Privacy Policy

Welcome to our website. The protection of your data is very important to us. Therefore, we would like to inform you in the following which data of your visit we use for which purposes. If you have any further questions regarding the processing of your personal data, please do not hesitate to contact our data protection officer (contact details at the end of this privacy policy).

I. Controller

Responsible in the sense of the Data Protection Regulation (GDPR) for the use of your data in connection with this website is:

HIW Hamburg Invest Wirtschaftsförderungsgesellschaft mbH
Wexstraße 7
20355 Hamburg

On behalf of the Ministry of Economic Affairs and Innovation (BWI), Hamburg Invest Wirtschaftsförderung mbH together with Hamburg Innovation GmbH manages the development of the "Startup City Hamburg" platform. With regard to the processing of personal data on this website, Hamburg Invest Wirtschaftsförderung mbH is to be regarded as the controller, which commissions Hamburg Innovation GmbH with the technical operation of the website within the scope of processing on behalf of a controller pursuant to Art. 28 GDPR.

II. General information on data processing

1.     What is personal data?

The term personal data is defined in the General Data Protection Regulation (hereinafter "GDPR"). Accordingly, "personal data" is any information relating to an identified or identifiable natural person. This includes, for example, your civil name, your address, your telephone number or your date of birth. Information about your usage behavior on this website can also be personal data if it is possible to draw conclusions about your person from this information.

2.     Scope of the processing of personal data

As a matter of principle, we process personal data of our users only to the extent that this is necessary for the provision of a functional website as well as our content and services. The processing of personal data of our users is regularly only carried out after the consent of the user or if the processing is permitted by legal regulations.

3.     legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Article 6(1) sentence 1 lit. a) GDPR serves as the legal basis.

 When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6(1) sentence 1 lit. b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.

 Insofar as processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 (1) sentence 1 lit. c) GDPR serves as the legal basis.

 In the event that vital interests of the data subject or another natural person make processing of personal data necessary, Art. 6 (1) sentence 1 lit. d) GDPR serves as the legal basis.

 If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6 (1) sentence 1 lit. f) GDPR serves as the legal basis for the processing.

4.     Data deletion and data storage

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may take place beyond this if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.

III. Provision of the website and creation of log files

1.     Description and scope of data processing

 When accessing our website
- Browser type/version
- Operating system used
- Referrer URL (previously visited website), as well as pages accessed on our website
- IP address
- Date and time of server request
- Internet service provider

are logged. This data is also stored in the log files of our system. A storage of this data together with other personal data of the user does not take place.

2.     Legal basis for data processing

The legal basis for the storage of the data and the log files is Art. 6 (1) sentence 1 lit. f) GDPR.

3.     Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. The storage of data in log files is done to ensure the functionality of the website.

In addition, we use the data to optimize the website and to ensure the security of our information technology systems.

An evaluation of the data for marketing purposes does not take place in this context.

These purposes are also our legitimate interest in data processing according to Art. 6 (1) sentence 1 lit. f) GDPR.

4.     Duration of storage

The data stored by us will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. This is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible.

5.     Objection and removal possibility

The collection of the aforementioned data is mandatory for the operation of the website. Consequently, there is no possibility of objection on the part of the user.

IV. Use of cookies

1.     Description and scope of data processing

Our website uses various cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again. 

We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change.

The following data, for example, is stored and transmitted in the cookies:

- Language settings
- Items in a shopping cart
- Log-in information
- Cookie information banner that this website uses cookies

We also use cookies on our website that enable an analysis of the user's surfing behavior.

In this way, for example, the following data can be transmitted:

- Search terms entered
- Frequency of page views
- Use of website functions

2.     Legal basis of data processing

Insofar as we use cookies for analysis or marketing purposes, we process your data on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR and Section 25(1) TTDSG.

 For the use of technically necessary cookies, the legal basis is Art. 6 para. 1 sentence 1 lit f) GDPR and § 25 para. 2 no. 2 TTDSG (essential cookies). Further processing is carried out in each case in accordance with Art. 6 para. 1 DSGVO.

3.     Purpose of the data processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page change.

For example, we require cookies for the following applications:

a) Adoption of language settings
b) Remembering search terms
c) Saving the user's session in the browser.
d) Provide security functions of the website.
e) Store cookie settings of the user.
f) Enable functionality of the dealroom matching tool.
g) Store some details about the user, such as the unique visitor ID.
h) Store attribution information, i.e. the referrer originally used to visit the website.

Short-lived cookies used to temporarily store data for the visit. User data collected through technically necessary cookies are not used to create user profiles.

The analysis cookies are used for the purpose of improving the quality of our website and its content and so that you can use our services on the website more comfortably. Through the analysis cookies, we learn how the website is used and can thus constantly optimize our offer.

The so-called marketing cookies are used to show you personalized content, matching your interests.

4.     Duration of storage, possibility of objection and removal 

Hamburg Invest Wirtschaftsförderungsgesellschaft mbH offers you the possibility, within the framework of a consent management ("cookie banner"), to decide on the setting of cookies in the area of our offer according to your specifications. For more information on the individual services, the scope as well as the duration of data storage or to be able to view and manage your consent individually, you can call up our consent platform here and make your personal settings again!

Furthermore, you can disable or restrict the transfer of cookies by changing the settings in your Internet browser. Already stored cookies can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all functions of the website.

V. Use of Matomo

1.     Description and scope of data processing

Our website uses the web analytics service Matomo. Matomo is an open source project and is legally represented by its founder Matthieu Aubry. Matomo uses "cookies", through which an analysis of the use of the website becomes possible. For this purpose, the usage information collected in the cookie (including your shortened IP address) is transmitted to our server and stored for usage analysis purposes. Matomo does not transmit any data to servers that are outside of our control. Your IP address is immediately anonymized during this process, so that you as a user are not identifiable to us. The information collected about your use of this website is not shared with third parties.

2.     Legal basis

The legal basis for the use of Matomo is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR.

3.     Purposes of processing

We use the collected data for statistical analysis of user behavior for the purpose of optimizing the functionality and stability of the website and for marketing purposes.

4.     Duration of storage, possibility of objection and removal

For more information about Matomo and the possibility to revoke your consent, please click here: Edit Cookie Settings.

VI. Registration

1.     Description and scope of data processing

You can register at several places on our website using the form provided. Personal data that must be provided is marked as mandatory in the respective registration form, any additional information is voluntary.

We use the so-called double opt-in procedure for registration, i.e. your registration is only completed once you have confirmed your registration by clicking on the link contained in a confirmation e-mail sent to you for this purpose. If your confirmation is not received, your registration will be automatically deleted from our database after 7 days. After successful registration, you will receive a personal, password-protected access and will be able to view and manage your stored data. Registration is voluntary but may be a prerequisite for using certain of our services. 

2.     Legal basis for data processing

The legal basis for the processing of personal data is Art. 6(1) sentence 1 lit. a) and b) GDPR. You can delete your voluntarily provided information in your user account management on your own.

3.     Purpose of the data processing

The collection and subsequent processing and, if necessary, forwarding of your data is necessary for the fulfillment of the contracts you have requested or for the implementation of pre-contractual measures. 

Furthermore, your registration may be necessary for the provision of certain content and services on our website.

4.     Duration of storage

We delete the data as soon as they are no longer required to achieve the purpose for which they were collected.
This is the case for the data collected during the registration process when the registration on our website is cancelled or modified.

This is the case for the data collected during the registration process for the fulfillment of a contract or for the implementation of pre-contractual measures when the data is no longer necessary for the implementation of the contract. Even after the conclusion of the contract, there may be a need to store personal data of the contractual partner in order to fulfill contractual or legal obligations.

The job advertisements will be deleted after 90 days at the latest.

5.     Possibility of objection and removal

 You have the possibility at any time to cancel the registration or to have your data stored with us corrected.

 You can find out how to delete the registration from the controller and our data protection officer.

 If the data is required for the performance of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible insofar as contractual or legal obligations do not prevent deletion. 

VII. Contact form and e-mail contact

1.     Description and scope of data processing

Our website contains a contact form that can be used for electronic contact. If a user takes advantage of this option, the data entered in the input mask is transmitted to us and stored.

When you contact us by e-mail or via a contact form, the data you provide (your e-mail address, name and telephone number, if applicable) will be stored by us in order to answer your questions and process your requests.

At the time of sending the message, the following data is also stored:

a) The IP address of the user
b) Date and time

Alternatively, it is possible to contact us via the e-mail address provided. In this case, the user's personal data transmitted with the e-mail will be stored.

