The operators of this website and its pages take the protection of your personal data very seriously. Hence, we handle your personal data as confidential information and in compliance with the statutory data protection regulations and this Data Protection Declaration. Personal data comprises data that can be used to personally identify you. We herewith advise you that the transmission of data via the Internet (i.e., through e-mail communications) may be prone to security gaps. It is not possible to completely protect data against third-party access. The following information will provide you with an easy to navigate overview of how your personal data is processed under the responsibility of Ocean Vision Legal gGmbH (registered office, registration number, etc.).
A. Applicability of this Privacy Policy
This Privacy Policy applies to your use of the www.oceanvisionlegal.com website (“Website“) and the services offered there (e.g. contact form), to the data processing in the context of our application procedures and our social media presence (“Social Media Profile“). If you visit another website, the data protection information of the respective operator applies. This also applies to websites to which we provide a link. We recommend that you familiarise yourself with the scope of personal data on the respective website.
We process personal data (Art. 4 no. 2 GDPR) in accordance with the provisions of the European Data Protection Regulation (“GDPR”) and the German Federal Data Protection Act (“BDSG”) and comply with the provisions of the Telecommunications Digital Services Data Protection Act (“TDDDG”). For detailed information about the subject matter of data protection, please consult our Data Protection Declaration, which we have included beneath this copy.
B. Who is the responsible party for the recording of data?
The data processing controller for the above mentioned activities (i.e. the “controller” according to Art. 4 No. 7 GDPR) is:
Ocean Vision GmbH
You can contact us for any inquiry under:
Phone: +4915167786007
E-mail: contact@oceanvisionlegal.com
C. Data Recording
The following part will explain how Ocean Vision GmbH records and processes data, what we use the data for, who receives and works with your data and the duration of storage.
I. What data do we collect?
1. Communications
We use your personal data to improve the usability of our website and to provide you with a better service. We also use it to communicate with you, e.g. through our newsletters. Furthermore, we may use information collected through forms on our website, through your registration for our events, or through other direct interactions with you to invite you to make donations or otherwise support our work.
We may retain the following personal data:
● Full name
● Email address
● Country
● Postal address
● Payment details
● Telephone number
● Company name
● Job title
● IP address
● Gender
● Date of birth
● Areas of interest
We process this data on the basis of your consent, which you provide when subscribing to our newsletters and updates, and/or on the basis of our legitimate interest in keeping you informed about our campaigns. For information on how long we store your personal data from communications see: Other Communications.
2. Job Applications
We may retain personal data submitted as part of job applications. This may include, but is not limited to:
● Full name
● Email address
● Telephone number
● Employment history
● Sensitive personal data, including information relating to racial or ethnic origin, sexual orientation, religion, and/or disability where applicable
● Any other information contained in your CV
We process this data on the basis of your consent. Based on your consent and/or your employment contract, or where we are legally required to do so or where processing is carried out in the public interest (for example, for immigration or diversity monitoring purposes), we may process additional data at a later stage of the recruitment process. Further details will be set out in your employment contract. For more information on how long we store your personal data from your job application see: Job Applications in the section: How long do we store your data?.
3. Fundraising and Donations
We may also process your personal data in connection with our fundraising activities, including where you have made a donation to us or where we reasonably believe that you may have an interest in supporting our charitable work. We may obtain this information directly from you, from trusted partners within the charitable sector, or from publicly available sources. The personal data we process for these purposes may include:
● Full name
● Marital status
● Gender
● Date of birth
● Postal address
● Email address
● Telephone number
● Dietary requirements (for events that we might invite you to)
● Information about family members
● Giving history
● Gift Aid information
● Education and career information
We process this personal data on the basis of your consent, where required, and/or our legitimate interests in carrying out fundraising activities as a charitable organisation, including identifying and engaging with potential donors. Where we have an existing relationship with you, we may contact you regarding opportunities to support our work where permitted by applicable law and based on your consent or our legitimate interests, as appropriate. We may also process your personal data to comply with our contractual, legal, and regulatory obligations, including those relating to the administration, accounting, and reporting of donations. For more detailed information how we process your data through the Online Donations Platform “Donately” see: Payment service providers.
II. How do we record your data?
We collect your data as a result of your sharing of your data with us. This includes data you submit to us or third parties via:
● e-mail;
● telephone;
● contact form;
● newsletter subscription (Mailchimp);
● other forms through our website (Google Forms, Google Calendar, Google Drive);
● social media (LinkedIn, WhatsApp);
● online payment platforms (Donately);
and data that are automatically recorded by our IT systems after you consent to its recording during the visit of our website or third parties. The IT systems we use are:
● Analysis Tools (e.g. Google Analytics, LinkedIn Insight Tag);
● “Cookies”;
● Video Conference Tools (Zoom, Google Meet).
