Notes on privavcy and data protection
Information on how Nagarro ES processes personal data that is not related to the operation of this website is provided in our Data Protection Statement. If you have any questions, please contact the Data Protection Officer at Nagarro ES.
Website Operator
Name and address of the entity responsible for website content
The entity responsible in accordance with the General Data Protection Regulation, other national data protection legislation in the EU member states and other applicable data protection/privacy provisions is:
Nagarro ES GmbH
Westerbachstraße 32
61476 Kronberg im Taunus
Germany
Managing Directors:
Michael Schmidt, Joerg Dietmann
Name and address of the Data Protection Officer
The entity’s Data Protection Officer is: Richard Gertis, Fahnenbergplatz 1, D-79098 Freiburg, Germany – Email: DataProtection.NES@nagarro.com
General information about data processing
Scope of the processing of personal data
We process our users’ personal data only insofar as this is necessary to provide a working website and deliver our content and services. Our users’ personal data is normally processed only subject to the consent of those users. The only exception is in cases where it is not possible to obtain such consent in advance for practical reasons and where data processing is nevertheless permitted by statutory provisions.
Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject to process their personal data, Article 6 (1) a of the EU’s General Data Protection Regulation (GDPR) serves as the legal basis. Where personal data is processed that is necessary for the performance of a contract to which the data subject is party, Article 6 (1) b GDPR serves as the legal basis. This provision also applies to processing activities that are necessary to complete pre-contractual measures. Where personal data must be processed to comply with a legal obligation to which our company is subject, Article 6 (1) c GDPR serves as the legal basis. If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not override said interest, Article 6 (1) f GDPR serves as the legal basis for such processing.
Data erasure and duration of storage
The data subject’s personal data will be erased or blocked as soon as the purpose of storage no longer applies. Storage can continue beyond this time where provision is made for such storage by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. Data will also be erased or blocked when a retention period prescribed by the said norms expires, except in cases where continued data storage is necessary for the conclusion and/or performance of a contract.
Data processing on this website
Website availability and the production of logfiles
Description and scope of data processing
Every time our website is accessed, our system automatically records data and information about the requesting computer system. The following data is collected under these circumstances:
- Date and time of access
- User’s IP address
- Information about the browser type and the version used
- User’s operating system
- User’s Internet service provider (ISP)
- Websites from which the user’s system accessed our website
This data is stored in logfiles on our system. None of this data is stored together with any of the user’s other personal data.
Legal basis for data processing
The legal basis for the temporary storage of data and logfiles is Article 6 (1) f GDPR:
Purpose of data processing
The temporary storage of IP addresses by the system is necessary in order to make the website available to the user’s computer. To this end, the user’s IP address must be stored for the duration of the session. It is stored in logfiles to ensure that the website works properly. In addition, the data enables us to optimize the website and ensure the security of our information technology systems. The data is not analyzed for marketing purposes in this context. The stated purposes substantiate our legitimate interest in data processing pursuant to Article 6 (1) f GDPR.
Duration of storage
The data is deleted as soon as it is no longer needed to fulfill the purpose for which it was collected. Where data is recorded in order to make the website available, said purpose is fulfilled when the given session ends. Where data is stored in logfiles, this is the case after seven days at the latest. It is possible that the data may be stored beyond this point. In such cases, users’ IP addresses are erased or anonymized to ensure that identification of the requesting clients is no longer possible.
Opportunities to object and have data erased
The recording of data in order to make the website available and the storage of data in logfiles are activities that are essential to the operation of this website. It follows that the user has no opportunity to object in this case.
Use of cookies
Do you want to edit your cookie preferences? You can change your preferences via this link.
Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in or by the web browser on the user’s computer system. When a user accesses a website, a cookie may be stored in the user’s operating system. This cookie contains a characteristic character string that enables the browser to be uniquely identified if it accesses the website again. We use cookies to make our website more user-friendly. For some elements of our website, it is essential that the requesting browser can be identified even after a change to another website.
