Contact

Data privacy

How GOPA processes personal data on this website and beyond: legal bases, retention periods, your rights, and how to reach our data protection officer.

Privacy Policy pursuant to Art. 12 et seq. EU GDPR

Table of Contents

  1. Name and Contact Information of the Data Controller
  2. Contact Details of the Data Protection Officer
  3. General Information on Data Processing
  4. Data Processing on Our Website
  5. Other Data Processing Activities Outside Our Website
  6. Categories of Recipients
  7. Data Transfers to Third Countries
  8. Your Rights as a Data Subject
  9. Right to Lodge a Complaint with the Supervisory Authority

1. Name and Contact Information of the Data Controller

The controller as defined in the European General Data Protection Regulation (GDPR) and other national data protection provisions is:

GOPA Gesellschaft für Organisation, Planung und Ausbildung mbH
Hindenburgring 18
61348 Bad Homburg
Germany
Tel.: +49 6172 930 0
Email: gdpr-gcg@gopa.eu
(hereinafter referred to as “we”, “us” or “our”).

2. Contact Details of the Data Protection Officer

The protection of your personal data is important to us. We have commissioned a consulting firm specializing in data protection and data security to handle these matters. Our data protection officer is a member of this highly experienced group of experts:

MAGELLAN Säugling Rechtsanwaltsgesellschaft mbH
Raiffeisenallee 9
82041 Oberhaching
www.magellan-legal.de
Email: privacy_gopa_group@magellan-legal.de
Tel.: +49 6172 930 0

For any data protection and data security related questions, please contact our data protection officer directly.

3. General Information on Data Processing

3.1 Scope of Processing

We generally process your personal data only to the extent necessary for the functional provision of our website, our content, and our services.

If we have obtained your consent to the processing of your personal data, the legal basis for such processing is Art. 6 Sect. 1 S. 1 lit. a) EU GDPR.
If we process your personal data with the aim of meeting contractual obligations or if the processing takes place in conjunction with the negotiation of a contractual relationship, the legal basis for the processing of such data is Art. 6 Sect. 1 S. 1 lit. b) EU GDPR.
If the processing of personal data is necessary in order for us to meet any legal obligations, the legal basis for the processing of such data is Art. 6 Sect. 1 S. 1 lit. c) EU GDPR.
If we process your personal data to safeguard our or any third party’s legitimate interests, provided your interests or fundamental rights and freedoms do not outweigh the aforementioned interests, the legal basis for the processing of such data is Art. 6 Sect. 1 S. 1 lit. f) EU GDPR.

3.3 Retention Period

Your personal data will be deleted as soon as the purpose for its retention no longer applies or, if you have a right to revoke your consent, with declaration of your revocation. It is possible that your data will be stored longer if this has been defined in the respective European or domestic legislation, in Union-law provisions, acts or any other provisions we are subject to. In these cases, your personal data shall, however, be blocked.

If we provide links to external websites, this Privacy Policy shall not apply to the processing of your personal data by the data controller of the linked website. Hence, we recommend that you review the data privacy policies on external websites you visit. If such a linkage should require a legal basis for the resulting processing of your personal data, it shall be your consent pursuant to Art. 6 Sect. 1 S. 1 lit. a) EU GDPR, which you shall grant by clicking on the respective link.
As a rule, the clicking on any such links (hyperlinks) will result in the processing of the following personal data:

  • IP address
  • Screen resolution
  • Deployed browser
  • Bandwidth
  • Language settings

4. Data Processing on Our Website

4.1 Provision of the Website and Log Files

When providing our website, we process your personal data to enable the error-free delivery of our website. Some of your personal data has to be stored for the duration of a session for this purpose.

Data processed: IP address, access date, access time, page accessed, previously visited website (if transmitted), browser used, operating system used.
Purpose: The purpose of this data processing is to provide the website, ensure its functionality and secure the IT systems used for this purpose.
Legal basis: Legitimate interest, Art. 6 Sect. 1 S. 1 lit. f) EU GDPR.
Retention period: Your personal data is stored in log files for 7 days. Beyond that, your personal data is stored only for the duration of the session in the context of providing the website.
Objection: The processing of the data listed above is absolutely mandatory for the provision of the website, to guarantee its functionality and to secure the IT systems used. Consequently, you do not have an option to object.

4.2 AI Assistant “Ask GOPA”

Our website offers an AI assistant that answers questions about the content of our website.