The data we record through IT services comprise primarily technical information (e.g., web browser, operating system, or time the site was accessed). This information is recorded automatically when you access this website.
A detailed description of how we collect and process personal data through our website, including via our contact forms, email communications, and other technologies and communication channels, is set out in: Recording of Data by Tools.
III. On what legal basis do we process your personal data?
If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9 (2)(a) GDPR, if special categories of data are processed according to Art. 9 (1) DSGVO. In the case of explicit consent to the transfer of personal data to third countries, the data processing is also based on Art. 49 (1)(a) GDPR. If you have consented to the storage of cookies or to the access to information in your end device (e.g., via device fingerprinting), the data processing is additionally based on § 25 (1) TDDDG. The consent can be revoked at any time. If your data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, if your data is required for the fulfillment of a legal obligation, we process it on the basis of Art. 6(1)(c) GDPR. Furthermore, the data processing may be carried out on the basis of our legitimate interest according to Art. 6(1)(f) GDPR. Information on the relevant legal basis in each individual case is provided in the following paragraphs of this privacy policy.
IV. What are the purposes we use your data for?
A portion of the information recorded via our website is generated to guarantee the error free provision of the website. Other website data may be used to analyze your user patterns. Data you shared with us through e-mails or other contact forms are generally used for the purpose of processing your request. Data from job applications are also used for background research on applicants and to inform you about future employment opportunities (see: Job Applications). For more detailed information about the purposes for which we process your personal data, please refer to the relevant section for the applicable tool in the Recording of Data by Tools.
V. Who receives, processes and stores your data?
In the scope of our business activities, we cooperate with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only disclose personal data to external parties if this is required as part of the fulfillment of a contract, if we are legally obligated to do so (e.g., disclosure of data to tax authorities), if we have a legitimate interest in the disclosure pursuant to Art. 6 (1)(f) GDPR, or if another legal basis permits the disclosure of this data. In the case of joint processing, a joint processing agreement is concluded.
1. Transfer of Data to Third Parties
We pass on your data to the following categories of recipients if it is necessary for the compliance with an agreement between you and us or for the implementation of pre-contractual measures (Art. 6 para. 1 sentence 1 lit. b GDPR), for the protection of legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) or due to a legal regulation (Art. 6 para. 1 sentence 1 lit. c GDPR):
● IT service providers, e.g. cloud, hosting and software-as-a-service providers (in particular email delivery service providers) for information on the provider, “System for operating the Career Website and managing applicants”);
● Third parties involved in legal proceedings, provided they submit a legal order, court order or equivalent legal disposition to us.
Furthermore, we will only disclose your personal data to third parties if:
● you have given your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR (e.g. for Cookies),
● it is necessary to safeguard legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR), which include outsourcing functions (particularly to IT service providers),
● the transfer is necessary for the establishment, exercise or defence of legal claims pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,
● in the event of a legal obligation to transfer pursuant to Art. 6 para. 1 sentence 1 lit. c GDPR, and
● this is legally permissible and necessary pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR for the performance of a contract and the fulfilment of obligations arising from contractual relationships or for the implementation of pre-contractual measures with you.
2. Data Processing in Third Countries
We also use service providers based in third countries outside the European Union (EU) or the European Economic Area (EEA) to process your personal data. These countries may have a lower level of data protection than within the European Union. In case of data transfer to these countries, we will provide the necessary safeguards to ensure that your data is processed as securely as within the EEA, e.g. by concluding standard contractual clauses of the EU Commission (SCC) within the meaning of Art. 46 para. 2 sentence 1 lit. c GDPR or by other measures provided for by law. You can request a copy of the measures taken by contacting us using the contact details provided above. The service providers we use (see: Recording of Data by Tools) that are based in the USA have been certified under the EU-U.S. Data Privacy Framework to ensure an adequate level of data protection for data transfers to the USA. You can view the certificates here: www.dataprivacyframework.gov/list.
3. SSL and TLS encryption programme
For security reasons and to protect the transmission of confidential content, such as purchase orders or inquiries you submit to us as the website operator, this website uses either an SSL or a TLS encryption programme. You can recognize an encrypted connection by checking whether the address line of the browser switches from “http://” to “https://” and also by the appearance of the lock icon in the browser line. If the SSL or TLS encryption is activated, data you transmit to us cannot be read by third parties.
VI. How long do we store your data?
P
Unless a more specific storage period is specified in this privacy policy (see below), your personal data will remain with us until the purpose for which it was collected no longer applies. If you assert a request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.
