Privacy Policy

Sächsische Agentur für Strukturentwicklung GmbH (SAS) takes data protection very seriously. This is why we want you to be aware of what data we collect, process and use, when we do this, and for what purpose. Personal data is processed in accordance with the provisions of the relevant data protection regulations, in particular the EU General Data Protection Regulation and the Saxon Data Protection Implementation Act.

1. Controller and Data Protection Contact

Controller and data protection contact:

Sächsische Agentur für Strukturentwicklung GmbH
Pirnaische Strasse 9, 01069 Dresden, Germany
Tel.: +49 (0) 351 4910 5308
email: info@sas-sachsen.de

If you have questions about data protection, please contact our data protection officer at:

Sächsische Aufbaubank – Förderbank –
Data Protection Officer
Matthias Schmidt
Phone: +49 (0) 351 4910-1206
email: dsb@sab.sachsen.de

2. Purposes of data processing and legal basis

We process personal data in accordance with the provisions of the European General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other applicable legal regulations. We process your personal data to enable you to access our funding and other services. The legal basis for this includes the EU General Data Protection Regulation (EU GDPR) and supplementary provisions of the Saxon Data Protection Implementation Act (SächsDSDG).

Specifically, we process your data for the following purposes and on the following legal grounds:

2.1 To safeguard legitimate interests

The legal basis for processing is Article 6(1)(f) GDPR.

The processing of personal data is necessary in exceptional cases to safeguard the legitimate interests of SAS in accordance with Article 6(1)(f) GDPR.

Examples of processing personal data to safeguard our or third-party legitimate interests, provided your interest in protecting your personal data does not override these:

Ensuring IT security;
Transmission within the Group for internal administrative purposes.

2.2 Based on consent

The legal basis for processing is Article 6(1)(a) in conjunction with Article 7 GDPR.

Where consent has been granted to SAS to process personal data for specific purposes in accordance with Article 7 GDPR, processing is permitted on the basis of that consent. Consent can be revoked at any time. This also applies to the revocation of declarations of consent issued before the EU GDPR came into effect (25 May 2018).

The revocation of consent applies only to future processing; the lawfulness of data processing carried out on the basis of consent prior to revocation remains unaffected. Data processing on other legal grounds remains permissible even after consent has been withdrawn.

3. Data collection

Our web servers store the following data when our websites are accessed: the names of internet service providers, the websites from which our website is accessed and the pages that are accessed, including the date and duration of access. The data is stored anonymously for statistical purposes to continuously tailor our services to the needs of users.

If you order information material from us, use the registration form for an online information session or request information on a specific issue (or similar), we ask for your name, your email address, your company if applicable, your address and your fax and telephone numbers. You provide this data voluntarily. We store your data on specially protected servers. Access to the data is restricted to a small group of employees who are responsible for handling your request. The data is only processed for the purpose for which you provided it to us. Data will not be passed on to third parties unless we are legally obliged to do so or you have expressly requested this. When your data is no longer required, it will be deleted.

4. Automated decision-making (including profiling)

SAS does not use fully automated processing, including profiling, to make decisions solely based on this regarding the establishment and performance of the business relationship (Article 22 GDPR).

5. Disclosure of data

Within SAS, only departments that need your data to fulfil the statutory funding tasks, as well as contractual and legal obligations, will have access to this data.

Our contracted processors (Art. 28 GDPR) may also receive data for these stated purposes after we have ensured that their data processing is compliant with data protection regulations.

We only disclose information about you to third parties if required by law, if you have consented or if we are otherwise authorised or obliged to do so. In these cases, recipients of personal data may include:

Public bodies and institutions (e.g. Saxon public authorities, federal or European authorities, the German Central Bank, the Federal Financial Supervisory Authority (BaFin), the European Banking Authority, the European Central Bank, the European Investment Bank, the European Investment Fund, tax authorities, law enforcement authorities) in the event of a legal, regulatory or official obligation;
Other credit and financial institutions or comparable organisations to which we transfer personal data to conduct the business relationship or funding process with you (e.g. Kreditanstalt für Wiederaufbau (KfW), Landwirtschaftliche Rentenbank (LR), cooperating and correspondent banks, credit agencies);
Service providers who process data on our behalf (e.g. data centres);
Experts involved in a funding process.

Further data recipients may include entities for which you have given us your consent to transfer data or for whom you have released us from banking confidentiality in accordance with agreements or consent.

6. Retention period

The retention period for personal data depends on the specific processing purposes.

Where necessary, we process and store your personal data for the duration of our business relationship or funding procedure
In addition, we are subject to various retention and documentation obligations arising from the German Commercial Code (HGB), the German Fiscal Code (AO), the German Banking Act (KWG), the German Money Laundering Act (GwG), the German Securities Trading Act (WpHG), as well as EU law and state-level regulations. The retention and documentation periods specified therein range from two to ten years, and even longer for certain categories of data. Retention periods generally begin upon termination of the business relationship.

