contractual steps carried out at your request or where processing is necessary for the performance of a contract, processing may be based on Article 6(1)(b) GDPR.
Your personal data will be deleted as soon as the purpose of processing no longer applies and no statutory retention obligations or other statutory reasons prevent further storage.
Where your inquiry results in a contractual relationship or another legal obligation, the relevant data may be further processed to the extent necessary for the duration of the applicable statutory retention periods.
Online Job Applications / Publication of Job Advertisements
We offer you the opportunity to apply for advertised positions via our website. As part of the application process, we process the personal data submitted by you through the application form, including the application documents you provide, insofar as this is necessary to conduct the application process and decide whether to establish an employment relationship.
Application data are submitted via an application form on our website and processed and stored as part of the technical provision and use of the application form. This also applies to files submitted by you, such as CVs, cover letters or certificates. The processing serves the purpose of conducting and administering the application process.
We use SiteGround to host our website and for the associated processing of personal data. Where SiteGround processes personal data on our behalf, such processing is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR.
As part of processing applications, application data may be made accessible to the employees of OndoSense responsible for this purpose, insofar as this is necessary to conduct the application process.
Where communication by email takes place as part of processing applications, Microsoft 365 may be used for this purpose. The personal data required to process the application may be processed in this context. Where Microsoft processes personal data on our behalf, such processing is carried out on the basis of the applicable data protection and contractual provisions.
The legal basis for processing application data is Section 26(1) sentence 1 of the German Federal Data Protection Act (BDSG), insofar as processing is necessary for the decision on establishing an employment relationship.
If an employment relationship is established following completion of the application process, the data submitted as part of the application may, insofar as necessary for establishing and performing the employment relationship, be further processed for personnel administration purposes and as part of the personnel file. The applicable statutory provisions, in particular data protection requirements, shall be observed.
The legal basis for this is Section 26(1) sentence 1 BDSG, insofar as processing is necessary for establishing, performing or terminating the employment relationship.
If your application is unsuccessful, the personal data collected as part of the application process will generally be deleted no later than six months after completion of the application process, unless longer storage is required or permitted by law for the assertion, exercise or defence of legal claims.
Storage beyond completion of the application process may serve in particular the assertion, exercise or defence of legal claims, especially in connection with potential claims under the General Act on Equal Treatment (AGG).
The legal basis for such processing is Article 6(1)(f) GDPR. Our legitimate interest lies in the assertion, exercise or defence of legal claims.
If you expressly consent to storage of your application data beyond this period, for example for inclusion in an applicant or talent pool, your data will be further processed on the basis of your consent for the purposes specified in the consent.
The legal basis in this case is Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal shall remain unaffected.
X (Twitter)
We maintain a company presence on the X platform in order to provide information about our company and our services and to communicate with prospective customers and customers.
X is a service of X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. For users in the European Union, the EFTA States and the United Kingdom, X identifies this company as the controller responsible for the processing of personal data.
When visiting our company presence or interacting with the content provided there, personal data may be processed by X. This may include, in particular, information concerning the user account, interactions with our content, and technical and usage-related information.
We generally have no complete control over the nature and scope of the processing of personal data carried out by X. Processing by X is governed by X's privacy policy.
X states that, as part of its global operations, personal data may be processed in, among other places, the United States, Ireland and other countries. The legal bases and safeguards specified by X apply to such transfers.
Further information on the processing of personal data by X can be found in X's privacy policy:
YouTube
We maintain a presence on the YouTube platform in order to provide information about our company and our services and to make relevant content available.
YouTube is a service provided by Google. When visiting our YouTube presence or interacting with content provided there, personal data may be processed by YouTube and/or Google.
We generally have no complete control over the nature and scope of the processing of personal data carried out by YouTube and/or Google.
Further information on the processing of personal data by Google and YouTube can be found in Google's privacy policy:
https://policies.google.com/privacy
We maintain a company page on LinkedIn in order to provide information about our company and our services and to communicate with prospective customers and customers.
LinkedIn is a service provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
When visiting or interacting with our LinkedIn company page, personal data may be processed. LinkedIn provides operators of company pages with statistical analyses concerning the use of the respective company page in particular.
Where personal data are processed in connection with such Page Insights, joint controllership between LinkedIn and us may exist. The respective joint controllership is governed by the applicable agreements and information provided by LinkedIn.
We generally have no complete control over the nature and scope of any further processing of personal data by LinkedIn.
Further information on the processing of personal data by LinkedIn can be found in LinkedIn's privacy policy:
https://www.linkedin.com/legal/privacy-policy
We maintain a company presence on XING in order to provide information about our company and our services and to communicate with prospective customers and customers.
