Privacy

Avenga International GmbH

1. Overview of Data Processing, Legal Basis, and Terminology

1.1. This privacy statement explains how we process personal data through our online services, including related websites, features, and content (collectively referred to as the “website” or “online services”). This policy applies across all domains, systems, platforms, and devices (e.g., desktop and mobile). For the section of our website intended for job applicants at Avenga, accessible at avenga.com/career (the “Applicant Area”), additional regulations are specified in Article 12 of this policy.
1.2. Terms such as ‘personal data’ and ‘processing’ are defined according to Article 4 of the General Data Protection Regulation (GDPR).
1.3. The personal data processed through this online service includes usage data (websites visited, access times), communication data (device IDs, IP addresses, location data, browser type, operating system, referring websites), content data (contact form entries), and applicant data (name, contact details, subject areas, application documents).
1.4. The term “user” refers to all individuals affected by data processing, including business partners, customers, prospects, applicants, and other visitors to our online services. Terms like “users” are intended to be gender-neutral.
1.5. We process personal data in compliance with applicable data protection laws. Data processing occurs only when legally permitted, such as for contractual services (e.g., order processing), legal obligations, user consent, or legitimate interests (e.g., analyzing, optimizing, and securing our online services as per Article 6 (1) (f) GDPR, including metrics, advertising, and third-party services).
1.6. The legal bases for data processing are as follows: Article 6 (1) (a) and Article 7 GDPR for consent; Article 6 (1) (b) GDPR for contractual obligations; Article 6 (1) (c) GDPR for legal obligations; and Article 6 (1) (f) GDPR for legitimate interests.

2. Security Measures

2.1. We implement organizational, contractual, and technical measures to ensure compliance with data protection laws and protect data from accidental or intentional manipulation, loss, destruction, or unauthorized access.
2.2. Our security measures include encrypting data transmitted between your browser and our server.

3. Data Sharing with Third Parties

3.1. Data is only shared with third parties as legally required. User data is disclosed to third parties if necessary for contractual purposes under Article 6 (1) (b) GDPR or based on legitimate interests for efficient business operations under Article 6 (1) (f) GDPR.
3.2. When using subcontractors, we ensure appropriate legal, technical, and organizational measures are in place to protect personal data in compliance with applicable laws.
3.3. If third-party services or content providers from outside the EU or EEA are involved, data may be transferred to their countries. Such transfers are governed by adequate data protection levels, user consent, or other legal provisions.
3.4. Avenga operates as a group, with potential data processing outside the EU, including in Ukraine or the USA, for marketing and other activities. Contracts ensure compliance with EU data protection standards.

4. Access Data and Log Files

4.1. We collect server log files containing data on each access to our website (e.g., page names, retrieval times, data volumes, success messages, browser types, operating systems, referrer URLs, anonymized IP addresses) based on our legitimate interests under Article 6 (1) (f) GDPR.
4.2. Log file data is stored for security reasons (e.g., to investigate misuse) for a maximum of 30 days and then deleted. Data required for legal evidence is retained until the issue is resolved.
4.3. Our website is hosted by Avenga Germany GmbH, Bahnhofsvorplatz 1, 50667 Cologne. User IP addresses (anonymized) are processed and stored in log files by Avenga Germany GmbH, with data deleted after 2 months. They process data on our behalf per Article 28 (3) (1) GDPR.

5. Cookies and Tracking

5.1. Cookies are small files or other data storage mechanisms sent from our web server or third-party servers to users’ web browsers for later retrieval.
5.2. We use cookies for pseudonymous tracking and inform users about this in our privacy policy.
5.3. Users can disable cookies through their browser settings and delete stored cookies. However, disabling cookies may affect the functionality of our online services.
5.4. Users can opt-out of cookies used for tracking and advertising through the Network Advertising Initiative (http://optout.networkadvertising.org/), the US website (http://www.aboutads.info/choices), or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/).

