Privacy Policy
of HAIBERG GmbH
Privacy Policy
The protection of your personal data is important to us. This privacy policy informs you about which personal data we process when you visit this website, for what purpose and on what legal basis this takes place, and what rights you have.
Controller and Data Protection Officer
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
HAIBERG GmbH
Ernst-Amme-Straße 19
38114 Braunschweig
Telephone: +49 531 28181-0
datenschutz@haiberg.com
Data Protection Officer
You can reach our Data Protection Officer by e-mail at datenschutz@haiberg.com or by post at the above address with the addition "Data Protection".
Your Rights
Subject to the statutory requirements, you have the right to information about the data relating to you that is being processed (Art. 15 GDPR), to rectification of inaccurate data (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR).
Where we base processing on Art. 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation (Art. 21 GDPR).
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal remains unaffected.
To exercise your rights, please contact us using the contact details given above.
Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
The supervisory authority responsible for us is:
Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover
Provision of the Website and Server Log Files
When you access our website, our system automatically collects data and information from the accessing device. In particular, the following are collected:
- Browser type and browser version
- Operating system used
- Name and URL of the file accessed
- The previously visited page (referrer URL)
- The IP address of the accessing device
- Date and time of access
This data is stored in the log files of our system. The log files contain the IP address and may therefore have a connection to you as an individual.
The legal basis for processing is Art. 6(1)(f) GDPR. Our legitimate interest is to enable the delivery of the website, to ensure technical operation, to analyse errors and to detect and defend against attacks on our systems. This data is not analysed for advertising purposes.
The log files are deleted after 7 days.
Cookies and Consent Management
Our website uses cookies and similar technologies. A cookie is a small text file that is stored on your device. Some cookies are technically necessary for the operation of the website; others are only used if you have given your prior consent.
You can view at any time in our privacy settings which cookies and services are used in detail, what purpose they serve and how long they are stored. There you can change your selection and withdraw consent you have given with effect for the future. Withdrawal is as simple as giving consent.
Consent Management Tool
To obtain and manage your consent, we use a consent management tool from consentmanager AB, Haltegelvägen 1b, 72348 Vasteras.
The tool stores your decision on your device so that we do not have to ask you for your consent again each time you visit a page, and logs it for evidential purposes. In particular, the following data is processed:
- Your consent decision
- The time of the decision
- An identifier for your device
- The website or page accessed
Storing and reading this information on your device is necessary so that we can take account of and document your decision.
The legal basis for this is Section 25(2)(2) TDDDG. The legal basis for the subsequent processing of personal data is Art. 6(1)(c) GDPR in conjunction with our obligation to provide evidence pursuant to Art. 7(1) GDPR.
Contact Form
You can send us an enquiry via our contact form. Mandatory information includes your name, your e-mail address and your message. Providing your company and telephone number is voluntary.
In addition, we process the time the form is submitted and a technical verification feature with which we defend against automated entries by programmes.
If your enquiry relates to a contract or its initiation, the legal basis for processing is Art. 6(1)(b) GDPR. In all other cases, processing is based on Art. 6(1)(f) GDPR.
Our legitimate interest is to respond to your enquiry and to enable communication with you.
We store your enquiry until it has been fully processed and then delete it, unless statutory retention obligations prevent deletion.
You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.
Applications
You can apply to us by sending us an e-mail to karriere@haiberg.com or by using the application form on our website.
Via the application form you can upload your application documents directly. The uploaded documents are automatically transferred to our applicant management system. We operate this on the basis of the software ERPNext in the hosted variant Frappe Cloud from Frappe Technologies Pvt. Ltd., D/324, Neelkanth Business Park, Next to Vidyavihar Railway Station, Vidyavihar (West), Mumbai, Maharashtra 400086, India. The data is stored in a data centre in the European Union (Frankfurt am Main). The provider accesses the data from India for maintenance and support purposes and stores backup copies in India. It processes the data on our behalf; we have concluded a data processing agreement with it pursuant to Art. 28 GDPR. For transmission to India, see the section "Transfer to Third Countries".
The provider processes the data exclusively on our behalf. We have concluded a data processing agreement with it pursuant to Art. 28 GDPR.
We process the data that you submit to us as part of your application, in particular:
- Contact and master data
- Application documents
- Certificates and other attachments
- Further information provided by you during the application process
Processing is carried out exclusively for the purpose of conducting the application process. Access to your data is restricted to the persons and departments responsible for the process.
The legal basis for processing your application data is Section 26(1) sentence 1 BDSG. Processing is necessary for the decision on establishing an employment relationship.
Where we process your data beyond this for the purpose of asserting, exercising or defending legal claims, this is based on Art. 6(1)(f) GDPR.