If you provide us with information regarding your communication channels (e.g. e-mail address, telephone number), we will only use this information to respond to your request.

In this context, the data will not be passed on to third parties. The data is used exclusively for processing the conversation.

2.     Legal basis for data processing

The legal basis for processing the data that you transmit to us in the course of contacting us is Art. 6 (1) sentence 1 lit. f) GDPR.

Insofar as we request input via our contact form that is not required for contacting us, we have always marked this as optional. This information serves us to specify your request and to improve the processing of your request. A communication of this information is expressly on a voluntary basis and with your consent, Art. 6 paragraph 1 sentence 1 lit. a) GDPR.

If the e-mail contact aims at the conclusion of a contract, the additional legal basis for the processing of the data is Art. 6 (1) sentence 1 lit. b) GDPR.

3.     Purpose of the data processing

The processing of the personal data from the input mask serves us solely to process the contact. In the case of contact by e-mail, this also constitutes the necessary legitimate interest in processing the data.

The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

4.     Duration of storage

The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it is clear from the circumstances that the matter in question has been conclusively clarified.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

5.     Possibility of objection and removal

The user has the possibility to withdraw his consent to the processing of personal data at any time. If the user contacts us by e-mail, he can object to the storage of his personal data at any time. In such a case, the conversation cannot be continued.

All personal data stored in the course of contacting us will be deleted in this case.

VIII. Use of OpenStreetMap

On our website, we integrate the maps of the OpenStreetMap Foundation service via the API of Geoapify GmbH (https://wiki.osmfoundation.org/wiki/Main_Page). As a Google Maps alternative, OpenStreetMap is an open source JavaScript library that allows us to embed interactive maps on our website. For the correct display of the maps, it is necessary from a technical point of view to make requests to the server.arcgisonline.com. Through these requests, it is generally possible that information about your use of this website (including your IP address and location data) is transmitted to other servers and stored there. The legal basis for the use of OpenStreetMap is Art. 6 (1) sentence 1 lit. f) GDPR and § 25 (2) sentence 1 no. 2 TTDSG.

To our knowledge, user data is used by OpenStreetMap solely for the purpose of displaying the map functions and temporarily storing the selected settings. Further information on OpenStreetMap and the respective storage period of the collected data can be obtained from the provider or at www.openstreetmap.de/faq.html or https://wiki.osmfoundation.org/wiki/Privacy_Policy. More information on the API used by Geoapify can be found at https://www.geoapify.com/privacy-policy.

IX. Use of Maptiler

We use the map service MapTiler from MapTiler AG, Höfnerstrasse 98, Unterägeri, Zug 6314, Switzerland, on this website to enable a search and filter function within the map modules.

To use the functions of Maptiler, it is necessary to store your IP address. The IP addresses of MapTiler Cloud visitors are only stored for a limited time, a maximum of 20 minutes, and then automatically destroyed. The collection and short-term storage are necessary for logging security-related activities on the MapTiler infrastructure. The legal basis for the data processing is Art. 6 (1) sentence 1 lit. f) GDPR and § 25 (2) sentence 1 no. 2 TTDSG.

X. Two-click solution for the integration of Youtube

1.     Description and scope of data processing

We are interested in providing you with a wide range of multimedia information. Therefore, we integrate videos from YouTube (YouTube LLC, 901 Cherry Ave. San Bruno, CA 94066 USA). YouTube, LLC is a subsidiary of Google Inc, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

YouTube is an Internet video portal that allows video publishers to post video clips free of charge and other users to view, rate and comment on them, also free of charge. YouTube allows the publication of all types of videos, which is why complete film and television shows, but also music videos, trailers or videos made by users themselves can be accessed via the Internet portal.

In order to view our videos, users must first click on the preview image. Only after clicking away the hint or logging in, the video can be watched.

The integration of YouTube videos takes place in the extended data protection mode or the no-cookie solution, which means that cookies and pixel tags for the personalization of advertising and search results are not set by YouTube until the video is played.

When the YouTube video is played, the following data is transmitted to Google as YouTube operator:

- the IP address,
- the specific address of the page accessed on our site,
- the transmitted identifier of the browser as well as
- system date and time of the call,
- already existing cookies, via which your browser can be clearly identified.

