Privacy Policy

Privacy policy

Below, we would like to explain to you what data we collect about you personally and what we do with these data. We will also provide you with information about your data protection rights and explain who you can contact with questions about the protection of your data.

The current data protection agreement according to EU-DSGVO in English can be found here.

Who we are

The body responsible for processing your data:

NRW.INVEST GmbH 
Economic Development Agency
of the German State of North Rhine-Westphalia (NRW)
Völklinger Strasse 4
40219 Düsseldorf, Germany

Tel: +49 211 13000-0

nrw@nrwinvest.com 

 

CEO:

Petra Wassner

 

Because we want to protect and safeguard your data protection rights, you can contact our Data Protection Officer with any questions about this privacy policy, the processing of your data, your rights or other issues in the area of data protection.

Contact details for the Data Protection Officer:

NRW.INVEST GmbH
Economic Development Agency
of the German State of North Rhine-Westphalia (NRW)
The Data Protection Officer
Völklinger Strasse 4
40219 Düsseldorf, Germany

datenschutz@nrwinvest.com

 

Scope of application

This privacy policy applies to the nrwinvest.com website. It is intended for visitors to our website.

Our web pages contain additional links that lead to the websites of other operators. This privacy policy does not apply to them.

The respective operator is responsible for insertions of advertising banners, textual advertising or publicity films before or during embedded videos.

 

 

Do I have to provide my data?

When you visit our website, user data are automatically saved. Some of the data collected is necessary for the use of a website. In addition, we also process your data to safeguard our legitimate interests after consideration of all the relevant interests. This enables us to continuously improve the services we offer you. On the following pages, you will find out the background to our interests and whether or how you can object to the use of your data or disable the use yourself.

In order to take advantage of one of our offers or to send an enquiry, you are requested to submit your personal data. You can decide yourself whether to make use of these offers and submit your data for this purpose. We of course only process your data for the purpose for which you have provided your data to us. We also offer you services for which we only process your data if you have given your consent to this. Consent is always given voluntarily. Consent that has been given on one occasion can be withdrawn at any time.

Please note that, if you provide details about other people, you must have obtained their prior authorisation and have informed them about the purposes for passing the information on – as they are presented in this privacy policy.

We would be grateful if you could also pass on this information to the people you are including for the use of our services, such as family members or authorised representatives.

 

What data are processed?

I. Your visit to our website

Various data about you personally are saved and used during your visit to our website.

1. Data processed and purposes of processing:

• Service provision: the specified data must be collected to enable our website to be visited and used.
• Data security: each time our Internet offering is accessed, this is stored in a log file. We only collect and use these data for the purposes of data security.
• Optimisation of the Internet offering, including profiling: we are constantly improving our web pages to offer you an optimum experience. To do so, our service providers collect, store and process the data provided about your visit as part of the processing they undertake on our behalf. Neither ourselves nor the service provider we have commissioned link your visit data to your name or other personal data which you have given to us.

Data	Service provision	Data security	Optimisation of the Internet offering, including profiling
IP number	x	x	x
Name of the file accessed		x
Quantity of data transferred		x
Website accessed	x		x
Referrer URL (the previously visited website)		x	x
Search terms which have brought the Internet user to our website			x
User agent that your browser sends (only for mobile version or automatic voice command)	x	x	x
Session cookie		x	x
Date and time of visit		x
Date and time of the last user activity (for session timeout)			x
Operating system			x
Browser type Browser version Browser resolution (inner window size) Browser language Screen format Screen resolution, including colour depth	x		x
URL of the page viewed/downloads			x
Cookies on/off	x		x
JavaScript on/off	x		x
Installed plugins			x
Mouse movement within the browser window			x
Cookie for differentiating first visits and subsequent visits			x

 

In addition, the above-mentioned data are used for the following purposes considering all the relevant interests (Art. 6 (1) (f) GDPR). The interests are stated below:

1. Should our company experience a security incident involving your data, we are obliged to report the case to our relevant data protection supervisory authority (Art. 33 GDPR). Because it is in our legitimate interest to comply with this statutory reporting requirement as quickly as possible, it may be the case that data concerning you personally are processed in the context of clarifying the corresponding security incident. The notifications of these security incidents to the data protection supervisory authorities do not contain any of your personal data.
2. Because it is in our interest to guarantee the security of our systems, we regularly carry out security and efficacy tests, in the context of which your above-mentioned data may be processed.
3. In case there are any legal disputes, it is in our interest to keep evidence until all relevant legal statutes of limitation have expired, in accordance with sections 195 et seq. BGB (German Civil Code). For this purpose, we retain the relevant personal data according to these statutes of limitation.
4. Furthermore, it is in our interest to pursue suspicious cases and to hand over relevant information to the law enforcement agencies when there is a specific suspicion of an offence.

 

2. Information about automated individual decisions

No automated individual decisions are made.

 

3. Legal basis/bases for using your data

1. We process the personal data specified under Service provision to fulfil the quasi-contractual relationship with you so that you can access and use our service, in other words our website (Art. 6 (1) (b) GDPR).
2. Furthermore, we process your data to safeguard our legitimate interests (Art. 6 (1) (f) GDPR):
   1. It is in our interest to be able to ensure data security. To this end, the data concerning every visit are saved in a log file and analysed.
   2. It is in our legitimate interest to optimise our Internet offering. To this end, service providers are used to carry out processing on our behalf, cookies are enabled, and the data provided about your visit to our website are processed.

 

You have the right, on the basis of reasons related to your particular situation, to object to the processing of your data for safeguarding our legitimate interests. For more on this please read 7. Cookies and web tracking.

 

4. Deletion deadlines (or storage time)

• Closing the browser results in automatic deletion of the session cookies.
• Technically, we need your IP number in order to supply the tracking pixel. It is not used for statistical purposes and is then immediately anonymised by our service provider, etracker GmbH. (see 6. Data recipients).
• The data used for the optimisation of our Internet offering, including profiling, are deleted on a regular basis.
• We use cookies to enable us to distinguish a return visit from your first visit to our website. You can delete the cookie manually, otherwise it will be automatically deleted after 28 days following your last visit to our website and then enabled again using a new ID on your next visit.

 

5. Source of the data

There is no third party data collection.

 

6. Cookies and web tracking

Cookies are used. You can delete these cookies at any time by changing your browser settings or preventing their acceptance.

If you do not want us to record your visits, then please click on the following link:

• Objection to optimisation of the www.nrwinvest.com Internet offering: http://www.etracker.de/privacy?et=V23Jbb

An opt-out cookie is enabled by clicking on the objection link. Please do not delete this cookie because it shows us your objection. If you use different browsers or PCs to visit our website, please click on the link in each browser.

 

II. Use of the knowledge base

1. Data processed and purposes of processing

The NRW knowledge base is a unique state-wide information and presentation database for the business location of North Rhine-Westphalia which you can access via our website and which you can log into. Via this database, North Rhine-Westphalia's partners, such as the state government, state initiatives and municipal and regional economic development agencies, have access to current economic and location data. We ask you to enter the data listed below to create an account:

• Preferred user name (required later for login)
• Password (required later for login)
• Form of address
• First name
• Surname
• Company
• Street or PO box
• Town/city
• Postcode
• Telephone
• E-mail address

 

In addition, the above-mentioned data are used for the following purposes considering all the relevant interests (Art. 6 (1) (f) GDPR). The interests are stated below:

1. Should our company experience a security incident involving your data, we are obliged to report the case to our relevant data protection supervisory authority (Art. 33 GDPR). Because it is in our legitimate interest to comply with this statutory reporting requirement as quickly as possible, it may be the case that data concerning you personally are processed in the context of clarifying the corresponding security incident. The notifications of these security incidents to the data protection supervisory authorities do not contain any of your personal data.
2. Because it is in our interest to guarantee the security of our systems, we regularly carry out security and efficacy tests, in the context of which your above-mentioned data may be processed.
3. In case there are any legal disputes, it is in our interest to keep evidence until all relevant legal statutes of limitation have expired, in accordance with sections 195 et seq.  BGB (German Civil Code). For this purpose, we retain the relevant personal data according to these statutes of limitation.
4. Furthermore, it is in our interest to pursue suspicious cases and to hand over relevant information to the law enforcement agencies when there is a specific suspicion of an offence.

 

2. Information about automated individual decisions

No automated individual decisions are made.

 

3. Legal bases for using your data

1. We process the above-mentioned data for the activation and use of the NRW knowledge base in the context of a quasi-contractual relationship of trust (Art. 6 (1) (b) GDPR). If you would like to make use of this service, we need the specified data to provide this service.

 

4. Deletion deadlines (or storage time)

• To conserve evidence, we retain data within the scope of the legal statutes of limitations provisions in accordance with sections 195 et seq. BGB (German Civil Code).
• Your personal data will be deleted within 14 days after the account is closed.

 

5. Source of the data

There is no third party data collection.

 

 

III. Making contact and other services

1. Data processed and purposes of processing

Below, we would like to explain the purposes for which your data are processed if you have a request or use our services.

• Dealing with enquiries, including contact forms: we process the data you give us when you have a question or request. This also includes the data which you have entered on the contact form or sent by e-mail or fax.
• Newsletter: you can subscribe to our newsletter and we need an e-mail address for this.
• Map service: in order to help you find NRW.INVEST more easily and to enable you to plan your journey, we provide you with a map from the Google Maps service. Use of the map means data are collected and processed by Google Inc. You can obtain further information in the Google Maps terms of use. We have no influence on data collection and processing by Google Inc.
• Use of social plugins: our website uses social plugins for the Twitter, Xing and LinkedIn social networks to enable you to use the interactive facilities of the social networks you use on our Internet pages as well. Using a social plugin means the relevant operator is informed that you have accessed the corresponding page on our website. NRW.INVEST does not itself record any personal data via the social plugins or through their use, provided that you do not enable the plugin. In order to prevent data from being communicated to service providers in the USA without the user's knowledge, NRW.INVEST uses something known as the Shariff solution. The solution ensures that no personal data are initially passed on to the providers of the individual social plugins when you visit our website. Data are not passed on until you click on one of the social plugins. For example, if you are logged in to the operator, they can assign the visit to your account. If you interact with the plugins, for example press the "like" button or make a comment, the corresponding information is communicated to the operator directly from your browser and stored there. You can obtain further information in the Twitter, Xing and LinkedIn terms of use.
• Showing videos: we incorporate YouTube videos into our online offering. These are stored on the YouTube servers and can be played directly from our website.

Data	Dealing with enquiries, including contact forms	Newsletter	Use of social plugins (after activation)	Showing videos
Form of address	x	x
First name, surname	x	x
E-mail address	x	x
Subject	x
Title (optional information)	x
Message	x
Country (optional information)	x
Town/city
Address
Postcode
IP address			x	x
Time of access			x	x
Operating system used			x	x
Screen format, resolution			x	x
Browser type, version, plugins installed			x	x
Referrer URL (the previously visited website)			x	x
JavaScript on/off			x	x
URL of the page viewed / downloads			x	x

 

In addition, the above-mentioned data are used for the following purposes considering all the relevant interests (Art. 6 (1) (f) GDPR). The interests are stated below:

1. Should our company experience a security incident involving your data, we are obliged to report the case to our relevant data protection supervisory authority (Art. 33 GDPR). Because it is in our legitimate interest to comply with this statutory reporting requirement as quickly as possible, it may be the case that data concerning you personally are processed in the context of clarifying the corresponding security incident. The notifications of these security incidents to the data protection supervisory authorities do not contain any of your personal data.
2. Because it is in our interest to guarantee the security of our systems, we regularly carry out security and efficacy tests, in the context of which your above-mentioned data may be processed.
3. In case there are any legal disputes, it is in our interest to keep evidence until all relevant legal statutes of limitation have expired, in accordance with sections 195 et seq. BGB (German Civil Code). For this purpose, we retain the relevant personal data according to these statutes of limitation.
4. Furthermore, it is in our interest to pursue suspicious cases and to hand over relevant information to the law enforcement agencies when there is a specific suspicion of an offence.

 

2. Information about automated individual decisions

No automated individual decisions are made.

 

3. Legal bases for using your data

1. Furthermore, we process your data to safeguard our legitimate interests (Art. 6 (1) (f) GDPR):
2. We process your data as stated under "Dealing with enquiries, including contact forms", "Newsletter", "Map service" and "YouTube videos" in the context of a quasi-contractual relationship of trust (Art. 6 (1) (b) GDPR). If you would like to make use of these services, we need the specified data to provide these services.

• We provide you with social plugins for the Twitter, Xing and LinkedIn social networks in order to make it easier for you to exchange ideas about our content on social media and so as to design our website in an attractive way.

1. We use your e-mail address to send our newsletter with information about our offers and services on the basis of the consent received from you (Art. 6 (1) (a) GDPR).

 

4. Deletion deadlines (or storage time)

• Your personal data are deleted within 14 days after receipt of your enquiry.
• Your e-mail address is deleted as soon as you unsubscribe from our newsletter or withdraw your consent.
• To conserve evidence, we retain data within the scope of the legal statutes of limitations provisions in accordance with sections 195 et seq. BGB (German Civil Code).

 

5. Source of the data

There is no third party data collection.

 

 

Which organisations receive your data?

The following table shows which organisations ("data recipients") receive your data in which cases. In order to see which specific data this involves, you can read through the relevant sections of this policy. Your data are sometimes passed on due to statutory reporting requirements. In other cases, we use selected agents and service providers who operate on our behalf as processors (in accordance with Art. 28 GDPR) and may be given access to your data to the extent required in each case. Processors are subject to numerous contractual obligations and must in particular only process your personal data acting on our instructions and exclusively for the fulfilment of orders received from us.

