Privacy policy
1. Controller
The controller responsible for this website (ethosgroup.eu) within the meaning of the General Data Protection Regulation (GDPR) is:
Ethos GmbH
Poelchaukamp 8
22301 Hamburg, Germany
Managing Director: Dirk Schimmel
Email: info@ethosgroup.eu
For the Pathos pages and for enquiries to pathos@ethosgroup.eu, the controller is Pathos GmbH, same address, Managing Director: Dirk Schimmel.
We have not appointed a data protection officer, as we are not legally required to do so. Please send any data protection enquiries to the email addresses above.
2. Hosting and server log files
This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The servers are located in Frankfurt am Main, Germany. We have concluded a data processing agreement with Hostinger pursuant to Art. 28 GDPR.
When you visit our website, the server automatically records information that your browser transmits: IP address, date and time of the request, page accessed, referrer URL, browser and operating system. This data is required to deliver the website securely and stably and is deleted after a short period. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the secure and error-free provision of the website.
3. Encryption
This website uses TLS encryption. You can recognise an encrypted connection by the “https://” in your browser’s address bar.
4. Contact by email
If you contact us by email, we process your email address and the information you provide in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to a contract or pre-contractual measures, and otherwise Art. 6 (1) (f) GDPR. We delete the data once it is no longer required, unless statutory retention obligations apply.
We use Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, for our emails. A data processing agreement is in place. Data may also be processed in the USA; Microsoft is certified under the EU-U.S. Data Privacy Framework.
5. Cookies and consent
We only use technically necessary storage without your consent (Section 25 (2) TDDDG):
- Language selection (cookie “pll_language”, 1 year): stores the language you selected.
- Consent status (local browser storage “ethos_consent_v1”, 12 months): stores your decision in the cookie banner.
Statistics are only used with your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). You can change or withdraw your consent at any time with effect for the future via the Cookie settings.
6. Google Analytics
With your consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how our website is used. Google Analytics uses cookies (“_ga”, “_ga_<ID>”, storage period up to 2 years) and records, among other things, pages visited, time spent on the site, device and browser information and the approximate location. IP addresses are not stored in Google Analytics 4.
Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework. We have concluded a data processing agreement with Google. The data is stored for a maximum of 14 months. The legal basis is your consent (Art. 6 (1) (a) GDPR); Google Analytics is not loaded without it.
7. Security
To protect the website against attacks, we use the security plugin Wordfence from Defiant, Inc., Seattle, USA. The plugin checks access requests, processes IP addresses for this purpose and blocks suspicious requests. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the security of the website. Where data is transferred to Defiant, Inc. in the USA, this is based on the EU standard contractual clauses.
8. Fonts
The fonts used on this website are hosted locally on our server. No connection is established to external font providers (e.g. Google Fonts).
9. Social media
Our website contains links to our profiles on Instagram and LinkedIn. These are simple links; no data is transferred to the networks until you click on them. After clicking, the privacy policies of the respective providers apply.
We maintain company profiles on Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) and LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). When you visit these profiles, the providers process your data. For the statistics on our profiles (“Insights”), we are jointly responsible with the respective provider (Art. 26 GDPR); the providers have assumed the primary responsibility for this. Information: Instagram, LinkedIn. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in presenting our company and communicating with users.
10. Applications
If you send us an application by email, we process your details to carry out the application process (Art. 6 (1) (b) GDPR). If we are unable to offer you a position, we delete your documents no later than six months after the end of the process, unless you have consented to longer storage.
11. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6 (1) (f) GDPR (Art. 21). You can withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR).
You also have the right to lodge a complaint with a supervisory authority, for example the authority responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.
12. Storage period
Unless a specific storage period is stated, we store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations.