Privacy policy

1. Introduction
With the following information, we would like to give you an overview of how Centuros processes your personal data and of your rights under data protection law. In principle, our website can be used without entering any additional personal data. However, if you provide personal data via our website, for example, or are in business contact with our company, it may become necessary to process further personal data.

The processing of personal data, such as your name, address or email address, is always carried out in accordance with applicable data protection law, in particular the General Data Protection Regulation (GDPR). With this privacy policy, we would like to create transparency for you and, depending on the processing situation, inform you in particular about the legal basis, scope and purpose of the personal data we process as well as about your rights.
2. Controller
The controller within the meaning of the GDPR is:

Centuros GmbH
Kurfürstenstraße 6
14467 Potsdam
Germany
3. Data protection officer
You can reach our data protection officer as follows:

Email: dsb@secjur.com

Phone: +49 941 569 550 20

You can contact our data protection officer directly at any time with any questions or suggestions regarding data protection and to exercise your rights under data protection law (see below).
4. Data collection when visiting the website/storage of log files
If you use our website for information purposes only, i.e. if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to our server (in so-called “server log files”). Each time a page is accessed, our server records a series of general data and information. This general data and information is stored in the server’s log files. The following may be recorded:

the browser types and versions used,
the operating system used by the accessing computer,
the website from which an accessing system reaches our website (so-called referrer),
the subpages accessed on our website by an accessing system,
the date and time of access to the website,
a shortened Internet Protocol address (anonymized IP address) and
the internet service provider of the accessing system.
When using this general data and information, we do not draw any conclusions about your person. Rather, this information is needed in order to

deliver the content of our website correctly,
optimize the content of our website and the advertising for it,
ensure the long-term functionality of our IT systems and the technology of our website, and
provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack.
The legal basis for data processing is our overriding legitimate interest within the meaning of Art. 6 (1) sentence 1 lit. f GDPR. We have a legitimate interest in being able to offer our services in a technically flawless manner.
The log files are deleted after 30 days at the latest.

The recipient of this data is our hosting provider, STRATO AG (Pascalstraße 10, 10587 Berlin, Germany), on whose infrastructure we operate our website.
5. Cookies
5.1 General information
We use cookies on our website. These are text files that your browser creates automatically and that are stored on your device when you visit our site. The cookie stores information that arises in connection with the specific device used.

You can adjust your cookie settings at any time using the “Cookie settings” button at the bottom right of the screen.
5.2 Technically necessary cookies
We use technically necessary cookies. These are cookies that are technically required to provide all the functions of our website.
5.2.1 Purpose of processing
We use technically necessary cookies for the following purposes:

to offer services,
to enable the use of our website functions,
to be able to store cookie settings and consents,
and to offer different languages.
5.2.2 Legal basis
The legal basis for data processing is our legitimate interest within the meaning of Art. 6 (1) sentence 1 lit. f GDPR. We have an overriding legitimate interest in being able to offer our services in a technically flawless manner.

5.2.3 Storage period
We delete your personal data as soon as it is no longer required to achieve the purpose for which it was collected. Technically necessary cookies are only stored for the respective session. When you leave our website and close your browser, the cookies are deleted.

5.2.4 Recipients of personal data
We use the following service providers:

Provider Address Third country Appropriate safeguard Further
information
Rapidmail GmbH Wentzingerstraße 21, 79106 Freiburg, Germany No Not required (EU) https://www.rapidmail.de/datenschutz
Intuition Machines, Inc. (hCaptcha) 350 Alabama St, San Francisco, CA 94110, USA Yes Standard contractual clauses https://www.hcaptcha.com/privacy
CookieYes Ltd. 3 Warren Yard, Wolverton Mill, Milton Keynes, MK12 5NW, UK UK Adequacy decision of the EU Commission
Link https://www.cookieyes.com/privacy-policy/


Use of hCaptcha
To protect our website from spam and abuse, we use the hCaptcha service of Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110, USA. hCaptcha analyzes the behavior of website visitors in order to distinguish between humans and bots. Personal data such as the IP address may be processed in the process. For more information, please see the hCaptcha privacy policy: https://www.hcaptcha.com/privacy.

Newsletter dispatch with Rapidmail
To send our newsletter, we use the service provider Rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg im Breisgau, Germany. Your email address is used exclusively for sending the newsletter. Registration takes place using the double opt-in procedure. You can withdraw your consent at any time, e.g. via the unsubscribe link in the newsletter. For more information, please see the Rapidmail privacy policy: https://www.rapidmail.de/datenschutz.
5.3 Analytics and marketing cookies
In addition to technically necessary cookies, we also use analytics and marketing cookies on our website in order to better understand the behavior of our users and continuously improve our online offering. Processing takes place exclusively on the basis of your consent in accordance with Art. 6 (1) lit. a GDPR, which you can give via our cookie banner.

Specifically, we use the following services:

Google Tag Manager
To manage website tags, we use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager itself does not set any cookies and does not collect any personal data. However, the tool can trigger other tags, which in turn collect and process data. Google Tag Manager does not access this data.
For more information on Google Tag Manager, please visit:
https://www.google.com/intl/de/tagmanager/faq.html
Google’s privacy policy can be found here:
https://policies.google.com/privacy?hl=de

Google Analytics
We use Google Analytics to analyze usage behavior on our website and to make targeted optimizations. The information obtained helps us to better tailor our offering to your needs and to align our marketing measures more effectively. Google Analytics is also integrated via Google Tag Manager.

The following data, among others, may be processed:

Anonymized IP address

Browser used and device settings

Device type

Internet provider

Pages visited

Time spent and click behavior (usage interactions)

Conversions

Page of origin (referrer URL)

Approximate location data (region)

We use Google Analytics with IP anonymization activated. This means that your IP address is shortened and thus anonymized within the EU or the EEA before it is transmitted to Google.

Google Site Kit
Our website uses the WordPress plugin Google Site Kit to seamlessly integrate Google services such as Analytics and Search Console. This may result in additional usage data being transmitted to Google. Here too, data processing takes place exclusively on the basis of your consent in accordance with Art. 6 (1) lit. a GDPR.

For more information on Google Site Kit, please visit:
https://sitekit.withgoogle.com/
5.3.1 Legal basis
The legal basis for data processing is your consent in accordance with Art. 6 (1) sentence 1 lit. a GDPR. The cookies are only set after you have given your consent via our cookie banner.

5.3.2 Purpose of processing
Reach measurement and tracking,
analysis of visitor behavior,
optimization of our offering,
and targeted advertising.
5.3.3 Storage period
We delete your personal data as soon as it is no longer required to achieve the purpose for which it was collected. The storage period of personal data depends on the providers used. In the case of Google, this is 14 months. The data is then generally deleted.

5.3.4 Recipients of personal data
We use the following service providers:

Provider Address Third country Appropriate safeguard Further
information
Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland USA Standard data protection clauses (link) Privacy Policy
Analytics Help
6. Contact options
If your inquiry is related to pre-contractual measures or to an existing contract with us, the legal basis is the performance of the contract and the implementation of pre-contractual measures in accordance with Art. 6 (1) sentence 1 lit. b GDPR.

If your inquiry is made independently of contractual or pre-contractual measures, our overriding legitimate interests in accordance with Art. 6 (1) sentence 1 lit. f GDPR constitute the legal basis. The overriding legitimate interest corresponds to the purposes stated above.

Our website offers you the option of contacting us by email or via our form.

When you contact us and we respond to your inquiry, we process the following personal data:

Name
Email
Date and time of the inquiry
IP address
Other personal data that you provide to us when contacting us.
6.2 Purpose of processing
We process your data in order to respond to your inquiry and to deal with any other matters arising from it.
6.3 Legal basis
If your inquiry is related to pre-contractual measures or to an existing contract with us, the legal basis is the performance of the contract and the implementation of pre-contractual measures in accordance with Art. 6 (1) sentence 1 lit. b GDPR.

6.4 Storage period
We delete your personal data as soon as it is no longer required to achieve the purpose for which it was collected. In the case of contact inquiries, this is generally the case when it is clear from the circumstances that the matter in question has been conclusively dealt with.
7. Applications
7.1 Description
On our website, we offer you the opportunity to apply for job vacancies and to send us your application online or by post.

7.2 Data processed
Master data (e.g. first and last name, address),
contact data (e.g. email address, telephone number),
application data (e.g. cover letter, CV, references and other certificates).
Special categories of personal data (e.g. health data, severe disability status, data on racial and ethnic origin).
7.3 Purpose of processing
Carrying out the application process and finding suitable applicants.