Google as the operator of YouTube is exclusively responsible for this data processing. You can find more information here: policies.google.com/privacy.

We would like to point out that Google may receive further data via cookies already stored on your computer. To what extent these are utilized by Google is beyond our control.

You can find YouTube's privacy policy here: https://policies.google.com/privacy?hl=de&gl=de

2.     Legal basis for data processing

The legal basis for the collection and disclosure of users' personal data is Art. 6 (1) sentence 1 lit. f GDPR. We have no influence on the processing of your personal data by Google.

3.     Purpose of data processing

The purpose of data processing is to provide a wide range of multimedia information.

4.     Duration of storage

Information on the duration of storage can be found in YouTube's privacy policy:

https://policies.google.com/privacy?hl=de&gl=de

5.     Objection possibility

If you do not wish Google to process your data via this service, you can deactivate the use of JavaScript in your browser settings. Please note that in this case, the videos embedded via YouTube can no longer be accessed.

XI. Data transfer to Dealroom 

1.     Description and scope of data processing

Dealroom.com B.V. ("Dealroom", Cornelis Dirkszstraat 27-2, 1056 TP Amsterdam, Netherlands) acts on the one hand as a data provider for the platform and provides data on demand for us via API. In principle, no personal data is transferred from Dealroom to us via the API of Dealroom.

In addition, Dealroom cookie is set on this page.

More information on data protection can be found here: https://dealroom.co/privacy-policy.

2.     Legal basis of data processing

The legal basis for the transfer of personal data to Dealroom is consent in accordance with Art. 6 (1) p. 1 lit. a) GDPR

3.     Definition of a verified startup:

A verified startup is a startup that has been manually checked by a dealroom analyst or a moderator. Dealroom has several algorithms that help detect the companies to be verified with priorities (claimed startups, startups with a high completion rate).

XII. Landing Page for the Office for IT and Digitalisation of the City of Hamburg (GovTecHH project)

1) Description and scope of data processing

Via the form "GovTecHH contact form" you have the possibility to enter the following data: Name, email address, telephone number, company name as well as the details listed in more detail in the form, such as a company description, year of foundation, etc. This data and information will be stored by us and transmitted to the 'Amt für IT und Digitalisierung der Stadt Hamburg (Projekt GovTecHH)'.

The data will not be passed on to other third parties in this context. We also use the double-opt-in procedure for registration for forwarding to the 'Amt für IT und Digitalisierung der Stadt Hamburg (Projekt GovTecHH)'. If your confirmation is not received, your registration will be deleted from our database after a period of 30 days.

2) Legal basis for data processing

The legal basis for data processing is your consent in accordance with Art. 6 para. 1 p. 1 lit. a DSGVO.

3) Purpose of data processing

Your data will be passed on to the 'Amt für IT und Digitalisierung der Stadt Hamburg (Projekt GovTecHH)' with the aim of establishing contact and further examining cooperation in the sense of a matching process between new types of problems in the specialist areas of the administration and suitable startup solutions. The `Amt für IT und Digitalisierung der Stadt Hamburg (Projekt GovTecHH)´ receives an initial impression of the company/startup through the detailed information provided, such as a sent pitch deck and other information.

4) Duration of storage

After passing on your data to the 'Amt für IT und Digitalisierung der Stadt Hamburg (Projekt GovTecHH)', we store your data for 7 days. After that, they will be deleted automatically.

5) Possibility of revocation

You can revoke your consent at any time. To do so, you can contact our data protection officer by e-mail, for example. However, please bear in mind that it will no longer be possible for us to delete the data after it has been passed on to the 'Amt für IT und Digitalisierung der Stadt Hamburg (Projekt GovTecHH)'. In case of doubt, the `Amt für IT und Digitalisierung der Stadt Hamburg (Projekt GovTecHH)´ will then have to be contacted directly, and we will forward revocations addressed to us to the `Amt für IT und Digitalisierung der Stadt Hamburg (Projekt GovTecHH)´.

Note on deletion: Among other things, you have the right to revoke your consent at any time. In this case, your data stored with us will be deleted immediately. To do so, please contact our data protection officer at datenschutz@hamburg-invest.com. Please note, however, that the data can only be deleted until it is passed on to the 'Amt für IT und Digitalisierung der Stadt Hamburg (Projekt GovTecHH)'. Data will only be forwarded to 'Amt für IT und Digitalisierung der Stadt Hamburg (Projekt GovTecHH)' after confirmation (verification) of the email address.