1. Job Applications
We will retain personal data submitted in connection with job vacancies for the duration of the recruitment process and for up to six months after the recruitment process has ended. Your data will then be deleted.
With your consent, we may retain your personal data for up to two years in order to notify you of future employment opportunities, unless you choose to opt out (for further information see: No obligation to provide personal data and Revocation of your consent to the processing of data). If your application is successful, we may retain your information for a longer period as part of your employment records.
2. Other Communications
The data sent by you to us via contact requests (via e-mail or contact form) remain with us until you request us to delete, revoke your consent to the storage or the purpose for the data storage lapses (e.g. after completion of your request).
The data deposited with us for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter or the newsletter service provider and deleted from the newsletter distribution list after you unsubscribe from the newsletter. Data stored for other purposes with us remain unaffected.
The communication content exchanged between you and us on WhatsApp remains with us until you request us to delete it, revoke your consent to storage or the purpose for which the data is stored ceases to apply (e.g. after your request has been processed). For all of the above, mandatory legal provisions – in particular retention periods – remain unaffected.
3. Tools (Google Form, Google Calendar, payment service providers, Virtual Meetings)
The data you enter into Google Form will remain in our possession until you ask us to delete them, revoke your consent to the archiving of your data or until the purpose of archiving the data no longer exists (e.g., upon completion of the processing of your inquiry). This does not affect mandatory statutory provisions – in particular those governing retention periods. For more information, please consult Google’s Data Privacy Policy at https://policies.google.com/.
The collected data through external online donation tools shall be deleted upon completion of the order or termination of the business relationship and upon expiration of any existing statutory archiving periods. This shall be without prejudice to any statutory archiving periods.
Data collected directly by us via video and conference tools such as Read AI will be deleted from our systems immediately after you request us to delete it, revoke your consent to storage, or the reason for storing the data no longer applies. Stored cookies remain on your end device until you delete them. Mandatory legal retention periods remain unaffected. We have no influence on the duration of storage of your data that is stored by the operators of the conference tools for their own purposes. For details, please directly contact the operators of the conference tools.
4. Cookies and other Analytics Tools
Cookies are stored for two years, unless you clear your browser cache or delete your cookies sooner. Session Cookies are automatically deleted when you leave our Websites. Necessary Cookies are usually only stored on your device for as long as your browser is active and, unless otherwise specified, are deleted at the end of the respective browser session. The Analytics Cookies are deleted after 14 months at the latest or if you withdraw your consent beforehand.
The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymized data will then be deleted within 180 days.
D. What rights do you have as far as your information is concerned?
There is no obligation to provide personal data to us. In case you do, you have the right to receive information about the source, recipients, and purposes of your archived personal data at any time without having to pay a fee for such disclosures. You also have the right to demand that your data are rectified or eradicated. If you have consented to data processing, you have the option to revoke this consent at any time, which shall affect all future data processing. Moreover, you have the right to demand that the processing of your data be restricted under certain circumstances. Furthermore, you have the right to log a complaint with the competent supervising agency. Please do not hesitate to contact us at any time if you have questions about this or any other data protection related issues.
I. No obligation to provide personal data
If we ask you to provide personal data, you can of course refuse to do so. However, we may then not be able to provide certain functions of the website, answer your enquiries or conclude a contract. This applies in particular if the data is required for the establishment, implementation and termination of a business relationship or an employment relationship, or if we are legally obliged to collect data.
II. Revocation of your consent to the processing of data
A wide range of data processing transactions are possible only subject to your express consent. You can also revoke at any time any consent you have already given us. This shall be without prejudice to the lawfulness of any data collection that occurred prior to your revocation.
III. Right to object to the collection of data in special cases; right to object to direct advertising (Art. 21 GDPR)
In the event that data is processed on the basis of Article 6(1)(e) or (f) GDPR, you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation. This also applies to any profiling based on these provisions. To determine the legal basis on which any processing of data is based, please consult this Privacy Policy. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or where the processing serves the establishment, exercise or defence of legal claims (right to object pursuant to Article 21(1) GDPR).
If your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing. This also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will thereafter no longer be used for direct marketing purposes (right to object pursuant to Article 21(2) GDPR).
IV. Right to log a complaint with the competent supervisory agency
According to Article 77(1) GDPR, in the event of violations of the GDPR, data subjects are entitled to lodge a complaint with a supervisory agency, in particular in the member state where they usually maintain their domicile, place of work or at the place where the alleged violation occurred. The right to log a complaint is in effect regardless of any other administrative or court proceedings available as legal recources.
V. Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you should demand the direct transfer of the data to another controller, this will be done only if it is technically feasible.
VI. Information about, rectification and eradication of data
Within the scope of the applicable statutory provisions, you have the right to demand information about your archived personal data, their source and recipients as well as the purpose of the processing of your data at any time. You may also have a right to have your data rectified or eradicated. If you have questions about this subject matter or any other questions about personal data, please do not hesitate to contact us at any time.
VII. Right to demand processing restrictions
You have the right to demand the imposition of restrictions as far as the processing of your personal data is concerned. To do so, you may contact us at any time. The right to demand restriction of processing applies in the following cases:
● In the event that you should dispute the correctness of your data archived by us, we will usually need some time to verify this claim. During the time that this investigation is ongoing, you have the right to demand that we restrict the processing of your personal data.
● If the processing of your personal data was/is conducted in an unlawful manner, you have the option to demand the restriction of the processing of your data instead of demanding the eradication of this data.
● If we do not need your personal data any longer and you need it to exercise, defend or claim legal entitlements, you have the right to demand the restriction of the processing of your personal data instead of its eradication.
● If you have raised an objection pursuant to Art. 21(1) GDPR, your rights and our rights will have to be weighed against each other. As long as it has not been determined whose interests prevail, you have the right to demand a restriction of the processing of your personal data.
If you have restricted the processing of your personal data, these data – with the exception of their archiving – may be processed only subject to your consent or to claim, exercise or defend legal entitlements or to protect the rights of other natural persons or legal entities or for important public interest reasons cited by the European Union or a member state of the EU.
E. Recording of Data by Tools
1. Request by e-mail or telephone
If you contact us by e-mail or telephone, your request, including all resulting personal data (name, request) will be stored and processed by us for the purpose of processing your request. We do not pass these data on without your consent.
These data are processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the fulfillment of a contract or is required for the performance of pre-contractual measures. In all other cases, the data are processed on the basis of our legitimate interest in the effective handling of inquiries submitted to us (Art. 6(1)(f) GDPR) or on the basis of your consent (Art. 6(1)(a) GDPR) if it has been obtained; the consent can be revoked at any time.
2. Contact form
If you submit inquiries to us via our contact form, the information provided in the contact form as well as any contact information provided therein will be stored by us in order to handle your inquiry and in the event that we have further questions. We will not share this information without your consent.
The processing of these data is based on Art. 6(1)(b) GDPR, if your request is related to the execution of a contract or if it is necessary to carry out pre-contractual measures. In all other cases the processing is based on our legitimate interest in the effective processing of the requests addressed to us (Art. 6(1)(f) GDPR) or on your agreement (Art. 6(1)(a) GDPR) if this has been requested; the consent can be revoked at any time.
The information you have entered into the contact form shall remain with us until you ask us to eradicate the data, revoke your consent to the archiving of data or if the purpose for which the information is being archived no longer exists (e.g., after we have concluded our response to your inquiry). This shall be without prejudice to any mandatory legal provisions, in particular retention periods.
3. Newsletter
If you would like to receive the newsletter offered on the website, we require an e-mail address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter. Further data is not collected or only on a voluntary basis. For the handling of the newsletter, this website uses the services of Mailchimp to send out its newsletters. The provider is the Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.
Among other things, Mailchimp is a service that can be deployed to organize and analyze the sending of newsletters. Whenever you enter data for the purpose of subscribing to a newsletter (e.g. your e-mail address), the information is stored on Mailchimp servers in the United States. With the assistance of the Mailchimp tool, we can analyze the performance of our newsletter campaigns. If you open an e-mail that has been sent through the Mailchimp tool, a file that has been integrated into the e-mail (a so-called web-beacon) connects to Mailchimp’s servers in the United States. As a result, it can be determined whether a newsletter message has been opened and which links the recipient possibly clicked on. Technical information is also recorded at that time (e.g. the time of access, the IP address, type of browser and operating system). This information cannot be allocated to the respective newsletter recipient. Their sole purpose is the performance of statistical analyses of newsletter campaigns. The results of such analyses can be used to tailor future newsletters to the interests of their recipients more effectively. If you do not want to permit an analysis by Mailchimp, you must unsubscribe from the newsletter. We provide a link for you to do this in every newsletter message.
The data is processed based on your consent (Art. 6(1)(a) GDPR). You may revoke any consent you have given at any time by unsubscribing from the newsletter. This shall be without prejudice to the lawfulness of any data processing transactions that have taken place prior to your revocation.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://mailchimp.com/eu-us-data-transfer-statement/ and https://mailchimp.com/legal/data-processing-addendum/#Annex_C_-_Standard_Contractual_
Clauses.
After you unsubscribe from the newsletter distribution list, your e-mail address may be stored by us or the newsletter service provider in a blacklist, if such action is necessary to prevent future mailings. The data from the blacklist is used only for this purpose and not merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). The storage in the blacklist is indefinite. You may object to the storage if your interests outweigh our legitimate interest.
For more details, please consult the Data Privacy Policies of Mailchimp at: https://mailchimp.com/legal/terms/.
The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id =a2zt0000000TXVKAA4&status=Active
4. Communication via WhatsApp
For communication with our partners and other third parties, one of the services we use is the instant messaging service WhatsApp. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
The communication is encrypted end-to-end (peer-to-peer), which prevents WhatsApp or other third parties from gaining access to the communication content. However, WhatsApp does gain access to metadata created during the communication process (for example, sender, recipient, and time). We would also like to point out that WhatsApp has stated that it shares personal data of its users with its U.S.-based parent company Meta. Further details on data processing can be found in the WhatsApp privacy policy at: https://www.whatsapp.com/legal/#privacy-policy.
The use of WhatsApp is based on our legitimate interest in communicating as quickly and effectively as possible with partners, interested parties and other business and contractual partners (Art. 6(1)(f) GDPR). If a corresponding consent has been requested, data processing is carried out exclusively on the basis of the consent; this consent may be revoked at any time with effect for the future.
The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id =a2zt00000011sfnAAA&status=Active
We use WhatsApp in the “WhatsApp Business” variant. Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.whatsapp.com/legal/business-data-transfer-addendum?lang=en.
5. Google Forms
We have integrated Google Forms into this website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as „Google”). Google Forms enables us to generate online forms to record messages, inquiries and other entries entered by visitors to our website. All entries you make will be processed on Google’s servers. Google Forms stores a cookie in your browser that contains a unique ID (NID cookie). This cookie stores a wide range of information, including, for example, your language settings. We use Google Forms on the basis of our legitimate interest in determining your needs as effectively as possible (Art. 6(1)(f) GDPR). If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. This consent can be revoked at any time. The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id =a2zt000000001L5AAI&status=Active
6. Google Calendar
For planning purposes, we use Google Calendar. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as “Google”). To make reservations for an appointment, you will enter the requested data and your preferred meeting date into the dedicated screen. The data you enter will be used to plan, conduct, and possibly also follow up on the appointment. The appointment information will be stored on the servers of Google Calendar on our behalf. You may review the company’s data protection policy here: https://policies.google.com/privacy.
The legal basis for the processing of the data is Art. 6(1)(f) GDPR. The operator of the website has a legitimate interest in ensuring that appointments with partners and prospective partners can be scheduled as easily as possible. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. This consent can be revoked at any time.
Data transfer to the US is based on the standard contractual clauses of the EU Commission. Details can be found here: https://workspace.google.com/terms/dpa_terms.html and https://cloud.google.com/terms/sccs.
The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id =a2zt000000001L5AAI&status=Active
7. Google Drive
Google Drive allows us to include an upload area on our website where you can upload content. When you upload content, it is stored on Google Drive’s servers. When you visit our website, a connection to Google Drive is additionally established so that Google Drive can determine that you have visited our website.
The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. The use of Google Drive is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in having a reliable upload area on its website. If a corresponding consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; the consent can be revoked at any time.
The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id =a2zt000000001L5AAI&status=Active.
We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.
8. Social Media
We operate Social Media Profiles. There we publish and share posts on current legal topics, news about our law firm’s activities and information about our events.
When you visit our Social Media Profiles, the social media provider processes information about you. You can find more detailed information on data processing in the Privacy Policy of the respective social media provider listed below. Some social media providers also offer the option to object to certain data processing. Please note that, according to the social media providers, user data is also processed in the USA or other third countries.
a. LinkedIn
Linkedin uses cookies and similar technologies to collect information about how you interact with our website. We may use this information to display advertisements or provide recommendations where we believe you may be interested in our work or wish to support our activities. Further information is available in Linkedin's Cookie Policy.
This website uses elements of the LinkedIn network. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
Any time you access a page of this website that contains elements of LinkedIn, a connection to LinkedIn’s servers is established. LinkedIn is notified that you have visited this website with your IP address. If you click on LinkedIn’s “Recommend” button and are logged into your LinkedIn account at the time, LinkedIn will be in a position to allocate your visit to this website to your user account. We have to point out that we as the provider of the websites do not have any knowledge of the content of the transferred data and its use by LinkedIn.
The use of this service is based on your consent in accordance with Art. 6 (1)(a) GDPR and § 25 (1) TDDDG. Consent can be revoked at any time.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.linkedin.com/help/linkedin/answer/a1343190/datenubertragung-aus-der-eu-dem ewr-und-der-schweiz?lang=de.
For further information on this subject, please consult LinkedIn’s Data Privacy Declaration at: https://www.linkedin.com/legal/privacy-policy.
9. Analysis tools and tools provided by third parties
There is a possibility that your browsing patterns will be statistically analyzed when you visit this website. Such analyses are performed primarily with what we refer to as analysis programs.
a. WIX.com
We are hosting the content of our website at the following provider: WIX Page 18 of 28
The provider is the Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel (hereinafter: “WIX”). WIX is a tool for creating and hosting websites. When you visit our website, WIX analyses user behavior, visitor sources, region of website visitors and visitor numbers. The WIX stores cookies on your browser, which are necessary for the presentation of the website and to ensure security (necessary cookies).
Data recorded via WIX may be stored on a variety of servers around the globe. Among other locations, WIX servers are also located in the USA. Details can be found in the privacy policy of WIX: https://de.wix.com/about/privacy. According to WIX, the transfer of data to the United States as well as other non-EU countries is based on the standard contract clauses of the EU Commission or comparable warranties pursuant to Art. 46 GDPR. For details, please go to: https://de.wix.com/about/privacy-dpa-users. The WIX is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest the most reliable presentation of our website. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. This consent can be revoked at any time. The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id =a2zt0000000GnbGAAS&status=Active
b. LinkedIn Insight Tag
This website uses the Insight tag from LinkedIn. This service is provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
i. Data processing by LinkedIn Insight tag
We use the LinkedIn Insight tag to obtain information about visitors to our website. Once a website visitor is registered with LinkedIn, we can analyze the key occupational data (e.g., career level, company size, country, location, industry, job title) of our website visitors to help us better target our site to the relevant audience. We can also use LinkedIn Insight tags to measure whether visitors to our websites make a purchase or perform other actions (conversion measurement). Conversion measurement can also be carried out across devices (e.g. from PC to tablet). LinkedIn Insight Tag also features a retargeting function that allows us to display targeted advertising to visitors to our website outside of the website. According to LinkedIn, no identification of the advertising addressee takes place.
LinkedIn itself also collects log files (URL, referrer URL, IP address, device and browser characteristics and time of access). The IP addresses are shortened or (if they are used to reach LinkedIn members across devices) hashed (pseudonymized). The data collected by LinkedIn cannot be assigned by us as a website operator to specific individuals. LinkedIn will store the personal data collected from website visitors on its servers in the USA and use it for its own promotional activities. For details, please see LinkedIn’s privacy policy at https://www.linkedin.com/legal/privacy-policy#choices-oblig.
ii. Legal basis
If your approval (consent) has been obtained the use of the abovementioned service shall occur on the basis of Art. 6(1)(a) GDPR and § 25 TDDDG (German Telecommunications Act). Such consent may be revoked at any time. If your consent was not obtained, the use of the service will occur on the basis of Art. 6(1)(f) GDPR; the website operator has a legitimate interest in effective advertising promotions that include the utilization of social media.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.
iii. Objection to the use of LinkedIn Insight Tag
You can object to LinkedIn’s analysis of user behavior and targeted advertising at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. In addition, LinkedIn members can control the use of their personal information for promotional purposes in the account settings. To prevent LinkedIn from linking information collected on our site to your LinkedIn account, you must log out of your LinkedIn account before you visit our site.
10. Cookies
We use cookies and similar technologies (hereinafter collectively referred to as “Cookies“) on our Websites. These are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our Websites. Cookies do not cause any damage to your device and do not contain viruses, Trojans, or other malware. The information stored in a Cookie is related to the specific device used. However, this does not mean that we immediately become aware of your identity.
We use so-called session cookies to recognise that you have already visited individual pages of our Websites during your visit. In addition, we use persistent cookies that are stored on your device and remain stored for longer than a browser session. They help us to store information, settings or preferences that you have previously saved.
Information about the individual Cookies for our www.oceanvisionlegal.com Website can be found in the Cookie Policy, which you can find via a link in our Cookie banner.
The Cookies used on our website can be categorised as follows:
a. Necessary Cookies
Most of the Cookies we use are necessary to enable you to use our Web-sites and the services offered there. They ensure that the Websites function properly and are optimised for user-friendliness. This purpose is our legitimate interest in data processing; the legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR, Section 25 para. 2 no. 2 TDDDG. In particular, necessary Cookies store the following information:
● Information about your browser, your network and your device;
● Websites you access via our Websites; and
● your IP address.