7.4 Legal basis
Performance of a contract and implementation of pre-contractual measures (Art. 6 (1) sentence 1 lit. b, Art. 88 (1) GDPR in conjunction with Section 26 (1) BDSG).
Consent (Art. 6 (1) sentence 1 lit. a GDPR). If we obtain your consent (e.g. for inclusion in our applicant pool), this constitutes the legal basis for data processing.
If special categories of personal data are processed, processing is carried out on the following bases:
Consent (Art. 9 (2) lit. a GDPR)
Preventive or occupational medicine, assessment of the employee’s working capacity, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services (Art. 9 (2) lit. h GDPR)
Exercise of rights and fulfillment of obligations arising from employment law and social security and social protection law by the controller or the data subject (Art. 9 (2) lit. c GDPR).
7.5 Storage period
If an employment relationship is established after the application process has been completed, the personal data provided may be processed further. Otherwise, we generally retain the data for six months. It is then deleted or disposed of in compliance with data protection regulations. Longer storage is possible if we include you in our applicant pool after obtaining your consent.
8. Social media presences
So that we can also communicate with you on social networks and inform you about our services, we are represented there with our own pages. If you visit one of our social media pages, we may be jointly responsible with the provider of the respective social media platform within the meaning of Art. 26 GDPR for the processing operations triggered thereby that concern personal data. We are not the original provider of these pages, but merely use them within the scope of the options offered to us by the respective providers. We would therefore like to point out as a precaution that your data may also be processed outside the European Union or the European Economic Area. Use may therefore entail data protection risks for you, as the protection of your rights, e.g. to information, erasure, objection, etc., may be more difficult, and processing on social networks is often carried out by the providers directly for advertising purposes or to analyze user behavior, without us being able to influence this. If the provider creates usage profiles, cookies are often used or usage behavior is assigned directly to your own member profile on the social network (if you are logged in there). The processing operations of personal data described are carried out in accordance with Art. 6 (1) sentence 1 lit. f) GDPR on the basis of our legitimate interest and the legitimate interest of the respective provider in being able to communicate with you in a contemporary manner and to inform you about our services. If you have to give your consent to data processing as a user with the respective providers, the legal basis is Art. 6 (1) sentence 1 lit. a) GDPR in conjunction with Art. 7 GDPR. As we do not have access to the providers’ databases, we would like to point out that you should best assert your rights (e.g. to information, rectification, erasure, etc.) directly with the respective provider. Further information on the processing of your data on social networks and on the possibility of exercising your right to object or withdraw consent (so-called opt-out) is listed below for each social network provider we use:

8.1 Xing
XING SE, Dammtorstraße 30, 20354 Hamburg, Germany

Privacy policy and opt-out option: https://privacy.xing.com/de/datenschutzerklaerung

8.2 LinkedIn
LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

You can find the link to LinkedIn’s privacy policy here: LinkedIn privacy notice
Cookie policy: https://www.linkedin.com/legal/cookie-policy


9. Rights of data subjects


9.1 Confirmation
You have the right to request confirmation from us as to whether personal data concerning you is being processed.

9.2 Access (Art. 15 GDPR)
You have the right to receive information from us free of charge at any time about the personal data stored about you, as well as a copy of this data, in accordance with the statutory provisions.
9.3 Rectification (Art. 16 GDPR)
You have the right to request the rectification of inaccurate personal data concerning you. Furthermore, taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data.

9.4 Erasure (Art. 17 GDPR)
You have the right to request that we erase personal data concerning you without undue delay if one of the legally stipulated grounds applies and insofar as processing or storage is not necessary.

9.5 Restriction of processing (Art. 18 GDPR)
You have the right to request that we restrict processing if one of the legal requirements is met.

9.6 Data portability (Art. 20 GDPR)
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, to whom the personal data was provided, provided that the processing is based on consent pursuant to Art. 6 (1) lit. a GDPR or Art. 9 (2) lit. a GDPR or on a contract pursuant to Art. 6 (1) lit. b GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability pursuant to Art. 20 (1) GDPR, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

9.7 Objection (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 (1) lit. e (data processing in the public interest) or f (data processing on the basis of a balancing of interests) GDPR.

This also applies to profiling based on these provisions within the meaning of Art. 4 No. 4 GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

In individual cases, we process personal data for direct marketing purposes. You can object at any time to the processing of personal data for the purpose of such marketing. This also applies to profiling insofar as it is related to such direct marketing. If you object to us processing your data for direct marketing purposes, we will no longer process the personal data for these purposes.

In addition, you have the right, on grounds relating to your particular situation, to object to the processing of personal data concerning you that we carry out for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 (1) GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you are free to exercise your right to object by automated means using technical specifications.

9.8 Withdrawal of consent under data protection law
You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.

9.9 Complaint to a supervisory authority
You have the right to lodge a complaint with a supervisory authority responsible for data protection about our processing of personal data.



10. Storage period of personal data


We process and store your personal data only for as long as is necessary for the purpose of storage or as required by law.

If the purpose of storage no longer applies or a prescribed storage period expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions. The criterion for the duration of storage of personal data is the respective statutory retention period. After expiry of this period, the corresponding data is routinely deleted, provided it is no longer required for the fulfillment or initiation of a contract.



11. Currency and changes to this privacy policy


This privacy policy is currently valid and was last updated in April 2025.

As we further develop our website and our services, or if legal or regulatory requirements change, it may become necessary to amend this privacy policy.