6. Google Analytics

6.1. To analyze, optimize, and efficiently operate our online services, we use Google Analytics, a web analytics tool provided by Google Inc. (“Google”). Google Analytics employs cookies to collect data about user interactions with our website. Typically, this data is transmitted to and stored on Google servers in the USA.
6.2. Google adheres to European privacy regulations, as outlined here: Google's EU Model Contract Clauses.
6.3. Google processes this information on our behalf to evaluate user engagement with our online services, generate activity reports, and provide additional services related to internet usage. Pseudonymous user profiles may be created from this data.
6.4. We use Google Analytics with IP anonymization enabled. This means Google truncates IP addresses within EU member states or other countries participating in the European Economic Area (EEA). Only in exceptional cases is the full IP address sent to and shortened by Google in the US.
6.5. The IP address transmitted by your browser is not combined with other Google data. Users can prevent cookies from being stored by adjusting their browser settings or by using the opt-out browser plugin available at: Google Analytics Opt-Out.
6.6. For more information about how Google handles data, including options to manage settings and opt-out, visit these pages: Google Privacy & Terms, Advertising Data Use, Ad Settings.

7. Contact

7.1. When you contact us via form or email, the information provided is processed to address your request according to Article 6 (1) (b) GDPR.
7.2. We use HubSpot for managing contact requests. HubSpot Inc., based in the USA, complies with EU data protection laws: HubSpot Data Protection. HubSpot uses cookies and similar technologies to analyze site usage and may link your visits to personal information if you are registered on our site. More about HubSpot's privacy practices can be found here: HubSpot Privacy Policy.
7.3. Contact requests are also processed using Salesforce CRM software provided by Salesforce.com Germany GmbH, Erika-Mann-Str. 3, 80636 Munich, Germany. The provider’s data policy is available here: Salesforce Privacy Policy.
7.4. Supermetrics is used for processing contact data. Based in Finland, Supermetrics displays data from HubSpot in dashboards and reports. For details, see Supermetrics’ Privacy Policy: Supermetrics Privacy Policy.
7.5. Live Support
7.5.1. Our website's chat function allows users to directly contact Avenga employees without needing to provide personal data.
7.5.2. We use Userlike for live chat services. Userlike UG (limited liability) uses cookies to facilitate real-time chat but does not use collected data to personally identify users or merge it with other personal data.
7.5.3. Chat logs are stored for 90 days to evaluate and improve service quality.

8. Embedding Third-Party Services and Content

8.1. To enhance and analyze our website, we integrate content and services from third-party providers. This requires users’ IP addresses to deliver content. We aim to use services where IP addresses are only used for this purpose. Third-party services may also use pixel tags for statistical or marketing purposes, potentially storing pseudonymous data in cookies.
8.2. Below are third-party services used on our site, along with links to their privacy policies and opt-out options:
8.3. YouTube functions are embedded on our site, provided by Google Inc., USA. We do not have knowledge of the content or use of the data by Google. YouTube Privacy Policy, YouTube Opt-Out.
8.4. LinkedIn functions are integrated, and LinkedIn receives your IP address when visiting our pages. If logged into LinkedIn, your visit may be linked to your LinkedIn account. LinkedIn Privacy Policy, LinkedIn Opt-Out.
8.5. Pinterest social plug-ins are used on our site. Pinterest receives data such as IP address and page details when you visit pages with these plug-ins. Pinterest Privacy Policy.
8.6. Twitter functions are included on our site. When using Twitter’s retweet function, your visits may be linked to your Twitter account and data sent to Twitter. Twitter Privacy Policy, Twitter Privacy Settings.
8.7. XING functions are used, and connections are made to XING servers when accessing pages with XING features. As far as we know, XING does not store personal data. XING Privacy Policy.
8.8. Unbounce is used for creating contact forms on our site. Unbounce Germany GmbH provides this service. Unbounce Privacy Policy.
8.9. Albacross identifies companies visiting our site and processes related data (e.g., IP address, location) to generate reports. Albacross Privacy Policy, Albacross Data Processing Agreement.
8.10. Facebook functions are integrated, linking your visits to Facebook if you are logged in. Data is sent to Facebook, and we have no knowledge of the content or use by Facebook. Facebook Privacy Policy, Facebook Privacy Settings.
8.11. Hotjar is used to understand user behavior on our site and improve service. Hotjar collects data such as IP address, device type, and browser information, stored in a pseudonymized user profile. Hotjar Privacy Policy.