The data is not merged with other personal data or used for advertising purposes.
b. Analysis tools
If you have given your consent, we also use Cookies to create pseudonymous usage profiles for the purpose of web analysis (“Web Statistics- or Analytics Cookies“). These Cookies enable us to recognise returning users (device owners), analyse their behaviour on our Website, optimise our Website and measure its reach. The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. a GDPR, Section 25 para. 1 TDDDG, i.e. your prior consent. You consent to this tracking by accepting all Cookies in the Cookie banner or by expressly allowing the service in the settings; no Analytics Cookies are set before this happens. We do not combine the data with other personal data, nor do we use it to target individual users for advertising purposes.
c. Cookies for integrating external content
We use plugins and Cookies to embed external content (e.g. maps) offered by third-party providers (“External Content“) into our Website so that it can be used directly on our Website.
Only if you have given your consent (Art. 6 para. 1 sentence 1 lit. a GDPR, Section 25 para. 1 TDDDG) on our Website by accepting all Cookies in our Cookie banner or by expressly allowing the service in the settings, will the third-party provider receive the information that you have accessed the cor-responding subpage of our Website. This is regardless of whether you have a user account with the third-party provider or are logged in there. If you are logged into your account and use the Embedded Content, your data will be directly associated with your account. If you do not wish to have your data associated with your account, you must log out before visiting our Website.
The third-party provider might store your data as user profiles and use them for the purposes of advertising, market research and/or the demand-oriented design of their website. Such evaluation takes place in particular to provide personalised advertising. You have the right to object to the creation of these user profiles, which you must claim from the responsible third-party provider. We have no influence on the data transfer and processing by the third-party provider.
For further information (e.g. about the third-party provider, the specific purpose of use, the storage period), please visit our Cookie settings, which are accessible at any time on our Website.
d. Cookie management and withdrawal of your consent
You can change your Cookie settings for our Websites at any time: for our Website via the Cookie settings on our Website and for our Career Website via the Cookie icon at the bottom right-hand corner of our Career Website. If your device supports this feature, you can also prevent the use of Cookies at any time by adjusting your internet browser settings to reject new Cookies (especially third-party Cookies) or to alert you when new Cookies are received. You can also delete Cookies that have already been saved in your internet browser settings. You can find help on how to change your Cookie settings, for example, in the help function of your internet browser. Further information on this and on Cookies in general can be found, for example, at www.allaboutcookies.org and www.youronlinechoices.com.
Please be aware that if you deactivate Cookies, you may not be able to use all the functions of our Websites.
11. Plug-ins and Tools
a. YouTube
This website embeds videos of the website YouTube. The website operator is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
If you visit a page on this website into which a YouTube has been embedded, a connection with YouTube’s servers will be established. As a result, the YouTube server will be notified, which of our pages you have visited.
Furthermore, YouTube will be able to place various cookies on your device or comparable technologies for recognition (e.g. device fingerprinting). In this way YouTube will be able to obtain information about this website’s visitors. Among other things, this information will be used to generate video statistics with the aim of improving the user friendliness of the site and to prevent attempts to commit fraud.
If you are logged into your YouTube account while you visit our site, you enable YouTube to directly allocate your browsing patterns to your personal profile. You have the option to prevent this by logging out of your YouTube account.
The use of YouTube is based on our interest in presenting our online content in an appealing manner. Pursuant to Art. 6(1)(f) GDPR, this is a legitimate interest. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. This consent can be revoked at any time. For more information on how YouTube handles user data, please consult the YouTube Data Privacy Policy under: https://policies.google.com/privacy?hl=en.
The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id =a2zt000000001L5AAI&status=Active
b. Zapier
We have integrated Zapier on this website. The provider is Zapier Inc, Market St. #62411, San Francisco, CA 94104-5401, USA (hereinafter “Zapier”).
Zapier allows us to link and synchronize various functionalities, databases, and tools with our website. In this way, it is possible, for example, to automatically play out content that we publish on our website on our social media channels or to export content from marketing and analysis tools. Depending on the functionality, Zapier may also collect various personal data in the process.
The use of Zapier is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest on the most effective integration of the tools used. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. This consent can be revoked at any time.
Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://zapier.com/tos.
12. Payment service providers
We collect, process, and use personal and contract data for the establishment, content arrangement and modification of our contractual relationships. Data with personal references to the use of this website (usage data) will be collected, processed, and used only if this is necessary to enable the user to use our services or required for billing purposes. The legal basis for these processes is Art. 6(1)(b) GDPR.
Online donations to Ocean Vision Legal gGmbH are processed by specialist third-party service providers that are contracted by and act on behalf of Ocean Vision Legal gGmbH. We may engage the following payment processors to process your donations:
● Donately – You can read their Data Privacy Policy here.
When a payment is processed by our service provider acting on behalf of Ocean Vision Legal gGmbH, payment information is collected securely through an encrypted connection and protected using industry-standard security software.
Ocean Vision Legal gGmbH itself does not collect payment information (such as payment card details), and payment information submitted in connection with a donation is not made available to Ocean Vision Legal gGmbH. Our specialist third-party payment provider will use the information you provide solely for the purpose of processing your donation. However, in connection with donations, we may also process certain personal data that you provide via forms on our website or through platforms such as Donately in order to establish a recurring donation. This may include:
● Full name;
● Postal address;
● Email address.
13. Online-based Audio and Video Conferences (Conference tools)
a. Data processing
We use online conference tools, among other things, for communication with our partners. The tools we use are listed in detail below. If you communicate with us by video or audio conference using the Internet, your personal data will be collected and processed by the provider of the respective conference tool and by us. The conferencing tools collect all information that you provide/access to use the tools (email address and/or your phone number). Furthermore, the conference tools process the duration of the conference, start and end (time) of participation in the conference, number of participants and other “context information” related to the communication process (metadata). Furthermore, the provider of the tool processes all the technical data required for the processing of the online communication. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or loudspeaker and the type of connection.
Should content be exchanged, uploaded, or otherwise made available within the tool, it is also stored on the servers of the tool provider. Such content includes, but is not limited to, cloud recordings, chat/ instant messages, voicemail uploaded photos and videos, files, whiteboards, and other information shared while using the service.
Please note that we do not have complete influence on the data processing procedures of the tools used. Our possibilities are largely determined by the corporate policy of the respective provider. Further information on data processing by the conference tools can be found in the data protection declarations of the tools used, and which we have listed below this text.
b. Purpose and legal bases
The conference tools are used to communicate with prospective or existing partners (Art. 6(1)(b) GDPR). Furthermore, the use of the tools serves to generally simplify and accelerate communication with us or our company (legitimate interest in the meaning of Art. 6(1)(f) GDPR). Insofar as consent has been requested, the tools in question will be used on the basis of this consent; the consent may be revoked at any time with effect from that date.
c. Conference tools used
We employ the following conference tools:
i. Zoom
We use Zoom. The provider of this service is Zoom Communications Inc, San Jose, 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA. For details on data processing, please refer to Zoom’s privacy policy: https://explore.zoom.us/en/privacy/. Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://explore.zoom.us/en/privacy/. We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.
ii. Google Meet
We use Google Meet. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For details on data processing, please see the Google privacy policy: https://policies.google.com/privacy?hl=en.
The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id =a2zt000000001L5AAI&status=Active
We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.
iii. Read AI
We use Read AI (Read AI, Inc.) as an AI-powered meeting assistant to support virtual meetings with external business partners. Read AI may join meetings to record audio, generate transcripts, create summaries, identify action items, and provide meeting analytics.
Where Read AI is used, participants will be informed that the meeting is being recorded and transcribed. Participation in a meeting involving Read AI is voluntary. If a participant does not wish to be recorded or transcribed, they may notify us in advance or during the meeting so that appropriate arrangements can be made.
The personal data processed by Read AI may include participants' names, email addresses, profile information, voice recordings, spoken content, meeting transcripts, chat messages, meeting metadata (such as date, duration, and participant list), and AI-generated summaries or action items. The processing of personal data is carried out for the purposes of documenting meetings, preparing accurate meeting minutes, facilitating follow-up actions, improving internal collaboration, and maintaining records of business communications. We do not pass these data on without your consent.
The legal basis for the processing is Article 6(1)(f) GDPR, based on our legitimate interest in efficiently documenting and managing business meetings. Where required by applicable law, recordings or transcriptions will only be made with the consent of the participants pursuant to Article 6(1)(a) GDPR.
Read AI processes personal data on our behalf pursuant to a data processing agreement (DPA) where applicable. If personal data is transferred to countries outside the European Economic Area (EEA), such transfers are carried out in accordance with applicable data protection laws and are subject to appropriate safeguards, including, where applicable, the European Commission's Standard Contractual Clauses or another valid transfer mechanism.
Meeting recordings, transcripts, and AI-generated summaries are retained only for as long as necessary for the purposes described above or as required by applicable legal retention obligations, after which they are securely deleted. You can request the deletion of your personal data at any time.
Further information on Read AI's processing of personal data is available in Read AI's Privacy Policy at https://www.read.ai/privacy-policy.
F. Rejection of unsolicited e-mails
We herewith object to the use of contact information published in conjunction with the mandatory information to be provided in our Site Notice to send us promotional and information material that we have not expressly requested. The operators of this website and its pages reserve the express right to take legal action in the event of the unsolicited sending of promotional information, for instance via SPAM messages.