XIII. Newsletter 

You can subscribe to our newsletter on our website. The newsletter will inform you about the latest news and stories from the startup ecosystem in Hamburg. The legal basis for sending the respective newsletter is your consent in accordance with Article 6 (1) (a) GDPR.

Registration for our newsletter takes place in a so-called double opt-in procedure. This means that after signing up, you will receive an e-mail asking you to confirm your registration. This confirmation is necessary to prevent anyone from signing up with other people's email addresses.

The newsletter will only be sent after explicit confirmation by clicking on the link in the confirmation e-mail. If you do not confirm your registration, your information will be automatically deleted after 3 days.

After your confirmation, we will store your e-mail address for the purpose of sending you the newsletter until you cancel your subscription. We also store your current IP address at the time of registration, the time of registration and the confirmation for up to three years after registration (limitation period). The purpose of this procedure is to be able to prove your registration in case of doubt and, if necessary, to clarify any misuse of your personal data. The legal basis for logging the registration is our legitimate interest pursuant to Article 6 (1) (f) GDPR in providing evidence of a previously given consent, see also Article 7 (1) GDPR.

You can withdraw your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare your cancellation by clicking on the link provided in every newsletter e-mail.

Your data processed in connection with the sending of the newsletter will be used exclusively for sending the newsletter and will not be passed on to third parties. An exception exists if there is a legal obligation to pass on the data.

Data will not be transferred to third countries.

Newsletter-Tracking

We do not create any personal user profiles for subscribers to our newsletter. We have activated the data protection compliance function in our newsletter dispatch software. This means that we only receive anonymised reports on the newsletter recipients who open and click on the newsletter.

Activating data protection compliance also prevents the collection and processing of full IP addresses and cookies.

Newsletter tracking is used to statistically analyse the success or failure of online marketing campaigns. This allows us to track whether and when an email is opened and which links in the email are clicked on. Newsletter tracking is also used to improve and optimise the newsletter.

As part of the registration process, your consent is obtained for this by means of a double opt-in procedure. The legal basis for the processing of data after registration for the newsletter is Article 6 (1) (a) GDPR.

The data stored by us as part of your consent for the purpose of the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted at the latest after a period of seven days after cancellation of the newsletter. Data stored by us for other purposes (e.g. email addresses for the member area) remain unaffected by this. 

You can withdraw your consent to newsletter tracking at any time by unsubscribing from the newsletter. You can declare your cancellation by clicking on the link provided in every newsletter email.

XIV. Data security 

We use technical and organizational security measures to protect your data processed by us against accidental or intentional manipulation, loss, destruction or against access by unauthorized persons. Our security measures are continuously improved in line with technological developments.

XV. Rights of the data subjects 

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights towards the controller: 

We will gladly provide you with information as to whether and which personal data of yours is processed by us and for which purposes (Art. 15 GDPR). In addition, you have the right to rectification (Art. 16 GDPR), the right to restriction of processing (Art. 18 GDPR), the right to erasure (Art. 17 GDPR) and the right to data portability (Art. 20 GDPR) under the respective legal conditions.

You have the right to object to processing under the legal conditions (Art. 21 GDPR).

To exercise your above rights, please contact us by e-mail at datenschutz@hamburg-invest.com or by post (Hamburg Invest Wirtschaftsförderungsgesellschaft mbH GmbH, Wexstraße 7, 20355 Hamburg).

The exercise of your above rights is free of charge for you.

Without prejudice to these rights and the possibility of seeking any other administrative or judicial remedy, you may at any time exercise your right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes data protection law (Article 77 GDPR).

The supervisory authority responsible for us is: The Hamburg Commissioner for Data Protection and Information Security.

XVI. Changes to the data protection declaration

This data protection declaration is continuously adapted in the course of further development of the Internet or our offer. We will announce any changes on this page in good time. In order to be informed about the current status of our data usage regulations, this page should be called up regularly.

XVII. Contact data protection officer

Attn: external data protection officer of Hamburg Invest Wirtschaftsförderungsgesellschaft mbH

intersoft consulting services AG
Beim Strohhause 17
20097 Hamburg

Phone: +49 (0) 40 790 235 0
E-mail: datenschutz@hamburg-invest.com