Privacy Policy

Download privacy policy as PDF

1. Definitions

This privacy policy uses the terms of the GDPR. It is intended to be easy to read and understand for the public as well as for our customers and business partners. We explain the most important terms below:

a) Personal data: any information relating to an identified or identifiable natural person (the “data subject”). b) Data subject: any identified or identifiable natural person whose personal data is processed. c) Processing: any operation involving personal data, such as collection, recording, storage, alteration, retrieval, use, disclosure, restriction, erasure or destruction. d) Restriction of processing: the marking of stored personal data with the aim of limiting its future processing. e) Profiling: any automated processing using personal data to evaluate, analyse or predict personal aspects of a natural person. f) Pseudonymisation: processing in such a way that the data can no longer be attributed to a data subject without additional, separately kept information. g) Controller: the natural or legal person that alone or jointly with others determines the purposes and means of processing. h) Processor: an entity that processes personal data on behalf of the controller. i) Recipient: an entity to which personal data is disclosed. j) Third party: an entity other than the data subject, the controller and the processor. k) Consent: any freely given, informed and unambiguous indication of the data subject’s wishes regarding the processing of their data.

2. Controller

The controller within the meaning of the GDPR and other data protection provisions is:

IMT-Systems GmbH

Alfred-Herrhausen-Allee 3-5, 65760 Eschborn, Germany

Tel.: +49 6196-20210890

Email: data-protection@imt-systems.com

Website: https://www.imt-systems.com

3. Cookies

Our websites use cookies. Cookies are text files stored on a computer system via an internet browser. Many cookies contain a cookie ID, a unique identifier by which websites and servers can be assigned to the browser in which the cookie was stored.

By using cookies, we can provide more user-friendly services. The data subject can prevent the setting of cookies at any time via the browser settings or delete cookies already set. If cookies are deactivated, not all functions of the website may be fully usable.

4. Collection of General Data and Information (Server Log Files)

Each time the website is accessed, our system automatically collects a series of general data and information that is stored in the server log files. The following may be recorded:

• browser types and versions used,
• the operating system of the accessing system,
• the website from which an accessing system reaches our site (referrer),
• the sub-pages accessed,
• the date and time of access,
• the IP address,
• the internet service provider of the accessing system,
• other similar data used to avert danger in the event of attacks on our IT systems. We do not draw any conclusions about the data subject from this data. The information is needed to deliver and optimise the content of our website, to ensure the long-term functionality of our systems and, in the event of a cyber-attack, to provide law enforcement authorities with the necessary information. The legal basis is Article 6(1)(f) GDPR (legitimate interest in security and functionality). The anonymous log file data is stored separately from any personal data provided by a data subject.

5. Contact Option via the Website

Our website contains information that enables quick electronic contact, including an email address. If a data subject contacts us by email or contact form, the personal data transmitted is stored for the purpose of processing or contacting the data subject. This data is not passed on to third parties. The legal basis is Article 6(1)(f) GDPR (legitimate interest in responding to enquiries) or – where the enquiry aims at concluding a contract – Article 6(1)(b) GDPR.

5.1 Protection of the Contact Form by hCaptcha

To protect our contact form against automated input (spam, misuse), we use the hCaptcha service. The provider is Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110, USA. hCaptcha checks whether the input is made by a human and analyses various information (e.g. IP address, device and browser data and user behaviour when interacting with the form). The data collected is transmitted to and processed by Intuition Machines.

The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in protecting our website against abusive automated use and spam. Where data is transferred to the USA, this is based on the EU Commission’s standard contractual clauses. Further information: https://www.hcaptcha.com/privacy and https://www.hcaptcha.com/terms.

6. Routine Erasure and Blocking of Personal Data

We process and store personal data only for the period necessary to achieve the purpose of storage, or where statutory provisions so provide. If the purpose of storage ceases to apply or a prescribed storage period expires, the data is routinely blocked or erased in accordance with statutory provisions.

7. Rights of the Data Subject

a) Right to confirmation as to whether personal data concerning them is being processed. b) Right of access to the stored personal data and a copy thereof (Article 15 GDPR). c) Right to rectification of inaccurate data (Article 16 GDPR). d) Right to erasure (“right to be forgotten”) pursuant to Article 17 GDPR. e) Right to restriction of processing pursuant to Article 18 GDPR. f) Right to data portability in a structured, commonly used and machine-readable format (Article 20 GDPR). g) Right to object to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR). h) Right not to be subject to a decision based solely on automated processing – including profiling (Article 22 GDPR). i) Right to withdraw consent given, with effect for the future (Article 7(3) GDPR). To exercise these rights, the data subject may contact us at any time (contact details see Section 2).

7.1 Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, every data subject has the right under Article 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of their residence, place of work or the place of the alleged infringement. The competent authority for IMT-Systems GmbH is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit).

8. Data Protection in Applications and the Application Procedure

We collect and process the personal data of applicants for the purpose of handling the application procedure, including by electronic means (e.g. by email or web form). The legal basis is Section 26 BDSG in conjunction with Article 88 GDPR or Article 6(1)(b) GDPR.

If we conclude an employment contract with an applicant, the data transmitted is stored for the purpose of handling the employment relationship in compliance with statutory provisions. If no employment contract is concluded, the application documents are automatically erased two months after notification of the rejection decision, unless other legitimate interests preclude erasure.

9. Web Analytics with Matomo (self-hosted)

We use the open-source web analytics software Matomo on this website. The software is operated exclusively on our own servers; the data-protection-sensitive log files are stored exclusively on these servers. No transmission to third parties takes place.

The purpose is to analyse visitor flows in order to evaluate the use of the website and compile online reports. Information such as access time, place of origin and frequency of visits is stored. The IP address is anonymised immediately after processing and before storage. The legal basis is Article 6(1)(f) GDPR (legitimate interest in the needs-based design of the website); where consent is obtained, Article 6(1)(a) GDPR. The data subject may object to the collection. Further information: https://matomo.org/privacy/.

10. Legal Bases for Processing

Article 6(1)(a) GDPR serves as the legal basis for processing for which we obtain consent. Where processing is necessary to perform a contract with the data subject or to take pre-contractual steps, it is based on Article 6(1)(b) GDPR. Where we are subject to a legal obligation, processing is based on Article 6(1)(c) GDPR. Otherwise, processing may be based on Article 6(1)(f) GDPR where it is necessary to safeguard a legitimate interest and the interests, fundamental rights and freedoms of the data subject do not override it.

11. Legitimate Interests

Where processing is based on Article 6(1)(f) GDPR, our legitimate interest is the conduct of our business activities as well as the security and functionality of our systems for the benefit of our employees and shareholders.

12. Duration of Storage

The criterion for the duration of storage of personal data is the respective statutory retention period. After the period expires, the data is routinely erased, provided it is no longer required for the performance or initiation of a contract.

13. Provision of Personal Data

The provision of personal data is partly required by law (e.g. tax regulations) or may result from contractual arrangements (e.g. information about the contractual partner). To conclude a contract, it may be necessary for a data subject to provide us with personal data that we must subsequently process. Failure to provide the data would mean that the contract could not be concluded.

14. No Automated Decision-Making

As a responsible company, we do not use automated decision-making or profiling within the meaning of Article 22 GDPR.

IMT-Systems GmbH · Privacy Policy · As of: June 2026 · Convenience translation – German version prevails