If no employment relationship is established, we delete your application documents after completion of the application process, unless statutory retention obligations exist or storage is necessary for the assertion, exercise or defence of legal claims.
If, at your express request, we also consider your application for further job offers, this is based on your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw this consent at any time with effect for the future.
Customer Area and Ticket System
For customers with a valid contract, we offer a password-protected customer area. Access is via login with username and password.
In the customer area, depending on the products and services purchased, we provide you in particular with product documentation and release notes. In addition, you can submit enquiries, change requests and error and fault reports to us via our ticket system.
In doing so, we process your login and usage data as well as the content that you make available to us via the ticket system in order to provide you with access, to process your enquiries and to provide the contractually agreed services.
If you are our contractual partner yourself, processing is based on Art. 6(1)(b) GDPR.
If you are a contact person for a company with which we have a contractual relationship, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is to provide the agreed access and support and to handle cooperation with your company efficiently.
Data from the ticket system that we require to provide evidence of processing or to fulfil statutory retention obligations or for billing purposes is stored in accordance with statutory requirements.
We delete all other tickets as soon as they are no longer required for processing and no statutory retention obligations prevent deletion.
The ticket system is part of the hosted software Frappe Cloud (ERPNext Helpdesk) from Frappe Technologies Pvt. Ltd., D/324, Neelkanth Business Park, Next to Vidyavihar Railway Station, Vidyavihar (West), Mumbai, Maharashtra 400086, India. The data is stored in a data centre in the European Union (Frankfurt am Main). The provider accesses the data from India and stores backup copies in India. It processes the data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. For transmission to India, see the section "Transfer to Third Countries".
Processing on Behalf of Our Customers
Where we process personal data in the customer area or in the course of handling enquiries that our customers make available to us, we act exclusively in accordance with their instructions.
In this case, the controller for this processing is the respective customer. The details are set out in the data processing agreement concluded between us and the customer pursuant to Art. 28 GDPR.
Registration for Events
Via our website you can register for our events, for example workshops, customer days or information events.
Depending on the event, we collect your name, your contact details, your company and other information that is necessary for the planning and conduct of the respective event. Which information is mandatory is marked accordingly in the respective registration form.
The legal basis for processing your registration data is Art. 6(1)(b) GDPR. Processing is carried out to enable your participation in the respective event.
Where we collect voluntary information beyond this that is not necessary for the conduct of the event, processing is based on your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw consent you have given at any time with effect for the future.
Event Service Provider
For the organisation and conduct of our events, we use sweap, MATE Development GmbH, Rankestraße 9, 10789 Berlin.
This service provider processes the data exclusively on our behalf. We have concluded a data processing agreement with it pursuant to Art. 28 GDPR.
We delete your registration data after the respective event has been held, unless statutory retention obligations prevent deletion.
Transfer to Third Countries
We process your personal data principally within the European Union (EU) and the European Economic Area (EEA).
Exceptions may arise in the case of the services mentioned in this privacy policy, where a transfer of personal data to the United States of America (USA) or other third countries takes place.
For our applicant management and the ticket system, we use the software Frappe Cloud (ERPNext) from Frappe Technologies Pvt. Ltd., based in India. The data is stored in a data centre in the European Union (Frankfurt am Main). However, the provider accesses the data from India and stores backup copies there. There is no adequacy decision by the European Commission for India. We therefore base the transfer on the European Commission's standard contractual clauses pursuant to Art. 46(2)(c) GDPR together with supplementary protective measures. You can reach the provider's representative in the European Union appointed pursuant to Art. 27 GDPR via Prighter (https://prighter.com/q/17949637227).
Where we transfer data to recipients in a third country, this is done exclusively in compliance with the requirements of Chapter V of the GDPR.
The transfer is based either on an adequacy decision by the European Commission pursuant to Art. 45 GDPR or on standard contractual clauses pursuant to Art. 46(2)(c) GDPR in conjunction with additional technical and organisational protective measures.
Which specific legal basis applies to a data transfer is explained in the section for the service concerned.
We will be pleased to provide you with a copy of the existing guarantees for third-country transfers on request.
Storage Period
We process and store personal data only for as long as is necessary for the fulfilment of the purposes stated in this privacy policy or as provided for by statutory retention periods.
As soon as the respective processing purpose ceases to apply and no statutory, contractual or other legal retention obligations exist, the personal data concerned is deleted.
Changes to this Privacy Policy
We reserve the right to amend this privacy policy if the processing of personal data that we carry out changes or if new statutory or regulatory requirements make this necessary.
The current version of the privacy policy published on this website applies in each case.
Date of this privacy policy: 18.09.2026
Privacy Information for AI-Supported Chatbot and Voicebot
This privacy information supplements the general privacy information of the respective controller. It applies to the AI-supported chatbot within the application and to the AI-supported voicebot of the support hotline.