7. Your rights

Every data subject whose personal data (e.g. contact details such as their name, address, telephone number, email, etc.) is processed by SAS has the following rights (subject to legal prerequisites):

Right of access in accordance with Art. 15 GDPR, i.e. the right to obtain confirmation from us as to whether your personal data is being processed and, if so, access to this data and further information;
Right to rectification in accordance with Art. 16 GDPR if your personal data is incorrect;
Right to erasure in accordance with Art. 17 GDPR, for example if the personal data is no longer necessary for the purposes for which it was processed;
Right to restriction of processing in accordance with Art. 18 GDPR; and
Right to data portability in accordance with Art. 20 GDPR, i.e. the right to receive your personal data from us in a structured, commonly used and machine-readable format and the right to transmit this data to another controller, whereby this right is not available pursuant to Art. 20 (3) (2) GDPR if the data processing serves the performance of public duties.

Our data protection officer will check in individual cases whether you are entitled to the asserted right.

The restrictions under Sections 34 and 35 of the Federal Data Protection Act (BDSG) and Sections 7 and 9 of the Saxon Data Protection Implementation Act (SächsDSDG) apply to the right of access and the right to erasure.

If your personal data is processed as part of a commissioned data processing arrangement in accordance with Art. 28 and Art. 29 GDPR, please contact SAS exclusively as the responsible entity to enforce your data protection rights.

For contact information, please refer to: "1. Controller and data protection contact”.

8. Objection to processing

You have the right to object at any time to the processing of your personal data if it is based on the performance of tasks carried out in the public interest or on the grounds of legitimate interests (Art. 6(1)(1) (e) and (f) GDPR), provided that there are reasons arising from your particular situation that oppose this data processing.

This also applies to any automated individual decision-making (Art. 22 GDPR) that may be used. If you file an objection, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

In certain instances, we process your personal data to enquire about your satisfaction with SAS products, inform you about similar funding products or initiate or maintain business contacts.

You have the right to object at any time to the processing of your personal data for such purposes. If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes. Your objection can be raised informally.

Please use the contact details provided under section: “1. Controller and Data Protection Contact”.

Please note that the objection will only take effect for future processing. Processing carried out prior to the objection is not affected.

9. Right to lodge a complaint

Pursuant to Art. 77(1) GDPR, you have the right to lodge a complaint if you believe that the processing of your personal data violates data protection regulations.

The supervisory authority responsible for SAS can be contacted at:

Sächsische Datenschutz- und Transparenzbeauftragte
Devrientstraße 5
01067 Dresden
Telephone: +49 351 85471-101
Fax: +49 351 85471-109
Email: post@sdtb.sachsen.de
Website: www.datenschutz.sachsen.de

10. Data collection

10.1 Use of cookies

Cookies are small amounts of data in the form of text information that the web server sends to your browser. These are stored locally on your system. They can only be read by the server that initially stored them and contain information about what you have viewed on a website and when.
We use cookies for both the operation of our website and for pseudonymised tracking of website usage. This enables us to analyse user behaviour by collecting and evaluating information transmitted by your browser.
None of the analyses relate to individual users. Personal identification features, such as your IP address, are deleted upon processing and are replaced by an indicator, making it impossible or at least extremely difficult to identify data subjects. This approach means that SAS is generally unable to establish a direct link to any person.
We have explained in detail in our Cookie Policy which cookies and other technologies are used for specific purposes and the legal basis for their use. You can also enable or disable these settings there.
You can prevent the tracking of your usage data by turning off “functional cookies” in the privacy settings of the automatic Cookie Policy or by selecting “Reject”.
You can open the Cookie Policy by clicking on the blue circular icon at the bottom left of this page.

10.2 Server log files

When you access our website, the browser on your device automatically sends information to our website server. This information is temporarily stored in a log file. During this process, the following information is collected without any action on your part and is stored until it is automatically deleted:

IP address of the requesting device;
Date and time of access;
Name and URL of the accessed file;
Website from which the access originated (referrer URL);
Browser used and, where applicable, the operating system of your device and the name of your access provider.
We process this data for the following purposes:
Ensuring a smooth connection to the website;
Ensuring comfortable use of our website;
Evaluation of system security and stability; and
Other administrative purposes.

The legal basis for the data processing is Art. 6(1)(1)(f) GDPR. Our legitimate interest arises from the purposes listed above for data collection. Under no circumstances do we use the collected data to draw conclusions about your identity.

10.3 Contact form

We provide you with a contact form for enquiries. The following personal data is collected:

[Title]
[First name]*
[Surname]*
[Company/institution]
[Job title]
[Street and house number]
[Postcode and town]
[Email address]*
[Phone number]
[Your message]*

Required fields are marked with an *.

This data is stored exclusively for the purpose of sending and responding to enquiries. The required information is used to process and respond to your request. Processing is carried out for the purpose of pre-contractual measures (Art. 6 (1)(b) GDPR) and for job applications under Section 11 of the Saxon Data Protection Implementation Act (SächsDSDG).

You have the right to object to the processing. The success of an objection will be determined on the basis of a balancing of interests. For more information, please refer to section “7. Your rights”.

Your data will be deleted at the end of the year after completion of processing, unless applicable legal regulations require a different retention period.