XING is a service provided by New Work SE, Am Strandkai 1, 20457 Hamburg, Germany.
When visiting our XING presence or interacting with content provided there, personal data may be processed by XING.
We generally have no complete control over the nature and scope of the processing of personal data carried out by XING.
Further information on the processing of personal data by XING can be found in the provider's privacy policy:
https://privacy.xing.com/de/datenschutzerklaerung
We maintain a company page on Facebook in order to provide information about our company and our services and to communicate with prospective customers and customers.
Facebook is a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
When visiting or interacting with our Facebook company page, personal data may be processed by Meta. This may include, in particular, information concerning interactions with our page and the content provided there.
Meta may provide us with statistical analyses concerning the use of our Facebook company page. Where joint controllership between Meta and us exists in connection with such analyses, it shall be governed by the applicable agreements and statutory requirements.
We generally have no complete control over the nature and scope of any further processing of personal data carried out by Meta.
Further information on the processing of personal data by Meta can be found in Meta's privacy policy:
https://www.facebook.com/privacy/policy/
Bluesky
We maintain a company presence on the Bluesky platform in order to provide information about our company, our services and current developments and to communicate with prospective customers and other users.
The provider of the platform is Bluesky Public Benefit Corporation. When visiting our company presence or interacting with content published there, personal data may be processed by Bluesky. This may include, in particular, technical information, information concerning use of the platform and interactions with our published content.
As Bluesky is a public platform, posts and other content made publicly available by us may generally also be accessible outside the platform or without having a Bluesky account.
We generally have no complete control over the nature and scope of the processing of personal data carried out by Bluesky. Bluesky is independently responsible as controller within the meaning of the GDPR for processing of personal data carried out by Bluesky itself.
Further information on the processing of personal data by Bluesky can be found in Bluesky's privacy policy:
https://bsky.social/about/support/privacy-policy
Vimeo
We maintain a company presence or profile on the Vimeo platform in order to provide information about our company and our services and to publish video content provided by us.
Vimeo is a service provided by Vimeo.com, Inc., New York, New York, USA.
When visiting our Vimeo company presence or Vimeo profile or interacting with content provided there, personal data may be processed by Vimeo. This may include, in particular, information concerning the user account, interactions with our content, and technical and usage-related information.
We generally have no complete control over the nature and scope of the processing of personal data carried out by Vimeo.
Vimeo provides various options for managing the visibility of profiles and videos. The specific processing of personal data may therefore depend in particular on the respective account configuration, the settings of published content and users' interaction with Vimeo.
Further information on the processing of personal data by Vimeo can be found in Vimeo's privacy policy:
Links to Social Media Platforms
Our website may contain links to our presences on social networks and other online platforms.
Where a link is merely provided and no content from the respective social network is directly embedded in our website, merely accessing our website generally does not establish a connection to the respective social network solely by virtue of that link.
The respective platform operator may process personal data in connection with the use of the linked platform, in particular when you click on the relevant link and visit the website or service of the respective provider.
From the time you access the respective platform, the privacy policy of the respective provider shall apply. We generally have no complete control over the processing operations carried out there.
Our website may contain links to the following platforms in particular:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland
Privacy policy:
https://www.facebook.com/privacy/policy/
X
X Internet Unlimited Company
One Cumberland Place
Fenian Street
Dublin 2, D02 AX07
Ireland
Privacy policy:
YouTube
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Privacy policy:
https://policies.google.com/privacy
LinkedIn Ireland Unlimited Company
Wilton Plaza
Dublin 2
Ireland
Privacy policy:
https://www.linkedin.com/legal/privacy-policy
New Work SE
Am Strandkai 1
20457 Hamburg
Germany
Privacy policy:
https://privacy.xing.com/de/datenschutzerklaerung
Bluesky
Bluesky Social PBC
Seattle, Washington
USA
Privacy policy:
https://bsky.social/about/support/privacy-policy
Vimeo
Vimeo.com, Inc.
New York, New York
USA
Privacy policy:
Google Analytics
Where we use Google Analytics, we use the service for statistical analysis of the use of our website.
Google Analytics is a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When using Google Analytics, information concerning the use of our website and technical information concerning the end device and browser used may in particular be processed.
Where the use of Google Analytics requires consent, Google Analytics will only be used after the relevant consent has been obtained. The legal basis for processing personal data in this case is Article 6(1)(a) GDPR.