9. Accessing Exclusive Content

9.1. Avenga allows registered users to request and download exclusive editorial content via email. During registration, we collect and store the user’s name, email address, company, and phone number for advertising purposes and to send the requested content, based on their explicit consent under Section 6 (1) (a) and Section 7 GDPR.
9.2. To handle registrations, we use MailChimp, a marketing automation platform operated by Rocket Science Group, LLC, located at 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. MailChimp’s data protection practices are detailed here: MailChimp Privacy Policy. MailChimp adheres to EU data protection standards: MailChimp Data Processing Addendum.
9.3. Users may withdraw their consent for data processing described in Item 9.1 at any time, as outlined in Section 14 of this Privacy Policy.
9.4. For analytical purposes, Avenga uses HubSpot, a service provided by HubSpot Inc., based in the USA, which complies with EU data protection regulations: HubSpot Data Processing Addendum. HubSpot employs cookies and similar technologies to analyze website usage, providing reports based on collected data such as IP address, location, browser type, visit duration, and pages viewed. Registered users’ visits may be linked to personal information, such as name and email, for personalized communication. More details about HubSpot’s data practices can be found in their privacy policy: HubSpot Privacy Policy.

10. Applicant Regulations

10.1. By submitting an application through our website, you consent to the processing of your personal data for recruitment purposes, including name, address, date of birth, phone number, email address, and any details included in your CV or attachments.
10.2. For applications in Germany, data is managed by Avenga Germany GmbH, Bahngofsvorplatz 1, 50667 Cologne, Germany, and stored in our applicant management system, Talention, provided by TFI GmbH, Delphiplatz 1, 42119 Wuppertal, Germany.
10.3. For applications in Poland, your data controller may be:
a. AVENGA IT Professionals Sp. z o.o., Wrocław, 16 Legnicka Street, 53-673 Wrocław, KRS: 0000210937
b. ITK Inwestycje Sp. z o.o., Warsaw, 26 Przyokopowa, 01-208 Warsaw, KRS: 0000654511
c. Avenga Poland Sp. z o.o., Cracow, 22 Gen. Zielińskiego, 30-320 Cracow, KRS: 0000518453 Contact for personal data matters is [email protected]. After submitting your CV, you will receive detailed information and consent requests.
10.4. For applications in Ukraine or the USA, data is initially sent via email to Avenga and then stored in our Corebase applicant management system, managed by Avenga at Heroiv UPA St, 73, Lviv, Ukraine, 79000.
10.5. If an employment contract is concluded, applicant data may be stored in the personnel file for administrative and organizational purposes, in compliance with relevant legal regulations.
10.6. If no employment contract is concluded, applicant data will be retained for 2 months and then deleted. If you consented to future recruitment processing, data will be stored until consent is withdrawn.

11. Talent Pool Inclusion

11.1. Candidates not currently in an application process or whose profiles do not match current vacancies may be included in Avenga’s talent pool. Consent for inclusion will be specifically requested from the candidate by the respective data controller.
11.2. Data processing for talent pool inclusion is based on explicit consent under Article 6 (1) (a) and Article 7 GDPR.
11.3. Candidates may object to the processing of their data as outlined in Item 10.1 at any time, as specified in Article 13 of this Privacy Policy.

12. Data Deletion

12.1. We delete stored data as soon as it is no longer necessary for its intended purpose and when no legal retention obligations apply. If data cannot be deleted due to legal requirements, it will be restricted and not processed for other purposes, such as for commercial or tax reasons.
12.2. For Avenga Germany, data is stored for 6 years under § 257 Abs. 1 HGB (trading books, inventories, etc.) and for 10 years under § 147 Abs. 1 AO (books, records, management reports, etc.).

13. Right of Withdrawal

13.1. Users have the right to withdraw their consent for future processing of their personal data at any time, particularly regarding direct marketing.

14. Policy Updates

14.1. We may update the Privacy Policy to reflect legal changes or alterations in services and data processing. Changes requiring user consent or affecting contractual relations will only be made with user approval.
14.2. Users are encouraged to periodically review the Privacy Policy for updates. Equality and Non-Discrimination For readability, gender-specific terms are avoided. We are committed to fair treatment regardless of age, disability, gender, gender reassignment, marital status, pregnancy, race, religion, or sexual orientation. Our goal is to foster a discrimination-free and respectful environment for all employees, customers, and suppliers.