- privacyCookieAccepted:
The first time you visit our website, you will be notified of the fact that we use cookies. If you click the “Accept” button to indicate your consent, this fact will be noted in a cookie. On our website, we also use cookies to analyze surfing habits with the aid of Google Analytics. In this way, the following data can be passed on:
- Entered search strings
- Frequency of page views
- Use of website functions
Technical precautions are applied in order to pseudonymize the user data collected in this way. It is therefore no longer possible to trace data back to the requesting user, nor is this data stored together with other items of the user’s personal data. When you access our website, an info banner informs you about the use of cookies for analytical purposes and draws your attention to this privacy policy. You are also told how you can prevent the cookies from being stored in your browser settings.
Legal basis for data processing
The legal basis for the processing of personal data using cookies that are necessary for technical purposes is Article 6 (1) f GDPR. The legal basis for the processing of personal data using cookies for analytical purposes is Article 6 (1) a GDPR, provided consent to this effect has been granted.
Purpose of data processing
The purpose of cookies that are necessary for technical purposes is to make it easier for users to access websites. Some functions on our website cannot be made available without the use of cookies. For these functions, the browser has to be recognized again even after switching to a different website. We need cookies for the following applications:
- Confirmation of the use of cookies
The user data collected by cookies that are needed for technical purposes is not used to produce user profiles. Analytical cookies are used to improve the quality of our website and its content. By using analytical cookies, we learn how visitors use our website and can therefore constantly optimize our offerings. These purposes also substantiate our legitimate interest in processing personal data pursuant to Article 6 (1) f GDPR.
Duration of storage, opportunities to object and have data erased
Cookies are stored on the user’s computer and transmitted from the computer to our website. That is why we give you, the user, full control over the use of cookies. You can change the settings in your web browser to deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time, and this process can also be automated. However, if cookies are deactivated for our website, you may not be able to properly use all the functions of the website.
Use of HubSpot
We use HubSpot for our digital marketing activities. HubSpot, an American provider of software for marketing automation, is headquartered in the USA and has its European office in Ireland (HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, Attn: Privacy. | HubSpot, Ground Floor, Two Dockland Central Guild Street, Dublin 1, Ireland). We use HubSpot to analyze and provide marketing content, in particular for e‑mail marketing, landing pages and contact management. Visitors to our website can use contact forms to learn more about us, download content and supply us with contact details (plus additional demographic information, where appropriate). This information is stored on HubSpot servers, where we use it to optimize our activities regarding and contact with potential customers. All the information we gather in this way is governed by this privacy provision. The Data Processing Agreement with HubSpot includes the European Union Standard Contractual Clauses (SCC) and contractually ensures compliance with an adequate level of data protection in the processing of personal data by HubSpot.
Go here for more information about HubSpot’s privacy policy.
Go here for more information about HubSpot’s compliance with the EU’s privacy provisions.
Go here and here for more information about the cookies used by HubSpot.
Contact form, registration for webinars/events, request for downloads and e‑mail contact
Description and scope of data processing
Our website has a contact form that can be used to establish electronic contact with the company and/or to sign up for webinars/events. When users make use of this facility, the data they enter in the contact form is forwarded to us and stored. This data is as follows:
- Form ID
- Style of address
- First name
- Last name
- E‑mail address
- Your message
- Your company (optional)
- Your function (optional)
- Your phone number (optional)
- Date of the webinar(s)/event(s)
- Request for information about webinars/events
At the time when your message is sent, the following additional data is also stored:
- User’s IP address
- Date and time of registration
During the process of sending the completed contact form, your consent to the processing of the data is obtained and you are referred to this privacy policy. Alternatively, you can also contact us via the published e‑mail address. In the latter case, the personal data that you transmit in an e‑mail is stored. In this context, no data is forwarded to third parties: The data is used exclusively to process your request to establish contact.
