Privacy Policy

We appreciate your interest in our company. Data protection is a top priority for the management of OHB SE. In general, it is possible to use the OHB SE website without providing any personal data. However, if a data subject wishes to use specific services offered by our company via our website, the processing of personal data may be necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the consent of the data subject.

The processing of personal data—such as a data subject’s name, address, email address, or phone number—is always carried out in accordance with the General Data Protection Regulation and in compliance with the country-specific data protection regulations applicable to OHB SE. Through this Privacy Policy, our company aims to inform the public about the nature, scope, and purpose of the personal data we collect, use, and process. Furthermore, this Privacy Policy informs data subjects of their rights.

As the data controller, OHB SE has implemented numerous technical and organizational measures to ensure the most comprehensive protection possible for the personal data processed via this website. However, internet-based data transmissions may inherently involve security risks, meaning that absolute protection cannot be guaranteed. For this reason, data subjects are free to provide us with personal data through alternative channels, such as by telephone.

1. External Hosting

This website is hosted externally. The personal data processed on the OHB SE website is stored on the host’s servers. This may include, among other things, IP addresses, contact requests, metadata and communication data, contract data, contact details, names, website visits, and other data generated through the website.

External hosting is carried out for the purpose of fulfilling our contractual obligations to our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of ensuring the secure, fast, and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR). If consent has been obtained, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device. Consent may be revoked at any time.

Our host will process your data only to the extent necessary to fulfill its service obligations.

We use the following web hosting provider:

Stefan Siedau

WebMen Internet Dresden, LLC

Marienallee

201099 Dresden

We have entered into a data processing agreement (DPA) for the use of the aforementioned service. This is a contract required under data protection law that ensures the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with applicable laws.

2. Name and address of the data controller

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union, and other provisions relating to data protection is:

OHB SE

2–4D Manfred-Fuchs-Platz

28359 Bremen

3. Name and address of the data protection officer

The data protection officer of the data controller is:

Jochen Zurborg

2–4D Manfred-Fuchs-Platz

28359 Bremen

Phone: +49 (0)421 2020 8

Email: datenschutz@ohb.de

Any affected individual may contact our Data Protection Officer directly at any time with questions or suggestions regarding data protection.

4. Cookies

The OHB SE website uses cookies. Cookies are text files that are placed and stored on a computer system via a web browser.

Cookies are either stored temporarily for the duration of a session (session cookies) and deleted once your visit ends, or stored permanently (persistent cookies) on your device until you delete them yourself or your web browser deletes them automatically.

Cookies that are necessary for the execution of the electronic communication process, for providing certain functions you have requested, or for optimizing the website (essential cookies) are stored on the basis of Article 6(1)(f) of the GDPR, unless another legal basis is specified. If consent to the storage of cookies and similar recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG); consent may be revoked at any time.

The user can prevent our website from setting cookies at any time by adjusting the settings of their web browser, thereby permanently opting out of the use of cookies.

5. Consent Management (Borlabs Cookie)

Our website uses Borlabs Cookie as a consent management platform (CMP). The provider is Borlabs GmbH, Ruhrallee 81, 45138 Essen, Germany.

Borlabs Cookie places a technically necessary cookie in your browser to store the cookie consents you have granted or revoked. No personal data that could be used to identify you is processed, unless you expressly give your consent. Storage is based on Art. 6(1)(c) GDPR, as the website operator is legally required to provide proof of consent in accordance with § 25(1) TDDDG. The consent data is stored until the statutory retention period expires. Further information: https://de.borlabs.io/datenschutz/.

6. Collection of general data and information (server log files)

The OHB SE website collects a range of general data and information each time it is accessed by a data subject or an automated system. This data is stored in the server’s log files. The following may be collected: browser types and versions used, the operating system used by the accessing system, the website from which an accessing system reaches our website (referrer), the subpages visited, the date and time of access, an Internet Protocol address (IP address), the Internet service provider of the accessing system, as well as other similar data and information used for security purposes.

