Privacy Policy
KORG Germany GmbH, Görlitzerstr. 52, 10997 Berlin (“KORG Germany“) operates the website www.korg.berlin (“Website“) on which it provides information about its offer and offers ways of contacting it.
The protection of personal data is very important to KORG Germany. The extent to which data is collected when visiting the website and using the services offered there, and the purpose for which it is processed, is explained in the following data protection declaration. KORG Germany complies with all applicable legal provisions on the protection of personal data and data security.
The legal basis for data processing for consents is Art. 6 para. 1 a), Art. 6 para. 1 b) GDPR, for the fulfilment of contractual obligations, Art. 6 para. 1 c) GDPR and for the safeguarding of legitimate interests Art. 6 para. 1 f) GDPR.
I. Name and contact details of the responsible person
The person responsible for processing personal data within the meaning of Art. 4 GDPR:
Tatsuya Takahashi
Görlitzerstr. 52
10997 Berlin
E-Mail: [email protected]
II. Type of data processed, purpose of processing and legal basis
In the following, we explain what kind of personal data is processed when visiting the website and using the offer. Processing in this sense means any form of use of the data, e.g. collection, recording, storage, provision, organisation, transmission, presentation, editing, deletion, reading or querying. Personal data is only processed to the extent that it is necessary for the provision of the offer, communication with users, the provision of services, the implementation of the contractual/business relationship as well as for the optimisation of business processes and the needs-based design of our services.
We observe the principle of data minimisation and only process your personal data in strict compliance with data protection regulations. In particular, corresponding data is only processed if a legal permission/legal basis exists.
1. Visiting the Website
Server Logfiles
With every access to the server on which the website https://korg.berlin/ is located, data, so-called server log files, are automatically collected. These server log files contain the IP address, directory protection user, browser information (type, version, possibly individual browser plug-ins installed), the operating system of the device (type, version), the device, the screen resolution, the click behaviour, the pages visited on the domain, the length of stay, date, time, logs, duration of visit and referrer. Location data is merely anonymised and recorded with limited accuracy (country/region/city), so that no conclusions can be drawn as to the identity of the site visitor. Additional personal data, such as names, are not collected.
This data is used to ensure the trouble-free operation of our website and to improve our offer. The processing is necessary to ensure the security and stability of the system and a comfortable use of the website. It is not possible to assign this data to a specific person.
We also use the log data for statistical evaluations, for the purpose of optimising the processes and the security of the services. We reserve the right to check the log data retrospectively if there are concrete indications of suspicion of illegal use of the service provided.
The legal basis for data processing is Art. 6 para. 1 b) and f) GDPR.
Cookies
Our website only uses cookies for the Shopify checkout. These cookies are technically necessary. Cookies are a short data package that is exchanged between computer programs or a text file that is stored on the visitor’s computer system. Session cookies are deleted after closing your browser, while persistent cookies remain on your end device and enable us to recognize your browser the next time you visit.
There are browser settings you can set to be informed about the setting of cookies and to decide individually whether to accept them or whether to exclude the acceptance of cookies in certain cases or in general, for example in the case of optional cookies. If cookies are not accepted, the functionality of our website may be restricted.
The legal basis for data processing is Art. 6 para. 1 b) and f) GDPR for cookies that are technically necessary for the operation of the website.
The legal basis for data processing for all other cookies that not technically necessary for the operation of the website is your consent according Art. 6 para. 1 a) GDPR.
2. Application form
We provide an application form in the form of a questionnaire to give you the opportunity to apply online for the positions advertised by us. The data entered in the input mask is processed by us. We ask for applicant data like personal data (like name, date of birth, nationality) contact details (like e-mail address, address, Visa status) information about your professional qualifications (like your CV, languages), your working methods and your skills and interests.
The participation in the application process and disclosure of personal data is voluntary.
The contact form allows you to contact us in a simple way. The collection of your e-mail address is essential in order to be able to answer your request. If additional data is processed, such as name, address or similar, the purpose of the processing is to individualise the respective user and thus to be able to respond to his or her request in the best possible way and to prevent any misuse of the contact form.
The legal basis for data processing is Art. 6 para. 1 a), b) and f) GDPR.
3. Other contact
If you contact us at the postal address, e-mail address or telephone number provided on our website, we will process the personal data provided by you – postal address, e-mail address, telephone number as well as your name and any other contact information provided – for the purpose of answering the enquiry.
In this case, the processing of your contact data is indispensable in order to get in touch with you and to be able to answer your request. If additional data is provided, the purpose of processing it is to individualise you so that we can respond to your request in the best possible way.
The legal basis for data processing is Art. 6 para. 1 a), b) and f) GDPR.
4. Newsletter
We offer a regular newsletter, which requires you to provide your e-mail address in order to receive it. Before the newsletter is sent, you must expressly confirm that you wish to receive our newsletter as part of the so-called double opt-in procedure. You will then receive a confirmation and authorisation e-mail with a link. If you click on this link, you confirm that you wish to receive the newsletter. This registration is logged in order to be able to legally prove the registration process.
You can unsubscribe from the newsletter at any time. The corresponding link can be found in every newsletter sent. Alternatively, you can revoke your consent by contacting us at [email protected].
In order to be able to prove your registration in our e-mail distribution list and to be able to defend ourselves against any accusations of unsolicited e-mails, the list provider stores the date of registration in the list as well as the IP address under which the registration was made. The IP address is not used for any other purpose.
The legal basis for data processing is Art. 6 para. 1 a) GDPR.
III. Duration of storage
Your data will be stored for as long as is necessary to fulfil the above-mentioned purposes.
As soon as this is no longer the case, e.g. after complete termination of the contractual/business relationship, including expiry of any existing warranty period, they will be deleted or blocked if and as long as commercial or tax retention obligations do not require further retention (Art. 6 para. 1 S. 1 lit. c) GDPR). From the point in time when legal storage obligations no longer conflict with this, the data will be deleted unless you have expressly consented to further use (Art. 6 para. 1 S. 1 lit. a) GDPR).
Personal data can also be manually deleted from the database at any time if requested.
Regarding your server logfiles: the IP-address is stored anonymously and is deleted after 60 days; information about the directory protection user used will be anonymized after one day; error logs that log pageview errors are deleted after seven days (in addition to the error messages, these include the accessing IP address and, depending on the error, the website accessed); access via FTP is logged with anonymized username and IP address and kept for 60 days.
IV. Transfer of data to third parties/ Transfer to third countries
Basically, the personal data you transmit will not be made available to third parties.
Within the KORG Group, data will only be forwarded to those responsible for personnel matters for the purpose of evaluating your application and deciding whether to cooperate with you. Since our 100% parent company of KORG INC. is based in 4015-2, Yanokuchi, Inagi-shi, Tokyo, 206-0812, Japan, your data might be transferred to the responsible person in Japan.
In individual cases, however, it may be necessary to pass on your personal data to companies that we entrust with the provision of individual services (e.g. webmaster, programmer, accounting).
Insofar as we disclose data to third parties in the context of our processing, transmit it to them or otherwise grant them access to the data, this will only be done on the basis of a legal permit, your consent, a legal obligation or on the basis of our legitimate interests. If we commission third parties to process data on the basis of a so-called ” Data Processing Agreement”, this is done on the basis of Art. 28 GDPR.
For their part, the third parties are obliged to comply with the legal regulations when handling and processing this data.
It is possible that the registered office of a third party is located in a third country, i.e. in a country in which the GDPR does not have direct legal effect. In this case, the transfer of data will only take place if your consent has been given, an adequate level of data protection prevails, for example due to individual agreements, the use of EU standard contractual clauses, the existence of an EU adequacy decision or if there is other legal permission.
Transmission to authorities and government institutions entitled to receive information is also possible, but only within the scope of the statutory disclosure obligations and in the event of a binding court decision. In such cases, KORG Germany may provide the information, e.g. to enforce, exercise and defend legal rights, enforce existing contracts, allege fraud, take security measures or generally enforce applicable laws, and if we disclose, transfer or otherwise provide access to data to third parties in the course of our processing, we may do so only on the basis of legal permission, your consent, a legal obligation or our legitimate interests.
Personal data will not be passed on outside the scope described here without express consent.
Under no circumstances will KORG Germany sell or rent personal data to third parties.
V. Third Party Services in the Operation of this Website
We would like to draw your attention separately to the following third-party providers whose services we use in the context of operating our website:
— InnoCraft Ltd, 7 Waterloo Quay PO625, 6140 Wellington, New Zeeland (“Matomo”)
— Shopify International Limited, Victoria Buildings, 2. Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Irland (“Shopify”)
— Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany („Brevo“)
We expressly point out that we ourselves have no influence on the extent of the data collected by these companies. Regarding the level of data protection, we must therefore rely on the privacy statements of the respective companies, on which the following clarification is based.
Please inform yourself about the purpose and scope of the data collection as well as your related rights and setting options for the protection of your privacy at the companies. We have listed the links to their privacy statements in the following.
Google, Facebook and Instagram operate under the Privacy Shield Agreement, which means that the requirements of the Privacy Shield Agreement are equivalent to the level of data protection in the European Union and that the data is treated accordingly.
In the following you will find information on possible data protection effects of the cooperation with these third parties as well as further links.
1. Matomo
We use the web analysis tool Matomo, self-hosted on our own servers (Matomo On-Premise). Matomo provides us with statistics about user behaviour on our website. Any data is stored directly by us and not passed on. This service is configured so that no cookies are set and all IP addresses are anonymised. Furthermore, no personal data such as order IDs are tracked and the data is not linked to other data or websites.
You can find out more about Matomo Cloud privacy policy here.
We have concluded a data processing agreement with Matomo.
2. Shopify
We use the shop system of Shopify for the purpose of displaying the online shop on the basis of processing on our behalf. All data collected via the online shop is processed on Shopify’s servers. Within the scope of the aforementioned services of Shopify, data may also be transmitted to Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Kanada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc. oder Shopify (USA) Inc. as part of further processing on behalf. In the event that data is transferred to Shopify Inc. in Canada, the appropriate level of data protection is guaranteed by adequacy decision of the European Commission. We would like to point out that the European Court of Justice has determined that there is currently no adequate level of protection for data transfers to the USA. Shopify uses standard contractual clauses as the basis for data processing in this case. These are intended to ensure that the European level of data protection is complied with.
Further information on Shopify’s data protection can be found at the following website:
https://www.shopify.com/de/legal/datenschutz
3. Brevo
We use the cloud-based newsletter management service Brevo to send our newsletter. This enables us to contact subscribers directly and inform them about news and offers. We also analyse your usage behaviour in order to optimise our offering. Brevo is the recipient of your personal data (email address, date of registration, IP address) and acts as a processor for us when it comes to sending our newsletter. A corresponding contract for commissioned data processing (Data Processing Addendum) has been concluded.
Further information on Brevo’s data protection can be found here, here and here.
VI. Online Presence / Company Profile in Social Media
Our company has online presences on LinkedIn and Instagram. This makes it easier for interested parties to search for our services and provides an additional channel of communication.
The purpose of the processing of user data by the respective social media and platforms is usually user-specific advertising, i.e. individualised advertising can be placed which corresponds to the presumed interests of the user or results from the user’s previous usage behaviour. For this purpose, cookies are stored on the end devices of the users. These cookies can save the usage behaviour and thus represent the areas of interest.
It is possible that the registered office of a social medium or platform is located in a third country, i.e. in a country in which the GDPR does not have direct legal effect. In this case, the transfer of data will only take place if your consent has been given, an adequate level of data protection prevails, for example due to individual agreements, the use of EU standard contractual clauses, the existence of an EU adequacy decision, or other legal permission exists.
We would like to make it clear that in the event of information requests and/or the assertion of other data subject rights, users should contact the respective third-party providers directly. They have insight and access rights to the user data stored and processed there and can provide information and/or take measures accordingly. If you contact us directly, we will try to support your request as best we can. However, since we have no insight into or access to the data stored by third-party providers, our options for action are limited. Please inform yourself about the data processing principles of the respective companies using the corresponding data protection statements.
Further information on the handling of user data can be found here: LinkedIn und Instagram
VII. Your rights as a data subject
As a data subject, you are entitled to the rights set out below. These rights result from the provisions of the General Data Protection Regulation and are reproduced here in a partially simplified form.
1. Right to withdraw the declaration of consent
Pursuant to Art. 7 para. 3 GDPR, you have the right to withdraw your consent to processing at any time. The lawfulness of the processing carried out on the basis of the consent until withdrawal is not affected. The right of withdrawal may be exercised by means of an informal declaration. A written declaration or alternatively an e-mail to the above contact address is sufficient.
2. Right of access
Pursuant to Art. 15 GDPR, you have the right to obtain confirmation from us as to whether personal data relating to you will be processed. If this is the case, you have a right to access to this personal data and the information specified in Art. 15 para. 1 GDPR. These include in particular the purpose of the processing, the categories of personal data concerned, the recipients to whom data have been or will be disclosed, as far as possible the envisaged duration of the storage or the criteria for the determination of the duration of the storage.
3. Right to rectification
Pursuant to Art. 16 GDPR, you have the right to obtain from us the rectification of any inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data – also by means of a supplementary statement.
4. Right to erasure
Pursuant to Art. 17 GDPR, you have the right to obtain from us the erasure of personal data concerning you without undue delay. We are obliged to delete personal data immediately if one of the provisions of Art. 17 para. 1 GDPR applies. One of these reasons is that the data are no longer necessary for the purposes for which they are collected or otherwise processed.
5. Right to restriction of processing
Pursuant to Art. 18 GDPR, you have the right to obtain from us the restriction of processing if one of the conditions set out in Art. 18 GDPR applies. This includes, for example, that you contest the accuracy of the personal data. Then we may process the data only to a limited extent as long as it takes to verify the accuracy of the personal data.
6. Right to data portability
Pursuant to Art. 20 GDPR, you have the right to receive the personal data concerning you which you have provided to us in a structured, commonly and machine-readable format. You have the right to transfer this data to another data controller, i.e. another entity that processes the data, without hindrance, if the original processing was based on consent or was necessary for the execution of a contract.
7. Right to object
Pursuant to Art. 21 GDPR, you have the right to object at any time to the processing of personal data concerning you if these data are processed on the basis of Art. 6 para. 1 e) or f) GDPR and there are reasons arising from your personal situation. The processing of data for the purpose of direct marketing can be objected to at any time. Personal data will then no longer be processed for this purpose. The right to object may be exercised by means of an informal declaration. A written declaration or alternatively an e-mail to the above contact address is sufficient.
8. Automated individual decision-making, including profiling
According to Art. 22 GDPR, you have the right not to be subject to a decision based solely on automated processing – including profiling – which has legal effect on you or similarly significantly affects you. Art. 22 para. 1 GDPR provides for exceptions to this rule, whereby Art. 22 para. 4 GDPR again contains some exceptions to withdrawal.
9. Right of appeal to a supervisory authority
Pursuant to Art. 77 GDPR, you have the right, without prejudice to any other administrative or non-judicial remedy, to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or place of presumed infringement, if you consider that the processing of your personal data is in breach of this Regulation.
In the present case, the competent supervisory authority is:
Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstraße 219, 10969 Berlin
Telephone: 030/13 889-0
Telefax: 030/215-5050
E-Mail: [email protected]
http://www.datenschutz-berlin.de
VIII. Technical and organisational measures
We take technical and organisational measures to ensure that the security and protection requirements of the GDPR are met and that personal data is protected against loss, destruction, manipulation or access by unauthorised persons. The measures are always adapted to the current state of the art.
IX. Changes to the Privacy Policy
We reserve the right to change this privacy policy at any time. You are requested to inform yourself regularly about the content of the data protection declaration.
Release January 2024