Legal basis for data processing
The legal basis for the processing of personal data using cookies for analytical purposes is Article 6 (1) a GDPR, provided consent to this effect has been granted. The legal basis for the processing of personal data transmitted when an e‑mail is sent is Article 6 (1) f GDPR. If the purpose of the e‑mail contact is to conclude a contract, Article 6 (1) b GDPR also serves as a complementary legal basis.
Purpose of data processing
Personal data entered in the contact form is processed only to allow us to deal with your request for contact. If contact is established by e‑mail, this fact also substantiates our legitimate interest in processing the data. The other personal data processed when the completed contact form is sent serve to prevent abuse of the contact form and safeguard the security of our information technology systems.
Duration of storage
The data is erased as soon as it is no longer needed to fulfill the purpose for which it was collected. For personal data collected from the contact form and personal data transmitted by e‑mail, that is the case when the given conversation with the user comes to an end. This conversation comes to an end when circumstances allow the conclusion to be drawn that the issue in question has been dealt with conclusively. The additional personal data collected when the contact form is sent will be deleted at the latest after seven days.
Opportunities to object and have data erased
Users can revoke their consent to the processing of their personal data at any time. Users who have established contact with us by e‑mail can raise objections to the storage of their personal data at any time. In such a situation, the conversation cannot be continued. Notice of revocation may be made within the framework of established e‑mail contact or in any other appropriate manner. If consent is revoked, all personal data stored when contact was established will be erased.
Integration of Google Maps
On the page “Locations” of this website we use the offer of Google Maps. This allows us to display interactive maps directly on the website and enables you to conveniently use the map function.
By visiting the website, Google receives the information that you have called up the corresponding subpage (“Locations”) of our website. This is regardless of whether Google provides a user account that you are logged in with or whether no user account exists. If you are logged in to Google, your information will be directly associated with your account. If you do not wish to be associated with your profile on Google, you must log out before visiting the “Locations” page. Google stores your data as usage profiles and uses them for purposes of advertising, market research and/or demand-oriented design of its website. Such evaluation takes place in particular (even for non-logged-in users) to provide demand-oriented advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.
For more information about the purpose and scope of data collection and its processing by the plug-in provider, please refer to the provider’s privacy policy. There you will also find further information about your rights in this regard and setting options for the protection of your privacy (https://policies.google.com/privacy?hl=en&gl=de).
Web analysis with Google Analytics
Scope of the processing of personal data
On our website, we use Google Analytics to analyze users’ surfing habits. This software places cookies on the user’s computer (see above for more information about cookies). If different pages of our website are viewed, the following data is stored:
- Three bytes from the IP address of the requesting user system
- The accessed website
- The website from which the user jumped to the accessed website (referrer)
- The individual pages viewed on the accessed website
- The time spent on the website
- The frequency with which the website was accessed
Google Analytics is set to ensure that IP addresses are not stored in full. Instead, one byte of the IP address is masked (e.g. 192.168.1.xxx). This procedure ensures that the truncated IP address cannot be traced back to the requesting computer.
Legal basis for the processing of personal data
The legal basis for the processing of users’ personal data is Article 6 (1) f GDPR.
Purpose of data processing
The processing of personal data enables us to analyze the surfing habits of our users. The insights we gain from analyzing this data help us to compile information about how the individual components of our website are used. That in turn helps us to constantly improve our website and make it more user-friendly. These purposes substantiate our legitimate interest in the processing of data pursuant to Article 6 (1) f GDPR. The anonymization of IP addresses accommodates users’ interest in having their personal data protected.
Duration of storage
The data is erased as soon as it is no longer needed for our recording purposes.
Opportunities to object and have data erased
Cookies are stored on the user’s computer and transmitted from the computer to our website. That is why we give you, the user, full control over the use of cookies. You can change the settings in your web browser to deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time, and this process can also be automated. However, if cookies are deactivated for our website, you may not be able to properly use all the functions of the website. We offer the people who use our website the chance to opt out of analytical uses. To do so, please click the Opt-Out link. This action will set another cookie on your system that instructs our system not to store the user’s data. Please note: If you delete the latter cookie from your system in the meantime, you will have to reset the opt-out cookie next time you visit our website.
Integration of YouTube Videos
We have integrated YouTube videos into our online offer, which are stored on www.youtube.com and can be played directly from our website.
By visiting the website, YouTube receives the information that you have accessed the corresponding subpage of our website. This is independent of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your information will be directly associated with your account. If you do not wish to be associated with your profile on YouTube, you must log out before visiting our website. YouTube stores your data as user profiles and uses them for purposes of advertising, market research and/or demand-oriented design of its website. Such evaluation takes place in particular (even for non-logged-in users) to provide demand-oriented advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right.
For more information on the purpose and scope of data collection and processing by YouTube, please refer to the privacy policy. There you will also find further information about your rights and setting options to protect your privacy: https://policies.google.com/privacy?hl=en&gl=de
Privacy information for webinars delivered with GoToWebinar
We use the GoToWebinar software solution from LogMeIn, Inc. to deliver webinars over the Internet. LogMeIn, Inc. is responsible for providing this service and for the associated data processing. Go here to read LogMeIn’s privacy policy. For the order-specific delivery of webinars, we forward your first name, last name and e‑mail address to LogMeIn, Inc. An encrypted link is then set up between you and the organizer of the webinar. Webinars are recorded (which is announced) so that they can be accessed later. Questions asked by participants and the answers given during a webinar are also recorded and reproduced when the webinar is subsequently accessed. Statistical data is also gathered during and after the webinar. If you take part in a webinar, we receive information about the duration of your participation, your interest in the webinar, any questions you ask and the answers given in addition to your registration data. The purpose of this data is to support our customer care activities and/or help us improve the user experience. You can terminate the session at any time simply by closing the browser window, the program or the app. If your contact person terminates the session, your participation in the session will also be terminated automatically.
Rights of data subjects
Whenever your personal data is processed, you are a data subject as defined by the GDPR. You thus have the following rights in respect of the controller:
Right to information
You can require the controller to confirm whether we process personal data in relation to yourself. If so, you can demand that the controller disclose the following information:
- The purposes for which your personal data is processed
- The categories of personal data that are processed
- The recipient and/or the categories of recipients to whom your personal data has been or will be disclosed.
- The planned period for which your personal data is to be stored or, if it is not possible to provide a concrete answer to this question, details of the criteria governing the duration of data storage
- The existence of a right to have your personal data rectified or erased, a right to restrict the processing of your personal data by the controller and/or a right to object to said processing
- The existence of a right to lodge a complaint with a supervisory authority
- All available information about the origins of the data in cases where personal data is not collected from the data subject
- The existence of automated decision-making, including profiling pursuant to Article 22 (1) and (4) GDPR and – at least in these cases – detailed information on the underlying logic, the resultant implications and the targeted effects of such processing on the data subject.
You have the right to demand information about whether your personal data is transmitted to a third country or an international organization. In this context, you can demand to be informed of the appropriate safeguards pursuant to Article 46 GDPR in conjunction with said transmission.
Right to rectification
You have the right to have your personal data rectified and/or completed by the controller if the personal data processed in relation to yourself is inaccurate or incomplete. The controller must rectify such data without undue delay.
Right to restriction of processing
You can demand that the processing of your personal data be restricted under the following circumstances:
- If you contest the accuracy of the personal data concerning yourself, for a period enabling the controller to verify the accuracy of your personal data
- If the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead
- If the controller no longer needs the personal data for the purposes of the processing but it is required by the data subject for the establishment, exercise or defense of legal claims
- Or if you have objected to processing pursuant to Article 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override your own legitimate grounds.
Where processing of your personal data has been restricted, such personal data shall – with the exception of storage – only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a member state. If the processing of your personal data has been restricted for one or more of the above reasons, you will be informed by the controller before the restriction of processing is lifted.