Section 25 TDDDG additionally applies to the storage of information on the end device or access to information already stored on the end device, insofar as its requirements are met.
Where personal data are transferred to Google or processed by Google outside the European Union or the European Economic Area, the respective applicable data protection requirements and safeguards shall apply.
Further information on the processing of personal data by Google can be found in Google's privacy policy:
https://policies.google.com/privacy
Google Maps
Where we use Google Maps on our website, this serves in particular to display our location and, where applicable, to assist with route planning.
Google Maps is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The integration of Google Maps may establish a connection to Google's servers. In this context, technical information, including the IP address, and other information required to provide the service may be processed.
Where consent is required for the integration of Google Maps, the connection to Google required for this purpose will only be established after the relevant consent has been obtained.
The legal basis for processing personal data on the basis of consent is Article 6(1)(a) GDPR. Section 25 TDDDG additionally applies to the storage of information on the end device or access to information already stored on the end device, insofar as its requirements are met.
Further information on the processing of personal data by Google can be found in Google's privacy policy:
https://policies.google.com/privacy
Google Fonts
Where we obtain Google Fonts via Google's servers, a connection to Google's servers may be established when the relevant pages of our website are accessed.
In this context, technical information, in particular the IP address and information concerning the end device and browser used, may be processed insofar as this is necessary to provide the fonts.
Where consent is required for the external integration of the fonts, the fonts will only be integrated after the relevant consent has been obtained.
The legal basis for processing personal data on the basis of consent is Article 6(1)(a) GDPR.
Further information on the processing of personal data by Google can be found in Google's privacy policy:
https://policies.google.com/privacy
Font Awesome
Where we obtain Font Awesome via external servers, a connection to the servers of Fonticons, Inc. may be established when the relevant pages of our website are accessed.
In this context, technical information, in particular the IP address and information concerning the end device and browser used, may be processed insofar as this is necessary to provide the relevant content.
Where consent is required for the external integration, the integration will only take place after the relevant consent has been obtained.
The legal basis for processing personal data on the basis of consent is Article 6(1)(a) GDPR.
Further information on the processing of personal data by Font Awesome can be found in the provider's privacy policy:
https://fontawesome.com/privacy
YouTube – Embedded Videos
Where we embed YouTube videos directly into our website, the embedding may establish a connection to the servers of YouTube and/or Google.
We may use the enhanced privacy mode offered by YouTube. The specific processing depends on the technical integration of the video and on interaction with the video.
Where consent is required for embedding the YouTube video, the connection to YouTube required for this purpose will only be established after the relevant consent has been obtained.
The legal basis for processing personal data on the basis of consent is Article 6(1)(a) GDPR. Section 25 TDDDG additionally applies to the storage of information on the end device or access to information already stored on the end device, insofar as its requirements are met.
Further information on the processing of personal data by Google and YouTube can be found in Google's privacy policy:
https://policies.google.com/privacy
Vimeo – Embedded Videos
Where we embed Vimeo videos directly into our website, embedding the Vimeo player may establish a connection to Vimeo's servers.
In this context, technical information, including the IP address, information concerning the end device and browser used, and information concerning the use of the embedded player may be processed.
With regard to the processing of personal data in connection with its embedded player, Vimeo generally considers itself to be an independent controller within the meaning of the GDPR. Accordingly, processing by Vimeo as a processor is not assumed for the normal use of the embedded player.
Where consent is required for embedding the Vimeo player, the connection to Vimeo required for this purpose will only be established after the relevant consent has been obtained.
The legal basis for processing personal data on the basis of consent is Article 6(1)(a) GDPR. Section 25 TDDDG additionally applies to the storage of information on the end device or access to information already stored on the end device, insofar as its requirements are met.
Vimeo may also process personal data outside the European Union and/or the European Economic Area. The respective applicable data protection requirements and safeguards shall apply to such transfers.
Further information on the processing of personal data by Vimeo can be found in Vimeo's privacy policy:
Google Ads / Conversion Tracking
Where we use Google Ads, including conversion tracking, information concerning interactions with our advertisements and subsequent activities on our website may be processed.
Where the use of Google Ads and/or conversion tracking requires consent, the relevant functions will only be used after the required consent has been obtained.
The legal basis for processing personal data on the basis of consent is Article 6(1)(a) GDPR. Section 25 TDDDG additionally applies to the storage of information on the end device or access to information already stored on the end device, insofar as its requirements are met.
Where we use functions of Google's Consent Mode, the transmission and processing of information may be adjusted based on the consent decision you have made.
Further information on the processing of personal data by Google can be found in Google's privacy policy: