Privacy policy

to fulfill the requirements of Articles 13 and 14 GDPR (information obligations) as well as Sections 29, 32, and 33 of the German Federal Data Protection Act (BDSG)

General information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data are all data with which you can be personally identified. Detailed information on data protection can be found in our privacy policy listed below this text.

The operators of this site take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations as well as this privacy policy.

When you use this website, various personal data are collected. Personal data are data with which you can be personally identified. This privacy policy explains which data we collect and what we use it for. It also explains how and for what purpose this happens.

We point out that data transmission over the internet (e.g., communication by e-mail) can have security vulnerabilities. Complete protection of data against access by third parties is not possible.

1. Name and contact details of the controller and the company data protection officer

This data protection information applies to data processing by:

Controller:
Evosys Laser Services GmbH
Felix-Klein-Straße 75a
D-91058 Erlangen
Represented by: Thomas Eckert
E-Mail: info@evosys-services.com
Phone: +49 9131 – 40180-0

The company data protection officer of Evosys Laser Services GmbH is reachable at the above address, attn. Mr. Volker Beneke, or by e-mail at datenschutz@evosys-services.com.

2. Collection and storage of personal data as well as type and purpose of their use

a) When visiting the website

When you access our website www.evosys-services.de, information is automatically sent to the server of our website by the browser used on your end device. This information is temporarily stored in a so-called log file.

The web server access logs record which page requests were made at what time. They include the following data: IP address, directory protection user, date, time, requested pages, protocols, status code, data volume, referrer, user agent, and requested hostname.

IP addresses are stored in anonymized form. For this purpose, the last three digits are removed, i.e., 127.0.0.1 becomes 127.0.0.*. IPv6 addresses are also anonymized. The anonymized IP addresses are retained for 60 days. Information on the directory protection user is anonymized after one day.

Error logs, which record faulty page requests, are deleted after seven days. These include error messages, the accessing IP address, and depending on the error, the requested webpage.

FTP accesses are logged anonymously and stored for 60 days.

Mail logs for sending e-mails from the web environment are anonymized after one day and then retained for 60 days. During anonymization, all sender/recipient data are removed. Only the sending time and information on how the e-mail was processed (queue ID or not sent) remain.

Mail logs for sending via our mail servers are deleted after four weeks. The longer retention period is necessary to ensure the functionality of mail services and spam protection.

The data mentioned above are processed for the following purposes:

  • Ensuring a smooth connection setup of the website,
  • Ensuring comfortable use of our website,
  • Evaluation of system security and stability, and
  • Further administrative purposes.

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest follows from the aforementioned purposes of data collection. Under no circumstances do we use the collected data to draw conclusions about your person. A merging of these data with other data sources does not take place.

To manage the cookies and similar technologies (tracking pixels, web beacons, etc.) used and related consents, we use the consent tool "Real Cookie Banner". Details on the functionality of "Real Cookie Banner" can be found at https://devowl.io/rcb/data-processing/.

The legal bases for processing personal data in this context are Art. 6 para. 1 lit. c GDPR and Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.

Provision of personal data is neither contractually required nor necessary for concluding a contract. You are not obliged to provide personal data. If you do not provide personal data, we cannot manage your consents.

b) When using our contact form

For questions of any kind, we offer you the possibility to contact us via a form provided on the website. It is necessary to provide a valid e-mail address, your name, a subject, the inquiry itself, and consent to the privacy policy so that we know who is contacting us and can answer your inquiry. Further information can be provided voluntarily.

If you send us inquiries via the contact form, your details from the inquiry form, including the contact data you provided there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not pass on these data without your consent.

The processing of the data entered in the contact form is therefore exclusively based on your consent (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time. A simple e-mail to datenschutz@evosys-services.com is sufficient. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

The data you enter in the contact form remain with us until you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies (e.g., after completed processing of your inquiry). Mandatory statutory provisions – in particular retention periods – remain unaffected.

c) When using our applicant management system

For the acceptance and processing of applicant data, we use a digital applicant management system.

To ensure the protection of applicant data against unauthorized access, we only accept applications (form entries and attachments) via this applicant management system. The data are transmitted encrypted (see section 7. Data security). Applications sent to us by e-mail or post cannot be considered and will be returned without comment.

Our applicant management system is technically operated and maintained by an external processor within the framework of a commissioned data processing agreement. The external processor guarantees secure storage, processing, and deletion of applicant data. Processing is carried out exclusively based on legal provisions according to Art. 28 GDPR within the scope of a corresponding contractual agreement with the processor.

Further processing of your data is based on the fulfillment of pre-contractual measures (Art. 6 para. 1 lit. b GDPR). We process your data exclusively for the purpose of personnel recruitment for the respective advertised position or speculative application.

There is no transfer of your data to third parties unless you give consent by ticking the box "The application may be forwarded within the corporate group. Consent can be revoked with effect for the future (optional)." If the applicant consents, the application will be forwarded within the corporate group (currently Evosys Laser GmbH, www.evosys-laser.de/ and Evosys Laser Services GmbH, www.evosys-services.de/). This means the application is processed not only by Evosys Laser Services GmbH but also by Evosys Laser GmbH. Further processing of your data is thus based on your consent (Art. 6 para. 1 lit. a GDPR).

In case of rejection as the conclusion of the application process, your data will be deleted from our system in compliance with statutory deadlines (6 months). If the applicant consents by ticking the box "I allow the use of my entire application documents also for further application procedures (talent pool). Consent can be revoked with effect for the future (optional)," the application will be included in the talent pool. This means the application will be processed beyond the current application process for a period of 2 years. Further processing of your data is thus based on your consent (Art. 6 para. 1 lit. a GDPR).

You can revoke the above consents at any time. A simple e-mail to datenschutz@evosys-services.com is sufficient. The legality of data processing carried out until revocation remains unaffected. Please also note sections 5 and 6 of this privacy policy.

In case of acceptance as the conclusion of the application process, your data will be transferred to our personnel management system. Our personnel management system is technically operated and maintained by an external processor within the framework of a commissioned data processing agreement. The external processor guarantees secure storage, processing, and deletion of personnel data. Processing is carried out exclusively based on legal provisions according to Art. 28 GDPR within the scope of a corresponding contractual agreement with the processor.

d) During contract initiation and execution with business partners (e.g., suppliers and customers)

The purpose of processing personal data is the provision of pre-contractual measures or the fulfillment of contractual obligations (legal basis Article 6 No. 1b GDPR). We use your personal data for:

  • Contact and information exchange
  • Delivery of the system
  • Organization of our services within our corporate group

The following categories of personal data are processed:

  • Name and first name of the data subject
  • Business address as well as contact details such as telephone number and e-mail address of the data subject
  • Information about the contract and the system

The source of the personal data mentioned is Evosys Laser GmbH (for delivery of a system, initiation of service contracts), Evosys Laser Services GmbH (initiation of service contracts or contract manufacturing), or the data subject themselves (for inquiries about services or contract manufacturing).

The personal data mentioned are necessary to fulfill the pre-contractual or contractual measures. If they are not provided, the pre-contractual or contractual measures cannot be provided.

The personal data are passed on to the following recipients:

  • Internal departments responsible for processing your contract
  • Affiliated companies within our corporate group responsible for assembly, commissioning, and – in the case of a separate order – maintenance of our systems

Automated decision-making including profiling does not take place.

No transfer to recipients abroad or third countries outside the EU takes place.

Your personal data will be deleted or blocked as soon as the purpose of storage no longer applies. In the event that no contract is concluded with you, this is 2 years after sending the offer. If a contract is concluded with you, this is 10 years after the conclusion of the contract.

3. Data sharing

Your personal data will not be transmitted to third parties for purposes other than those listed below or further described in this privacy policy (e.g., section 10). We share your personal data with third parties if:

  • You have given your explicit consent according to Art. 6 para. 1 sentence 1 lit. a GDPR,
  • The disclosure is necessary according to Art. 6 para. 1 sentence 1 lit. f GDPR for asserting, exercising, or defending legal claims and there is no reason to assume that you have an overriding legitimate interest in not disclosing your data,
  • In cases where there is a legal obligation to disclose according to Art. 6 para. 1 sentence 1 lit. c GDPR and this is legally permissible and necessary for the processing of contractual relationships with you according to Art. 6 para. 1 sentence 1 lit. b GDPR.

4. Plug-ins

This site uses the map service Google Maps via an API interface (an interface provided by a software system to integrate it into other programs). Provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

To use the functions of Google Maps, it is necessary to store your IP address. This information is usually transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transmission.

The use of Google Maps takes place only after explicit consent by the user according to Art. 6 para. 1 sentence 1 lit. a GDPR.

More information on handling user data can be found in Google's privacy policy: https://www.google.de/intl/de/policies/privacy/.

5. Data subject rights

You have the right to:

  • Request information about your personal data processed by us according to Art. 15 GDPR. In particular, you can request information about the processing purposes, categories of personal data, categories of recipients to whom your data have been or will be disclosed, planned storage duration, existence of rights to rectification, deletion, restriction of processing or objection, existence of a right to complain, origin of your data if not collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;
  • Request immediate correction of inaccurate or completion of your personal data stored by us according to Art. 16 GDPR;
  • Request deletion of your personal data stored by us according to Art. 17 GDPR, unless processing is necessary for exercising the right to freedom of expression and information, compliance with a legal obligation, reasons of public interest, or asserting, exercising or defending legal claims;
  • Request restriction of processing of your personal data according to Art. 18 GDPR if you dispute the accuracy of the data, the processing is unlawful but you refuse deletion, we no longer need the data but you require them for asserting, exercising or defending legal claims, or if you have objected to processing according to Art. 21 GDPR;
  • Receive your personal data provided to us in a structured, commonly used and machine-readable format or request transmission to another controller according to Art. 20 GDPR;
  • Revoke your consent given once at any time according to Art. 7 para. 3 GDPR by informal notification via e-mail. This means we will no longer process data based on this consent for the future;
  • Complain to a supervisory authority according to Art. 77 GDPR. Usually, you can contact the supervisory authority of your usual residence, workplace, or our company headquarters.

6. Right to object

If your personal data are processed based on legitimate interests according to Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right to object to the processing according to Art. 21 GDPR, insofar as there are reasons arising from your particular situation or the objection relates to direct marketing. In the latter case, you have a general right to object without specifying a particular situation, which we will implement. To exercise your revocation or objection rights, an e-mail to datenschutz@evosys-services.com is sufficient.

7. Data security

For security reasons and to protect the transmission of confidential content, such as inquiries you send to us as site operators, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the change of the browser address line from "http://" to "https://" and by the lock symbol in your browser line.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties. We also use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

8. Objection to advertising e-mails

The use of contact data published within the framework of the imprint obligation for sending unsolicited advertising and information materials is hereby contradicted. The operators of the pages expressly reserve the right to take legal action in the event of unsolicited sending of advertising information, such as spam e-mails.

9. Links/redirects to third-party websites

On our website, we use links that refer to our own content (within our website or our corporate group) and to external content (e.g., partner sites or social media).

Links to our own content are usually presented as text. We are responsible as content providers according to § 7 para. 1 Telemedia Act for this own content.

Links to external content are usually displayed as logos or symbols.

We point out that external content has its own privacy policies and we assume no responsibility for these.

As soon as you click on a link to external content, data are transmitted to this destination. These include in particular:

  • Your IP address
  • The time of clicking the link
  • Address of the website you came from
  • Operating system and browser version of your end device (user agent)

We also point out that clicking on links may mean that the aforementioned data are transferred to countries outside the European Union.

If you do not want this, do not click on links to external content.

10. Social media

10.1 LinkedIn

We operate a company page on LinkedIn. This page can be accessed either via a link on this website or via the LinkedIn search function. The page uses the technical platform of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

We point out that you use this LinkedIn page and its functions at your own responsibility. This applies especially to the use of interactive functions (e.g., commenting, sharing, rating). When visiting our LinkedIn page, LinkedIn Ireland Unlimited Company collects your IP address and other information stored as cookies on your PC. These and other data collected about you may be transferred to countries outside the European Union.

Which further information LinkedIn Ireland Unlimited Company receives and how it is used is described here: https://privacy.linkedin.com/de.

How LinkedIn Ireland Unlimited Company uses data from LinkedIn page visits for its own purposes, to what extent activities on the LinkedIn page are assigned to individual users, how long LinkedIn stores these data, and whether data from a LinkedIn page visit are passed on to third parties is unknown to us.

If you are currently logged in to LinkedIn as a user, a cookie with your LinkedIn ID is stored on your device. This enables LinkedIn to track that you visited this page and how you used it. To avoid this, you should log out of LinkedIn or deactivate the "stay logged in" function, delete cookies stored on your device, and close and restart your browser. This way, LinkedIn information that can directly identify you is deleted. You can then use our LinkedIn page without revealing your LinkedIn ID.

If you access interactive functions on the page (like, comment, share, messages, etc.), a LinkedIn login mask appears. After logging in, you are again identifiable to LinkedIn as a specific user. We as the provider of the information service do not collect or process any data from your use of our service.

11. Matomo

This website uses the open-source web analytics service Matomo. Matomo uses so-called "cookies". These are text files stored on your computer that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is stored on our server. The IP address is anonymized before storage.

Matomo cookies remain on your device until you delete them.

The storage of Matomo cookies and the use of this analysis tool are based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in anonymized analysis of user behavior to optimize both its web offering and its advertising. If consent has been obtained (e.g., consent to the storage of cookies), processing is based exclusively on Art. 6 para. 1 lit. a GDPR; consent can be revoked at any time.

The information generated by the cookie about your use of this website is not passed on to third parties. You can prevent the storage of cookies by setting your browser software accordingly; however, we point out that in this case you may not be able to use all functions of this website to their full extent.

If you do not agree to the storage and use of your data, you can deactivate storage and use here. In this case, an opt-out cookie is stored in your browser, which prevents Matomo from storing usage data. If you delete your cookies, the Matomo opt-out cookie is also deleted. The opt-out must be reactivated on a renewed visit to this website.

12. Currency and changes to this privacy policy

This privacy policy is current as of July 2025. Due to the further development of our website or due to changed legal or official requirements, it may become necessary to change this privacy policy. The current privacy policy can be accessed by you at any time here.