When using this general data and information, OHB SE does not draw any conclusions about the data subject. This information is required to correctly display the content of our website, to ensure the continued functionality of our IT systems, and to provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyberattack. The anonymous data from the server log files is stored separately from any personal data provided by a data subject.

7. SSL or TLS encryption

Our website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential information. You can recognize an encrypted connection by the fact that the address bar of your browser changes from “http://” to “https://” and by the lock icon in your browser bar. When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

8. Contact Form (Gravity Forms)

We use Gravity Forms for the contact forms on our website. The provider is Rocketgenius Inc., 1902 Campus Commons Drive, Suite 200, Reston, VA 20191, USA.

If you contact us via the contact form, the personal data you provide (e.g., name, email address, message) will be automatically stored. The data is processed exclusively on our web server and is not shared with third parties. The legal basis is Article 6(1)(b) of the GDPR (pre-contractual measures) or Article 6(1)(f) of the GDPR (legitimate interest in processing inquiries).

The data you enter in the contact form will remain with us until you request that we delete it, revoke your consent to its storage, or the purpose for storing the data no longer applies.

9. Spam Protection (CleanTalk Anti-Spam)

Our website uses the CleanTalk Anti-Spam service to protect against spam messages. The service is provided by CleanTalk Inc., 711 S Carson St., Suite 4, Carson City, NV 89701, USA.

CleanTalk checks submitted form data and comments for signs of spam. In doing so, the user’s IP address, user agent, and form submissions, among other things, are transmitted to CleanTalk’s servers and analyzed there. Data is transferred to the United States on the basis of Standard Contractual Clauses (SCCs) in accordance with Article 46(2)(c) of the GDPR.

CleanTalk is used based on our legitimate interest in ensuring that our website remains free of spam (Art. 6(1)(f) GDPR). For more information, visit: https://cleantalk.org/publicoffer#privacy.

10. Website Translation (Weglot)

Our website uses the Weglot service for the automated translation of website content. The provider is Weglot SAS, 138 rue Pierre Joigneaux, 92270 Bois-Colombes, France.

When you visit a translated page, content and technical data (e.g., IP address, browser information) are transmitted to Weglot’s servers. Processing takes place within the EU. The legal basis is Article 6(1)(f) of the GDPR (legitimate interest in providing our website in multiple languages). For more information: https://weglot.com/privacy.

11. Website Security (Wordfence)

Our website uses the Wordfence Security plugin. The provider is Defiant Inc., 800 5th Ave, Suite 4100, Seattle, WA 98104, USA.

Wordfence protects our website against cyberattacks, malware, and unauthorized access. To this end, IP addresses, access times, URLs visited, and other technical data are collected and processed. Some of this data is transferred to servers operated by Defiant Inc. in the United States. The data transfer is based on Standard Contractual Clauses (SCCs) in accordance with Article 46(2)(c) of the GDPR.

The legal basis is Article 6(1)(f) of the GDPR (legitimate interest in protecting our website from attacks). For more information, visit: https://www.wordfence.com/privacy-policy/.

12. Caching (WP Rocket)

Our website uses the WP Rocket caching plugin to improve loading speed. The provider is SAS WP Media, 17 Chemin de la Plaine, 69390 Vernaison, France.

WP Rocket stores static versions of web pages locally on the server and uses technically necessary cookies to manage cache settings. No personal data is transferred to third parties. The legal basis is Article 6(1)(f) of the GDPR (legitimate interest in optimizing website loading times).

13. Routine Deletion and Blocking of Personal Data

The data controller processes and stores the data subject’s personal data only for the period necessary to achieve the purpose of storage, or to the extent provided for by European legislative bodies or other legislative bodies in laws or regulations.

If the purpose of storage no longer applies or a statutory retention period expires, the personal data will be routinely blocked or deleted in accordance with legal requirements.

