Data Protection Policy
We at USU are delighted at your interest in our Internet presence and our services. Protection of personal data has a particularly high priority for us. This policy aims to inform you about whether and how personal data is collected and processed in connection with the use of our Internet presence and about your rights as a data subject in this context.
As the controller, USU Software AG has implemented numerous technical and organizational measures to ensure that personal data processed on this website is protected as fully as possible. Nevertheless, data transfers over the Internet may fundamentally have security loopholes, and thus total protection cannot be guaranteed.
With regard to the use of our website www.usu.com and its subpages, as well as the linked websites and social media presences of USU Group companies, the controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection legislation applicable to us is:
USU Software AG
Phone: +49 7141 4867 0
Fax: +49 7141 4867-200
If personal data is transmitted to us over our website, we use numerous secure technologies, in particular the Transport Layer Security (TSL) and Secure Socket Layer (SSL) transfer protocols. All information and data transferred using these secure methods is encrypted before being sent to us. The IP address of the system used to call the website is transmitted to us so that our users – and USU as well – are protected against misuse.
Whenever it is called, our website records a number of items of general data and information that are stored in the server’s log files. The following may be recorded:
We do not use this general data and information to identify the data subject. This information is required instead (1) to deliver our website’s content correctly, (2) to optimize our website’s content and advertising for it, (3) to ensure that our IT systems and our website’s technology keep running properly, and (4) to provide law-enforcement authorities with the information required to prosecute any cyberattacks that occur. This data and information, which is collected anonymously, is therefore analyzed statistically, in part with the objective of increasing data protection and data security at our company and thus ultimately ensuring an ideal level of protection for the personal data we process. The anonymous data in the server log files is stored separately from all personal data provided by a data subject.
Data subjects can prevent cookies from being placed by our website at any time by making the relevant settings in their web browsers and thus permanently objecting to the placement of cookies. They can also, at any time, delete cookies that have already been placed by using their web browsers or other software programs. This is possible in all common web browsers. If data subjects disable cookies in their web browsers, they may not be able to use all the functions of our website in full.
Data subjects can register on our website, which involves providing personal data. The personal data sent to us is defined in the input screen used for registration, and once entered it is collected and stored solely for the specified purpose. We can transmit it to one or more processors so that it can be processed as stipulated, or to a USU Group company, if that is necessary to fulfill the specified purpose. If data subjects register on our website, the IP address assigned by their Internet service providers (ISP) to the system they use is stored along with the date and time of registration. This data is stored because it is the only means of preventing misuse of our services and so that it can be used to investigate criminal acts, if necessary; in this respect, the storage of this data is necessary as a safeguard for the controller. By registering and voluntarily disclosing their personal data, data subjects help us offer them content or services which, due to their nature, can only be offered to registered users.
Users can subscribe to newsletters on our website. The personal data sent to us when a newsletter is ordered is as defined in the input screen used for subscribing. USU regularly informs its customers and prospects about what the company has to offer by means of a newsletter. Data subjects can only receive the newsletter if (1) they have a valid e-mail address and (2) they have registered for the newsletter or have an active contractual relationship with USU and the newsletter in question contains information of relevance to the contractual partner. The law requires us to send a confirmation message to the e-mail address the data subject has specified when subscribing to the newsletter (double opt-in method). This confirmation message helps us verify that the owner of the e-mail address is the data subject and has authorized receipt of the newsletter.
If data subjects register for the newsletter, we also store the IP address assigned by their Internet service providers (ISP) to the system they used at the time of registration, as well as the date and time of registration. This data must be collected in order to ascertain any (possible) misuse of a data subject’s e-mail address at a later time, and thus is a legal safeguard for the controller.
The personal data collected during registration for the newsletter is used solely for sending out the newsletter. In addition, newsletter subscribers can be notified by e-mail if this is necessary for the operation of the newsletter service or if registration is required, such as may be the case if there are changes in the newsletter offer or technical circumstances. The personal data collected as part of the newsletter service is not transmitted to third parties, with the exception of the persons responsible for the newsletter’s contents at the USU Group. Data subjects can cancel their subscriptions to the newsletter at any time. Data subjects can, at any time, withdraw their consent to storage of personal data they have given us (solely) for newsletter distribution. Every newsletter contains a link that can be used to withdraw consent. Data subjects can also cancel their subscriptions to the newsletter at any time directly on the controller’s website or use other means to notify the controller of their requests to cancel it.