1. Responsibility and Scope
The AI-supported chatbot is deployed within an authenticated application. The controller for the processing of personal data of users is generally the respective customer or employer or client that deploys the application.
HAIBERG GmbH processes personal data in the provision and operation of the chatbot generally as a processor pursuant to Art. 28 GDPR, where this is contractually agreed.
The following information on the voicebot applies to calls to the support hotline of HAIBERG GmbH. Where HAIBERG GmbH itself determines the purposes and means of processing, it is the controller within the meaning of the GDPR.
2. AI-Supported Chatbot Within the Application
Type of Processing
The chatbot assists with questions about content and functions of the application and, depending on the respective authorisations, with the creation, editing and structuring of content.
A transmission of data only takes place when you initiate an enquiry by actively entering and submitting a prompt.
In particular, the following data may be processed:
- Content of your inputs including personal data contained therein
- Information from the logged-in user account, where this is necessary for the provision of the function
- Technical usage and log data for operation, security and error analysis
- Responses, summaries or editing suggestions generated by the AI system
Please only enter such personal data as is necessary for your enquiry. Special categories of personal data pursuant to Art. 9 GDPR should only be processed if a suitable legal basis exists for this and processing has been expressly authorised by the controller.
Purposes and Legal Bases
Processing serves the provision of the chatbot function, the handling of technical or editorial matters, support in the creation and editing of content and ensuring secure and trouble-free operation.
The applicable legal basis in each case is determined by the controller. Where use is necessary for the performance of a contract or pre-contractual measures, Art. 6(1)(b) GDPR may apply. Otherwise, processing may be based on Art. 6(1)(f) GDPR.
Data subjects may object to processing based on Art. 6(1)(f) GDPR under the conditions of Art. 21 GDPR.
Recipients and Commissioned Processing
For the operation of the AI function, HAIBERG GmbH may use the service provider DeepSlate.
Where personal data is processed, this is based on a data processing agreement pursuant to Art. 28 GDPR. The respective controller ensures that the necessary contractual arrangements and information on possible third-country transfers are in place.
Storage Period
Inputs, responses and technical log data are only stored for as long as is necessary for processing the enquiry, providing the function, IT security, error analysis or fulfilling statutory obligations.
The specific storage period is determined by the settings and deletion concepts of the respective controller and the contractual agreements with HAIBERG GmbH.
Chatbot inputs are not used for marketing purposes or for profiling.
3. AI-Supported Voicebot of the Support Hotline
Type of Processing
When you call our support hotline, an AI-supported voicebot may receive your enquiry, ask follow-up questions and process the information to handle your support request.
In particular, voice and audio content, transcripts, summaries, information about the enquiry and communication data such as time, duration and, where applicable, telephone number may be processed.
The content may be forwarded to the responsible departments to create or supplement a support ticket.
Notice and Consent for Call Recordings
Before a recording begins, you will be informed that you are interacting with an AI system, for what purpose the data is being processed and how you can refuse processing or end the call.
Where voice or audio content is recorded and stored, this is done exclusively on the basis of your express consent pursuant to Art. 6(1)(a) GDPR.
Consent may be withdrawn at any time with effect for the future. If consent is not given, an alternative means of contact is available to you.
Purposes and Legal Bases
Processing serves the receipt, structuring and efficient handling of support requests and their forwarding to the responsible departments.
Where processing is necessary for the performance of a contract or pre-contractual measures, it is based on Art. 6(1)(b) GDPR. Otherwise, processing may be based on Art. 6(1)(f) GDPR.
For the recording and storage of voice or audio content, the consent previously given pursuant to Art. 6(1)(a) GDPR also applies.
Recipients and Commissioned Processing
For the operation of the voicebot, Bonkers Media GmbH, Gutenbergstraße 6, 22880 Wedel, is used.
The service provider processes personal data on behalf of HAIBERG GmbH. There is a data processing agreement for this pursuant to Art. 28 GDPR.
Storage Period
Audio recordings, transcripts, summaries and ticket data are deleted as soon as they are no longer required for processing the enquiry and no statutory retention obligations prevent deletion.
The specific storage period is determined by the deletion concept of the support and ticket systems used.
Processing for marketing purposes or for profiling does not take place.
4. Rights of Data Subjects
Subject to the statutory requirements, you have the right to information, rectification, erasure, restriction of processing, data portability and to object to processing based on Art. 6(1)(f) GDPR.
Consent given may be withdrawn at any time with effect for the future.
When using the chatbot within a customer application, please direct enquiries regarding data subject rights initially to the respective controller.
When using the support hotline, you can contact us using the contact details given in the general privacy information of HAIBERG GmbH.
In addition, you have the right to lodge a complaint with a competent data protection supervisory authority.