14. Rights of the Data Subject

a) Right to confirmation

Every data subject has the right to request confirmation from the controller as to whether personal data concerning them is being processed.

b) Right of access

Any individual whose personal data is being processed has the right to obtain, at any time and free of charge, information about the personal data stored about them and a copy of that information.

c) Right to rectification

Every data subject has the right to request the immediate correction of inaccurate personal data concerning them.

d) Right to erasure (right to be forgotten)

Every data subject has the right to request that the controller erase personal data concerning them without delay, provided that the processing is no longer necessary.

e) Right to restriction of processing

Every data subject has the right to request that the controller restrict processing if the accuracy of the data is disputed, the processing is unlawful, the controller no longer needs the data, or the data subject has objected to the processing.

f) Right to data portability

Every data subject has the right to receive the personal data concerning them in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

g) Right to object

Every data subject has the right to object at any time to the processing of personal data concerning them that is based on Article 6(1)(e) or (f) of the GDPR. In the event of an objection, OHB SE will no longer process the personal data unless we can demonstrate compelling legitimate grounds for doing so.

(h) Right to withdraw consent under data protection law

If you have given us consent in accordance with Section 25(1), sentence 1 of the TDDDG, Article 6(1)(a), or Article 9(2)(a) of the GDPR, you have the right to withdraw this consent at any time.

(i) Right to file a complaint with the competent supervisory authority

In the event of a breach of the GDPR, the data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work, or the place where the alleged breach occurred.

15. Legal Basis for Processing

Article 6(1)(a) of the GDPR serves as the legal basis for our company’s processing activities in cases where we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract, the processing is based on Article 6(1)(b) of the GDPR. If our company is subject to a legal obligation, the processing is based on Article 6(1)(c) of the GDPR. Finally, processing operations may be based on Article 6(1)(f) of the GDPR if the processing is necessary to safeguard a legitimate interest of our company and the interests, fundamental rights, and freedoms of the data subject do not override those interests.

16. Retention Period for Personal Data

The criterion for determining how long personal data is stored is the applicable statutory retention period. Once this period has expired, the relevant data is routinely deleted, provided it is no longer necessary for the performance or initiation of a contract.

17. Data Processing by Social Networks

We maintain publicly accessible profiles on social media platforms. Social media platforms such as Instagram, LinkedIn, XING, YouTube, or X can comprehensively analyze your user behavior when you visit their websites or pages that include embedded social media content.

If you are logged into your social media account and visit our page, the operator can link your visit to your user account. However, your personal data may also be collected even if you are not logged in or do not have an account.

Our social media accounts are designed to ensure comprehensive visibility on the internet. This constitutes a legitimate interest under Article 6(1)(f) of the GDPR. When you visit one of our social media accounts, we are jointly responsible with the platform operator for the data processing that takes place. You may exercise your rights with us as well as with the operator of the respective platform.

a) Instagram

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Data transfers to the United States are covered by the EU-U.S. Data Privacy Framework (DPF). Privacy Policy: help.instagram.com/155833707900388.

b) X (Twitter)

Provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Data is transferred to the United States on the basis of Standard Contractual Clauses (SCCs) pursuant to Article 46(2)(c) of the GDPR. Privacy Policy: x.com/de/privacy.

c) XING

Provider: New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany. Privacy Policy: privacy.xing.com/de/datenschutzerklaerung.

d) LinkedIn

Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn is certified under the EU-U.S. Data Privacy Framework (DPF). Some data is transferred to the United States; this transfer is additionally supported by Standard Contractual Clauses (SCCs). Privacy Policy: de.linkedin.com/legal/privacy-policy.

e) YouTube

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google is certified under the EU-U.S. Data Privacy Framework (DPF). Privacy Policy: policies.google.com/privacy.

18. Social Media Plugins (Shariff Solution)

We use social media buttons on our website. These are integrated using the so-called Shariff solution. This prevents a connection from being established with a social network simply because you visit a page with a social media button without clicking it. Information is only transmitted to the social network once you click the button.

19. Automated Decision-Making

As a responsible company, we do not use automated decision-making or profiling.

20. Legal or contractual requirements regarding the provision of personal data

The provision of personal data may in some cases be required by law (e.g., tax or commercial law regulations) or stem from contractual provisions. Before providing personal data, please contact one of our staff members, who will explain to you on a case-by-case basis the necessity of providing such data and the possible consequences of refusing to do so.