Data processed: Your freely entered questions and the conversation history of the current session (insofar as they contain personal data), the address of the page you are currently viewing, and the technical connection data listed under 4.1.
Purpose: Answering your questions about the public content of our website.
Legal basis: Legitimate interest, Art. 6 Sect. 1 S. 1 lit. f) EU GDPR.
Retention period: No storage. The conversation history remains in your browser for the duration of the session only and is deleted when you close the browser tab.

4.3 Reach Measurement (eTracker)

We measure the use of our website with the eTracker service of etracker GmbH, Hamburg. The service runs in its cookieless standard mode: when you access a page, eTracker collects technical access data from your browser on our behalf. The IP address is immediately truncated and anonymised. From the data anonymised in this way, we compile aggregated statistics on the use of our website; no information is stored on your device.

Data processed: Truncated, anonymised IP address, pages accessed, referrer, approximate origin (country/region), device type and browser, duration of visit. The data is not combined with other data and there is no cross-device recognition.
Purpose: Statistical analysis of website use in order to improve the website.
Legal basis: Legitimate interest, Art. 6 Sect. 1 S. 1 lit. f) EU GDPR.
Retention period: Only aggregated statistics are stored; raw data that could be related to an individual is not retained.
Objection: The processing is cookieless and anonymised; raw data that could be related to an individual is not stored. There is therefore no option to object.

4.4 LinkedIn Feed (walls.io)

On the pages of our expert companies we offer a LinkedIn feed provided via the walls.io service. When the page loads, the feed is deactivated and no data is transmitted to walls.io. If you display the feed via the button, your browser loads the posts from walls.io; by doing so, you consent to the data processing described below.

Data processed (only after your click): IP address, browser used, screen resolution.
Purpose: Displaying our company’s current LinkedIn posts on our website.
Legal basis: Consent, Art. 6 Sect. 1 S. 1 lit. a) EU GDPR.
Retention period: We do not store any personal data in connection with the embedded feed; the transmission ends when you leave the page.
Withdrawal: You can withdraw your consent at any time with effect for the future by reloading the page; the feed is only loaded again once you actively display it again.

4.5 Contact Form and Contact by Email

The following personal data is processed in the context of the contact form and contact by email:

Data processed: Name, email address, organisation (if provided), content of the message.
Legal basis: Legitimate interest, Art. 6 Sect. 1 S. 1 lit. f) EU GDPR.
Purpose: Processing your inquiry.
Retention period: Stored until the respective purpose no longer applies.
Objection: You may object to the processing of your personal data in conjunction with the initiation of contacts at any time, with effect for the future. In this case, we will not be able to continue to process your inquiry. All personal data that has been stored over the course of the initiation of contact will be deleted, unless statutory retention periods are in conflict with the deletion of your data.

4.6 Job Application Process

We display open positions at our headquarters on our website; the list of vacancies is retrieved server-side from our service provider Personio. Your browser does not connect to Personio when you visit our website. When you apply, you are redirected to the Personio application portal (external link, see 3.4). The following applies to the application process:

a. Data processing in the context of the application process

(1) Description and scope

On our website we offer you the possibility to apply for one of our vacant positions. You are redirected to the application portal of our service provider for this purpose. This involves the processing of the personal data you provide to us as part of your application.

(2) Legal basis

Consent, Art. 6 Sect. 1 S. 1 lit. a) EU GDPR, Art. 88 Sect. 1 EU GDPR in conjunction with § 26 Sect. 2 German Federal Data Protection Act (BDSG).
Establishment of an employment relationship, Art. 6 Sect. 1 S. 1 lit. b) EU GDPR.
When processing special categories of personal data:
Consent, Art. 6 Sect. 1 S. 1 lit. a) EU GDPR in conjunction with Art. 9 Sect. 2 lit. a) EU GDPR.

(3) Purpose

Your personal data is processed for the purpose of conducting the application process with the aim of establishing an employment relationship, and to fulfil obligations under employment contracts, statutory provisions, collective agreements where applicable, and social security law.

(4) Retention period

Your personal data will be deleted or blocked as soon as the purpose of its storage no longer applies. Storage beyond this may take place where provided for by the European or national legislator in Union-law regulations, acts or other provisions to which we are subject. Data is also blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

After that, we store your data for, among others, the following periods:

  • Application documents: up to 6 months after the decision not to fill the position, to provide evidence in discrimination cases, in accordance with §§ 21 Sect. 5, 22 German General Equal Treatment Act (AGG);
  • Application documents otherwise: upon dissolution or termination of the employment relationship.

(5) Objection and removal

If the processing of your personal data is based on your consent, you can withdraw your consent at any time. However, we can then no longer consider your application. The processing of your personal data in the application process is mandatory for the establishment of the employment relationship. Consequently, you have no option to object.