USU’s newsletters contain tracking pixels. A tracking pixel is a miniature graphic that is embedded in e-mails sent in HTML format to enable recording and analysis of log files. This permits statistical evaluation of the success or lack of success of online marketing campaigns. The embedded tracking pixel allows USU to recognize whether and when a data subject has opened an e-mail message and what links in the e-mail were called. We store and analyze the personal data collected by tracking pixels contained in the newsletters in order to optimize newsletter distribution and tailor the content of future newsletters even better to the interests of the data subject. However, data subjects can, at any time, withdraw the separate consent they have given to this practice, which uses the double opt-in method. When a subscription to the newsletter is canceled, USU automatically interprets that as a withdrawal of such consent.
In order to constantly improve our website, we use the web analysis service Lucky Orange. Lucky Orange creates heat maps and records based on the click behaviour of website visitors. With the help of this information we are able to identify and resolve problems with the use of our websites and thus provide a better user experience. Cookies are stored on your computer for analysis purposes. The storage of cookies can be prevented in the settings of your web browser. IP addresses are anonymized so that an exact identification is impossible.
If you would like to object to tracking by Lucky Orange, you can exclude yourself from tracking at any time via the following link: https://privacy.luckyorange.com
In compliance with statutory requirements, our website contains information that enables rapid electronic contact with us and allows the other USU Group companies to communicate directly with us. That information likewise comprises a general e-mail address. If data subjects contact the controller by e-mail or using a contact form, the personal data they send is automatically stored. Personal data given to the controller voluntarily in this way is stored so that the request can be handled or the data subject contacted.
On our website, we offer users the possibility of leaving individual comments on individual posts in a blog there. A blog is a portal on a website that can usually be viewed by the public and in which one or more persons (called bloggers) post articles or write down their thoughts in what are termed blog posts. Third parties can usually submit comments to the blog posts. If data subjects leave comments in the blog on our website, the comments they leave, as well as details of the time they entered them and their chosen user names (pseudonym), are stored and published. The IP address assigned by the Internet service provider (ISP) to the data subject’s system is also logged. The IP address is stored for security reasons and for the eventuality that a data subject submits a comment that infringes third-party rights or posts unlawful content. In other words, this personal data is stored in the controller’s interests as exculpatory evidence in the event of a violation of the law and is not transmitted to third parties unless prescribed by law or to help the controller defend against legal action.
We would like to point out that the USA is assessed by the European Court of Justice as a country with an insufficient level of data protection according to EU standards. When your data is processed by Google in the USA, for example, there is a risk that data may be viewed by US authorities. Within the scope of our possibilities, we also take measures to counter these risks as far as possible.
The above data processing, including the transfer of data to Google, will only take place after your active consent to this data processing for the purpose of providing the content, so that the basis for this is your consent in accordance with Article 6 (1) subparagraph 1 letter a) DSGVO. This consent can be revoked at any time with effect for the future; please bear in mind that the data processing by Google that took place before the revocation is not affected by this.
If and to the extent that data is additionally transferred to the USA, we will take the precautions within our power to ensure adequate protection for the data transfer in accordance with Art. 44 ff. DSGVO, for example by agreeing to the standard data protection clauses of the EU Commission pursuant to Article 46(2)(c) DSGVO and, if necessary, additional measures.
The component Google Analytics (with an anonymization function) is integrated in our website. Google Analytics is a web analytics service. Web analytics is the collection, gathering and analysis of data on the behavior of visitors on websites. Among other things, a web analytics service records data on the website from which a data subject accesses a website (referrer), which subpages on the website are accessed, or how often and for how long a subpage was viewed. Web analytics is mainly used to optimize a website and to conduct a cost-benefit assessment of Internet advertising. The operator of the Google Analytics component is the company Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043-1351, USA. We use Google Analytics with the “_gat._anonymizeIp” extension. With this extension, Google truncates and anonymizes the IP address of the system used by the data subject if our website is accessed from a Member State of the European Union or another country that is party to the Agreement on the European Economic Area.