Right to erasure
Obligation to erase data
You can demand that the controller erase your personal data without undue delay. The controller shall then have the obligation to erase said data without undue delay where one of the following grounds applies:
- The personal data concerning yourself is no longer necessary for the purposes for which it was collected or otherwise processed
- You revoke your consent to processing pursuant to Article 6 (1) a or Article 9 (2) a GDPR and where there is no other legal ground for the processing
- You object to processing pursuant to Article 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to processing pursuant to Article 21 (2)
- Your personal data has been unlawfully processed
- Your personal data must be erased for compliance with a legal obligation under the laws of the European Union or a member state to which the controller is subject
- Your personal data was collected in relation to the offer of information society services referred to in Article 8 (1) GDPR
Information to third parties
If the controller has made your personal data public and is obliged to erase it pursuant to Article 17 (1) GDPR, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers that are processing the personal data that you – a data subject – have requested the erasure by such controllers of any links to, or copies or replications of, said personal data.
Exceptions
The right to erasure shall not apply to the extent that processing is necessary:
- For exercising the right of freedom of expression and information
- For compliance with a legal obligation that requires processing by European Union or member state law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- For reasons of public interest in the area of public health in accordance with Article 9 (2) h and i and Article 9 (3) GDPR
- For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89 (1) GDPR insofar as the right referred to in paragraph a) is likely to render impossible or seriously impair the achievement of the objectives of said processing
- Or for the establishment, exercise or defense of legal claims
Right to notification
If you assert the right to rectification, erasure or the restriction of processing, the controller is obliged to communicate said rectification, erasure or restriction of processing to all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to demand that the controller inform you about these recipients.
Right to data portability
You have the right to receive the personal data you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data was originally provided:
- Where processing is based on consent pursuant to Article 6 (1) a GDPR or Article 9 (2) a GDPR or a contract pursuant to Article 6 (1) b GDPR
- And where processing is carried out by automated means
In exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, where this is technically feasible. The rights and freedoms of others must not be adversely affected as a result.
Right to object
You have the right, on grounds relating to your particular situation, to object at any time to any processing of your personal data that is based on Article 6 (1) e or f GDPR. This right also applies to profiling based on the same provisions. The controller shall no longer process your personal data unless the controller demonstrates compelling legitimate grounds for the processing that override your interests, rights and freedoms or that serve for the establishment, exercise or defense of legal claims. Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, including profiling to the extent that this is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you have the option of exercising your right to object by automated means using technical specifications.
Right to revoke your declaration of consent under data protection law
You have the right to revoke your declaration of consent under data protection law at any time. Any such revocation of consent shall not affect the legality of any processing that took place prior to said revocation.
If you wish to revoke your consent, please mail us to this effect at The entity’s Data Protection Officer is: Richard Gertis, Fahnenbergplatz 1, D-79098 Freiburg, Germany – Email: DataProtection.NES@nagarro.com or call us on +49 6173 3363000.
Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, that exposes you to legal effects or similarly significantly affects you. This provision shall not apply if the decision:
- Is necessary for entering into, or performance of, a contract between you and the controller
- Is authorized by European Union or member state law to which the controller is subject and that also lays down suitable measures to safeguard your rights, freedoms and legitimate interests
- Or is based on your explicit consent.
However, such decisions must not be based on special categories of personal data referred to in Article 9 (1) GDPR, unless Article 9 (2) a or g GDPR applies and suitable measures to safeguard your rights, freedoms and legitimate interests are in place. In the cases referred to in (1) and (3), the controller shall implement suitable measures to safeguard your rights, freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.
Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes the General Data Protection Regulation. The supervisory authority with which your complaint is lodged shall inform you on the progress and the outcome of your complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR.
Topicality and Amendment of this Privacy Statement
This privacy statement is up to date and its status is December 2021.
Due to the development of our website and offers made on our website or due to changed legal or official requirements, it may become necessary to amend this privacy statement. The respective current privacy statement is available to you any time on the website at https://www.nagarro-es.com/en/privacy-statement/