Data recipients	Explanation
Service providers for sending out newsletters	We use service providers who send out newsletters as part of the processing they undertake on our behalf. They are given your e-mail address for the purposes of dispatch.
Service providers for optimising our website	We are constantly improving our web pages to offer you an optimum experience. To do so, our service providers collect, store and process the data provided about your visit on our behalf. Neither ourselves nor the service provider we have commissioned link your visit data to your name or other personal data which you have given to us.
Service providers for the destruction of data carriers	We use service providers who carry out the destruction and disposal of paper files and data carriers as part of the processing they undertake on our behalf.
IT service providers	In the context of operating our IT infrastructure and our website, the relevant service providers may gain access to your data. We obligate our service providers to always limit the processing of your data to the measures necessary for achieving the purpose.
Police. lawyers, law enforcement agencies, public prosecutor's office, state or federal crime authorities	It is in our interest to pursue suspicious cases and to hand over all the required information to the law enforcement agencies when there is a specific suspicion of an offence with respect to a customer.
Social media	If you use social plugins, the operator of the relevant medium receives the information about your previous visit to our website.
Map services	If you use map services, the operator of the relevant medium receives the information about your previous visit to our website.

 

Data recipients in non-EU countries

• This website uses a map service by Google Inc. ("Google") to display our company and its international offices on an interactive map. Use of Google Maps may mean that the data specified under "Map service" in the table above is transferred to a Google server in the USA and stored there. The EU Commission specifies which non-EU countries have an appropriate level of data protection.
• Our website uses social plugins ("plugins") for the Twitter social network. Use of the plugin means that Twitter receives the data specified in the above table under "Use of social plugins (after activation)".
• Our website uses social plugins ("plugins") for the LinkedIn social network. Use of the plugin means that LinkedIn receives the data specified in the above table under "Use of social plugins (after activation)".
• We incorporate YouTube videos into our online offering. These are stored on the YouTube servers and can be played directly from our website. The videos are embedded in "enhanced data protection mode", which means that no data about you as a user are communicated to YouTube if you do not play the video. YouTube does not receive the data specified in the above table under "YouTube videos" until you play the videos. This is the case irrespective of whether YouTube provides a user account via which you are logged in or if no user account exists. If you are logged in with Google, your data are assigned directly to your account. If you do not wish them to be assigned to your profile, you have to log out before you play a video. Please consult YouTube's privacy notice for information on the purpose and scope of data collection, further processing and use of the data by YouTube, along with your rights associated with this and the setting options available for protecting your privacy.

The EU Commission specifies which non-EU countries have an appropriate level of data protection. The EU Commission recognises companies in the USA which participate in the EU-US Privacy Shield as data recipients with an appropriate level of data protection. This agreement between the USA and the EU ensures that data protection regulations comply with the level of data protection required in the European Union when data are processed by US companies subject to the EU-US Privacy Shield. According to their own statements, Google LLC, YouTube LLC, Twitter Inc. and LinkedIn Inc. are contracted into the EU-US Privacy Shield.

Information about the appropriate or reasonable guarantees for the level of data protection with Google LLC, Twitter Inc., LinkedIn Inc. and YouTube LLC as data recipients and how to obtain a copy of these guarantees or where they are available, can for instance be requested from:

NRW.INVEST GmbH
Economic Development Agency of the German State of North Rhine-Westphalia (NRW)
The Data Protection Officer
Völklinger Strasse 4
40219 Düsseldorf, Germany
datenschutz@nrwinvest.com

Your rights

You have the right to:

Access the personal data stored about you (Art. 15 GDPR)

Data portability (Art. 20 GDPR)

Rectification and completion of the data we have about you (Art. 16 GDPR)

Erasure (Art. 17 GDPR)

Restriction of processing (Art. 18 GDPR)

Objection to the processing of your data to safeguard our legitimate interests or the legitimate interests of third parties (Art. 21 GDPR) – You have the right, on the basis of reasons related to your particular situation, to object to processing of this kind at any time; this also applies to profiling based on these provisions within the meaning of Art. 4 (4) GDPR.

Withdrawal of consent that has been given (Art. 7 GDPR) with future effect for:

Newsletters: you can cancel the storage and use of your e-mail address and your name for sending out newsletters at any time with future effect. In order to unsubscribe from our newsletter, you can for example use the unsubscribe link within the newsletter.

To exercise these rights, you can in particular contact us via

NRW.INVEST GmbH

Economic Development Agency

of the German State of North Rhine-Westphalia (NRW)

The Data Protection Officer

Völklinger Strasse 4

40219 Düsseldorf, Germany

datenschutz@nrwinvest.com

 

 If you do not want data about your visit to our website to be recorded for the purpose of optimising our Internet offering, you can check here : "6. Cookies and tracking" in section "I. Your visit to our website"  to see how recording can be disabled.

You also have the right to make a complaint to a data protection supervisory authority.