The purpose of the Google Analytics component is to analyze visitor flows on our website. Among other things, Google uses the data and information it gathers for evaluating the use of our website, compiling online reports on activities on our web pages for us, and providing services related to the use of our website. Google Analytics places a cookie on the data subject’s IT system. Cookies have already been explained above. Placement of the cookie enables Google to analyze the use of our website. Whenever a data subject calls an individual page of our website that we operate and on which a Google Analytics component has been integrated, the web browser on the data subject’s IT system is automatically prompted by the Google Analytics component to transmit data to Google for the purpose of online analysis. As part of that technical process, Google gains knowledge of personal data, such as the IP address of the system used by the data subject. This helps Google trace the origin of visitors and clicks and thus, for example, enable commission to be charged. The cookie is used to store personal information, such as the time at and place from where our website was accessed and how often the data subject visited it. Whenever our web pages are visited, this personal data (including the IP address of the system used by the data subject) is transferred to Google in the United States of America and stored by Google there. Google may transmit the personal data collected by this technical method to third parties.
As described above, data subjects can, at any time, prevent cookies from being placed by our website by making the relevant settings in their web browsers and thus permanently objecting to the placement of cookies. Such a setting in the web browser would also prevent Google from placing a cookie on the data subject’s IT system. In addition, a cookie that has already been placed by Google Analytics can be deleted at any time in the web browser or by using other software programs.
USU’s website contains links to other websites. By clicking these links, you leave the USU website. The presence of these links on USU’s website does not mean that USU supports, promotes or claims ownership of the sites to which we provide links. These linked sites are beyond the control of USU and USU accepts no responsibility for these linked websites, in particular for their content, their data protection and privacy policies or any possible transmission of data by them.
Under the following links, you can view the data privacy policies of the social media channels that have links on our websites:
You can find our service providers recorded as part of the consent to the processing of personal data here:
Email Marketing & CRM
Webinars & Online Events
Cookie Consent Manager
Ads & Tracking
Hosting & Service provider
You can find an overview of our partners here.
The Gartner Peer Insights Customer First badge is a trademark and service mark of Gartner, Inc., and/or its affiliates, and is used herein with permission. The Gartner Peer Insights Customer First program constitutes an organization's commitment to solicit reviews from its customers using programmatic sourcing strategies and best practices. They neither represent the views of, nor constitute an endorsement by, Gartner or its affiliates.
We collect and process personal data from job applicants so as to handle the application process for all companies belonging to the USU Group. That may also be done electronically. That is the case in particular when applicants send their application documents to the controller electronically, such as by e-mail or using a form on the website. If the controller concludes an employment contract with an applicant, the data provided is stored for use as part of the employment relationship in compliance with statutory provisions. If the controller does not conclude an employment contract with an applicant, the application documents are destroyed or erased when a decision to reject the applicant is made, unless the controller has other legitimate interests for not doing do. A legitimate interest here is, for example, the requirement of furnishing proof in the event of possible legal action under the German General Act on Equal Treatment (AGG).
Personal data is collected and processed as part of commissions on the basis of the requirements for the specific commission and is usually done by the respective USU Group company itself as the controller. In this regard, any processing activities by USU Software AG are carried out solely in its capacity as a “processor.”
The criterion for storing personal data is the respective statutory retention period. When this period ends, the data in question is routinely deleted, if and to the degree that it is no longer required to perform a contract or steps prior to a contract. However, data will continue to be stored if the data subject’s interests in having the data deleted are overridden by the legitimate interests of the controller, such as to safeguard its means of defending against legal action and indemnity insurance cover for potential rights of recourse by customers and/or data subjects where the period of limitation has not yet expired. If there is no such legitimate interest, this data is also routinely erased.
Data subjects have the right to:
If your personal data is processed to safeguard legitimate interests in accordance with Article 6 (1) sentence 1 (f) GDPR, data subjects have the right under Article 21 GDPR to object to processing of their personal data if there are grounds relating to their particular situation or the objection is to direct marketing. In the latter case, data subjects have a general right to object and we will comply with that right without any need for them to specify grounds relating to their particular situation. If you wish to make use of your right to revoke your consent or object to processing, simply send an e-mail to: webteam(at)usu.com
The contact data of our Data Protection Officer is:
USU Software AG
Datenschutzbeauftragter (Data Protection Officer)
Phone: +49 7141 4867 0