Privacy
This website (henceforth “website”) is provided by HHLA Sky GmbH (henceforth “us” or “we”). Information on the provider of the website can be found in the legal notice.
A. Handling of personal data on this website
Where not described otherwise in the following sections, the legal basis for handling your personal data arises from the necessity of handling it for the purpose of providing the functionalities requested by you on this website (Section 6 (1) (b) of the General Data Protection Regulation (GDPR)).
B. Use of the website
1. Calling up the website
When you call up our website, your browser automatically transfers certain data to our web server in order to provide you with the information you have called up. In order to make your visit to our website possible, the following data is collected, briefly stored and used:
- IP address
- Date and time of the request, time zone difference from Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Operating system and its access status / HTTP status code
- Data volume transferred
- Website from which the request comes
- Browser, language and version of the browser software.
To safeguard our legitimate interests, we also store this data for a limited time to allow derivation of personal data in the case of unauthorised access or attempted access to local servers (Section 6 (1) (f) GDPR).
2. Use of cookies
a) What cookies are
We use cookies on this website. Cookies are small text files that are stored in your device memory via your browser. Cookies store certain information (e.g. your preferred language or site settings), which can be returned to us by your browser when you visit the website again (depending on the life of the cookies).
b) How you can limit the use of cookies
You can configure or entirely deactivate the use of cookies in your browser settings at any time. However, this may lead to a limitation in the functionality or user-friendliness of our website.
c) Matomo
We use the web analysis tool “Matomo” in order to tailor our website according to our needs. Matomo creates usage profiles based on pseudonyms. For this purpose, permanent cookies are stored on your device and read out by us. In this way, we are able to recognize returning visitors and count them as such. The data processing is based on your consent according to Art. 6 (1)(a) DSGVO or § 15(3) TMG, if you have given your consent via our banner. You can revoke your consent at any time. To do so, please follow this link and make the appropriate settings via our banner.
Matomo uses the cookies _pk_ses.1.5d3f and _pk_id.1.5d3f with a validity period of 30 minutes (_pk_ses.1.5d3f) and 13 months (_pk_id.1.5d3f) for the purpose of evaluating the behavior of users on the website (_pk_ses.1.5d3f) and recognizing returning visitors (_pk_id.1.5d3f).
3. External services and content on our website
We integrate external services or content into our website. If you use such a service or if third party content is displayed to you, communication data between you and the respective provider is automatically exchanged.
It may also be the case that the provider of the respective services or content processes your data for their own purposes as well. We have configured services or content from providers that are known to use data for their own purposes to the best of our knowledge and belief in such a way that there is no communication for purposes other than for display of the content or services on our website or that communication only takes place if you actively decide to use the service. Since we have no influence on the data collected by third parties and how they process it, we are unable to give definitive information about the purpose and scope of the processing of your data.
Further information about the purpose and scope of the collection and processing of your data can therefore be found in the data protection notice of the respective data protection-compliant provider of the services or content integrated by us. These are:
- Vimeo for videos (https://vimeo.com)
- Mapbox for map applications (https://www.mapbox.com)
- EQS for stock tools (https://www.eqs.com)
4. Transfer of data for processing on our behalf
We use specialised service providers to process some of your data. We carefully select and regularly monitor our service providers. They process personal data via order processing exclusively on our behalf and strictly in accordance with our instructions on the basis of corresponding agreements.
Data is not processed outside the EU / the European Economic Area.
5. Information about your rights
You have the following rights based on the applicable data protection laws:
- Right to information about the data we have stored about you
- Right to rectification, deletion or limitation of the processing of your personal data
- Right to object to processing that serves our legitimate interests, a public interest or profiling, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the enforcement, exercise or defence of legal claims
- Right to data transferability
- Right to complain to a supervisory authority
You can revoke the consent you gave for the collection, processing and use of your personal data at any time with future effect. More detailed information relating to this can be found in the respective sections above, which describe data processing based on your consent.
Should you wish to exercise your rights, please direct your concerns to the contact person named below.
C. Contact
For matters relating to data protection, please contact the Group data protection officer of our parent HHLA: datenschutz@hhla.de
D. Amending the data protection declaration
We reserve the right to update this data protection declaration from time to time. Updates to this data protection declaration will be published on our website. Changes apply from the date of their publication on our website. We therefore recommend that you regularly visit our website and take note of any possible updates.
As of: 1 January 2020
Privacy information regarding contacts via Email & LinkedIn
General Information
We take the protection of personal data very seriously and process personal data confidentially and in accordance with applicable data protection regulations.
This privacy notice applies to the processing of personal data in connection with outreach to prospective clients and B2B contacts via email and LinkedIn, as well as the documentation of correspondence, for the purpose of finding experts for knowledge exchange and attracting potential partners.
Data Controller
HHLA Sky, Bei St. Annen 1, 20457 Hamburg
You can contact our Data Protection Officer at the address listed above or at datenschutz@hhla.de.
Categories of Personal Data, Purposes, and Legal Bases for Processing
Depending on the contact status, we process the following personal data in particular:
Name, job title, business email address, business phone number, LinkedIn URL, company, corporate group, and, if applicable, the content of email and/or LinkedIn correspondence.
We process personal data for the following purposes:
To find and record business contacts; to automatically reach out to prospective clients and coordinate meetings; to record correspondence (email/LinkedIn) in order to track the history of our interactions and, if necessary, follow up with them again.
The legal basis for the processing is Article 6(1)(f) of the GDPR (legitimate interest). Our legitimate interest consists of efficiently reaching out to B2B contacts in order to attract industry experts for knowledge exchange, as well as potential test or pilot customers, and to establish new business relationships.
No automated decision-making, including profiling, takes place.
Source of the Data / Direct Collection
Indirect collection: When we contact you for the first time, your contact details typically originate from publicly accessible sources (e.g., publicly viewable LinkedIn profile information) as well as from a B2B contact database provided and verified by the online platform Lemlist (lempire SAS, 128 rue La Boétie, 75008 Paris, France). The online platform Lemlist may supplement this data through integrations with third-party databases (e.g., verified business email addresses or telephone numbers).
Direct collection: If you provide us with data directly (e.g., by replying to a message, scheduling an appointment, or sending additional contact details), we process this information for the purpose of communication and initiating contact within the described acquisition process.
Recipients of data
Within HHLA Sky, access is granted only to those departments that require it for acquisition or communication purposes, or to fulfill our contractual and legal obligations. Service providers and agents engaged by us (e.g., technical service providers, shipping companies, waste disposal companies) may also receive data for these purposes. We limit the disclosure of personal data to what is necessary, in compliance with data protection regulations. In some cases, we engage service providers (data processors); these are strictly bound by our instructions when handling personal data. In other cases, recipients act independently and bear their own responsibility under data protection law; they are likewise obliged to comply with the requirements of the GDPR and other applicable data protection provisions.
To carry out the processing, we specifically use lempire SAS, 128 rue La Boétie, 75008 Paris, France (Lemlist), for capturing and contacting prospective customers (hosting: France), and LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, for outreach and communication via the platform (hosting: USA).
Information regarding the processing of your personal data by the online platform Lemlist can be found in Lemlist’s relevant statement:
Lemlist Data Processing Addendum
You can find further information regarding LinkedIn’s data processing and usage, how to contact LinkedIn, and available settings for personalized advertising in the LinkedIn Privacy Policy at:
https://www.linkedin.com/legal/privacy-policy
Where necessary, appropriate data processing agreements, joint controllership agreements pursuant to Art. 26 GDPR, and EU Standard Contractual Clauses (SCCs) have been concluded with the service providers engaged.
Data Security
We protect personal data using appropriate technical and organizational measures to ensure an adequate level of protection and to safeguard the personal rights of the data subjects. The measures implemented serve, among other things, to prevent unauthorized access to the technical systems we use and to protect personal data against unauthorized disclosure to third parties.
Data Transfer to Third Countries
Data may be transferred to third countries, particularly through the use of LinkedIn. Where necessary, such transfers are carried out in accordance with the requirements of the GDPR (e.g., appropriate safeguards). With regard to the USA, data transfer is based on the EU-US Data Privacy Framework. In this context, the European Commission has certified, via an adequacy decision, that the level of data protection is comparable to the EEA standard. Otherwise, we do not transfer your personal data to countries outside the EU or EEA or to international organizations, unless expressly stated otherwise in this privacy notice.
Duration of Data Storage
We process and store your personal data initially for the duration required for the specific purpose of use. Data regarding prospective customers is stored for up to three years without any contact being made and is subsequently automatically deleted.
Your Rights as a Data Subject
Subject to statutory requirements, you have the following rights as a data subject:
Right of access: You are entitled at any time, pursuant to Art. 15 GDPR, to request confirmation from us as to whether we are processing personal data concerning you; if this is the case, you are further entitled, pursuant to Art. 15 GDPR, to obtain information about this personal data as well as certain other details (including purposes of processing, categories of personal data, categories of recipients, planned storage duration, the source of the data, the use of automated decision-making, and—in the case of transfers to third countries—appropriate safeguards) and to receive a copy of your data. The restrictions set out in Section 34 of the BDSG apply.
Right to rectification: You have the right, pursuant to Art. 16 GDPR, to request that we rectify the personal data stored about you if it is incorrect or inaccurate.
Right to erasure: You have the right, subject to the conditions of Art. 17 GDPR, to request that we erase personal data concerning you without undue delay. This right to erasure does not apply, inter alia, if the processing of personal data is necessary, for example, to comply with a legal obligation (such as statutory retention requirements) or to establish, exercise, or defend legal claims. Furthermore, the restrictions set out in Section 35 of the BDSG apply.
Right to restriction of processing: You have the right, subject to the conditions of Art. 18 GDPR, to request that we restrict the processing of your personal data.
Right to data portability: You have the right, subject to the conditions of Art. 20 GDPR, to request that we provide you with the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format.
Right to withdraw consent: You may withdraw any consent given for the processing of personal data at any time. Please note that the withdrawal applies only to the future; processing carried out prior to the withdrawal remains unaffected. An informal notification to us, for example via e-mail, is sufficient to declare the withdrawal.
Right to object: You have the right, subject to the conditions of Art. 21 GDPR, to object to the processing of your personal data, requiring us to cease processing your personal data. The right to object applies only within the limits provided for in Art. 21 GDPR. In addition, our interests may conflict with the cessation of processing, meaning we are entitled to process your personal data despite your objection. We will immediately honor any objection to direct marketing measures without conducting a further balancing of interests. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.
You have the right to lodge a complaint with a supervisory authority if you believe that the processing of data concerning you violates data protection regulations. This right to lodge a complaint may be exercised, in particular, with a supervisory authority in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. In Hamburg, the competent supervisory authority is: The Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit der Freien und Hansestadt Hamburg), Ludwig-Erhard-Str. 22, 20459 Hamburg, e-mail: mail-box@datenschutz.hamburg.de.