5. Other Data Processing Activities Outside Our Website

5.1 LinkedIn Page

Data processed: Interactions, Page Insights, messages sent by users.
Legal basis: Legitimate interest, Art. 6 Sect. 1 S. 1 lit. f) EU GDPR.
Purpose: Analysis of the reach of our LinkedIn Page, organizing the Page to match your interests, processing inquiries.
Retention period: See LinkedIn’s privacy policy.
Objection: You can object at any time to the processing of your personal data within the scope of the operation of our LinkedIn Page.

5.2 YouTube Channel

Data processed: Interactions, analytics, messages, comments.
Legal basis: Legitimate interest, Art. 6 Sect. 1 S. 1 lit. f) EU GDPR.
Purpose: Analysis of visit patterns, analysis of video success, processing inquiries.
Retention period: See Google’s privacy policy.
Objection: You can object at any time to the processing of your personal data within the scope of the operation of our YouTube channel.

5.3 Detailed Job Application Process

Data processed: Comprehensive application data, including voluntary information (see section 4.6 for full details).
Legal basis: Consent, contract, legal obligation, legitimate interest (Art. 6(1)(a), (b), (c), (f) GDPR; § 26 BDSG).
Purpose: Application process, possible employment.
Retention period: 6 months after rejection, longer if employed.

5.4 Microsoft Teams Project Meetings

a) Transcription

Data processed: First name, last name, language, audio content, account image, chat record.
Legal basis: Legitimate interest, Art. 6 Sect. 1 S. 1 lit. f) EU GDPR.
Purpose: Project organization.
Retention period: 60 days.
Objection: The processing of your personal data in the context of transcription is absolutely necessary for our project organization. Consequently, you have no option to object.

b) Recording

Data processed: First name, last name, language, audio content, video content, shared content, account image, chat record.
Legal basis: Consent, Art. 6 Sect. 1 S. 1 lit. a) EU GDPR.
Purpose: Project organization.
Retention period: 60 days.
Objection: You have the option to revoke your consent to the recording at any time.

c) Project Minutes/Planning

Data processed: Data from transcription/recording.
Legal basis: Legitimate interest, Art. 6 Sect. 1 S. 1 lit. f) EU GDPR.
Purpose: Creation of project-related meeting minutes, project organization.
Retention period: Until project completion.
Objection: The processing of your personal data in the context of management of project plans and creation of meeting minutes is absolutely necessary for our project organization. Consequently, you have no option to object.

6. Categories of Recipients

Within our company, only those departments and positions that require your data for the above-mentioned purposes will receive access. In addition, data may be shared with the following recipients:

  • Works council
  • Data protection officer
  • Representative for severely disabled employees
  • Equal opportunities officer
  • Employment agency
  • Integration office (in case of severe disability)
  • Printing companies
  • Lettershops
  • Scanning services
  • Banking institutions
  • IT service providers
  • Cooperation partners
  • Service providers
  • Lawyers, tax advisors, and courts
  • Authorities

7. Data Transfers to Third Countries

Data is transferred to service providers outside the EU/EEA only if adequate data protection guarantees exist (e.g., EU Standard Contractual Clauses or adequacy decisions). Details can be requested from us. We only work with service providers who ensure compliance with European data protection standards.

For the delivery of the website and the operation of the AI assistant, we use Cloudflare (a provider headquartered in the USA). This is based on a data processing agreement with EU Standard Contractual Clauses and on Cloudflare’s certification under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission is in place.

8. Your Rights as a Data Subject

You have the following rights:

  1. Right of access (Art. 15 GDPR): Information about whether and which personal data we process, and further details.
  2. Right to rectification (Art. 16 GDPR): Correction or completion of inaccurate or incomplete data.
  3. Right to restriction of processing (Art. 18 GDPR): Under certain circumstances (e.g., contesting accuracy, unlawful processing).
  4. Right to erasure (Art. 17 GDPR): Deletion of your data under specific conditions.
  5. Right to notify: We inform all recipients of your data about corrections, deletions, or restrictions.
  6. Right to data portability (Art. 20 GDPR): Receive your data in a structured, commonly used, machine-readable format.
  7. Right to object (Art. 21 GDPR): Object to processing on special grounds or for direct marketing.
  8. Right to withdraw consent (Art. 7(3) GDPR): Withdraw consent at any time.
  9. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

9. Right to Lodge a Complaint with the Supervisory Authority

You have the right to lodge a complaint with the competent supervisory authority:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Germany
Tel.: +49 611 1408 0
Email: poststelle@datenschutz.hessen.de

Version: 31 August 2026