10.4 Registration form for our "Frühschicht" events

We provide you with a registration form. The following personal data is collected:

[First name]*
[Surname]*
[Email address]*
[Date of birth]*
[School/place of study]*

Required fields are marked with an *.

The data is stored solely for the purpose of transmitting registrations and responding to them. The required information is used to process and respond to your request. Processing is carried out for the purpose of pre-contractual measures (Art. 6 (1)(b) GDPR).

Your data will be deleted at the end of the year after completion of processing, unless applicable legal regulations require a different retention period.

11. Analysis tools and third-party tools

11.1 Google Analytics

This website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies”, which are text files stored on your computer to help analyse how you use the website. The information generated by the cookie about your use of the website is usually transmitted to a Google server in the United States of America (USA) and stored there. If IP anonymisation has been activated on this website, your IP address will first be truncated by Google within the area of the Member States of the European Union or other parties to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compile reports on website activity and provide other other services related to website activity and internet usage.

Google will not associate your IP address with any other data held by Google.

You can prevent the use of cookies by adjusting your browser settings. However, please note that this may limit your ability to use all the features of this website. Furthermore, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: tools.google.com/dlpage/gaoptout.

This website uses Google Analytics with the extension "_anonymizeIp()". This ensures that IP addresses are further processed in abbreviated form, so that the data cannot be linked to a specific person. If any data collected about you can be personally linked, this link will be immediately removed and the personal data will be promptly deleted.
We use Google Analytics to analyse and improve the use of our website on a regular basis. We can use the statistics obtained to improve our services and make them more interesting for you as a user. In exceptional cases where personal data is transferred to the USA, Google complies with the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework. The legal basis for using Google Analytics is Art. 6(1)(1)(f) GDPR.2

Third-party provider information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of use: https://marketingplatform.google.com/about/analytics/terms/us/, overview of data protection: www.google.com/intl/de/analytics/learn/privacy.html and the Privacy Policy: https://policies.google.com/privacy?hl=en-US

11.2 Usercentrics

We use the consent management service Usercentrics, provided by Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany (Usercentrics). This enables us to obtain and manage user consent for data processing on our website. Processing is necessary to fulfil a legal obligation (Art. 7(1) GDPR) to which we are subject (Art. 6(1)(1)(c) GDPR). The following data is processed for this purpose:

Date and time of access
Browser information
Device information
Geographical location
Cookie preferences
URL of the page visited

The functionality of the website cannot be guaranteed without this processing.

Usercentrics is the recipient of your personal data and acts as a processor on our behalf.

The processing takes place within the European Union. Further information on objection and removal options in relation to Usercentrics can be found at:

https://usercentrics.com/privacy-policy/

The data is deleted after 3 years.
Please refer to our general information about deleting and deactivating cookies above.

11.3 YouTube videos

Our website includes the YouTube video player service to display videos from YouTube and the YouTube channel of "Sächsische Agentur für Strukturentwicklung GmbH" https://www.youtube.com/@sas.sachsen.

The features of this service are provided by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

We use the enhanced privacy mode to embed videos on our website. This means that data is only transmitted to YouTube when a video is played.

As the website provider, we have no knowledge of the content of the transmitted data or its use by YouTube. To our knowledge, the following data is collected by the service during use:

Device information
IP address
Referrer URL
Videos viewed

Data is deleted as soon as it is no longer required for processing purposes.

If you are logged into your YouTube account, you allow YouTube to directly associate your browsing behaviour with your personal profile. You can prevent this by logging out of your YouTube account.

The contact email for the data protection officer of the processing company is available here:

https://support.google.com/policies/contact/general_privacy_form

This service may transfer collected data to other countries. Please note that this service may transfer data outside the European Union and European Economic Area and to a country that does not have an adequate level of data protection. If the data is transferred to the USA, there is a risk that your data may be processed by US public authorities for control and surveillance purposes without you having any legal recourse.

12. Soziale Medien

Our website includes links to various social media platforms.

Important note: When you click one of the following links, you will leave our website and be redirected to a social media website. Any information provided on these platforms is created without our involvement and is therefore not our responsibility. We accept no liability for the validity, accuracy or completeness of such information. A link to a social media platform does not constitute our endorsement.

We do not use any active social media plugins, in particular for reasons of data protection compliance.

Only by clicking on the button (e.g. Twitter logo) or the links do you give your express consent to communication with the social media platform. A connection is then established by your browser connecting directly with the servers of the social media platform.

By clicking the button and being redirected to the connection page, the social media platform receives the information that you have accessed a corresponding page of the platform online.

If you are already registered with that platform, it is able to link your visit to your social media account.

However, even if you have not yet registered, after clicking the social media button and being redirected to the connection page, it cannot be ruled out that the medium will collect or store your IP address.

Please note that we ourselves have no knowledge of or influence over how and which data is transmitted to the social medium.

13. Validity and amendment of this Privacy Policy

This Privacy Policy is currently valid as of March 2024. As we further develop our website and online services or due to changes in legal or regulatory requirements, it may become necessary to amend this Privacy Policy.

The latest version of the Privacy Policy can be accessed and printed at any time on our website at sas-sachsen.de/en/privacy-policy.