Privacy Policy of 365 Sherpas GmbH

The basis of effective data protection is comprehensive information about the collection, processing and use of your data („data processing”).With this section we would like to inform you

» when and for which actions we process data
» which data we process for which reason
» who recieves data
» about your rights regarding data processing by us.

This privacy policy only regulates the use of personal data on our website If you leave our website via link or visit our pages on a social media platform, you leave the scope of this data protection information as well.

The transmission of information to or from this website is secured with TLS encryption.

You can access, print or download this privacy notice permanently and at any time here via the functions of your browser.

You can retrieve, print or download this data protection declaration permanently and at any time at the address

I. Contact Details

Controller of data processing in the meaning of the General Data Protection Regulation (GDPR) within the scope of this website is:

365 Sherpas GmbH
Schlesische Straße 26
10997 Berlin

You can contact our data protection officer at:

II. General Information on Data Processing

1. Scope of processing of personal data

The provision of this website requires the processing of various information. In addition, the scope of data processing depends on your use of the functionalities of this website, for instance if you communicate with us or consent to the processing of data.

As a visitor to our websites, you are not subject to any automated decision-making according to Article 22 GDPR.

2. Lawfulness of processing of personal data

The following legal basis apply to the processing of personal data on this website.

Reason for Data Processing Legal basis in GDPR Explanation
Performance of a contract or steps prior to entering into a contract Art. 6 Abs. 1 b) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
Legitimate Interests Art. 6 Abs. 1 f) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Consent Art. 6 Abs. 1 a) The data subject has given consent to the processing of his or her personal data for one or more specific purposes.
Legal Obligation Art. 6 Abs. 1 c) Processing is necessary for compliance with a legal obligation to which the controller is subject;

3. Erasure and storage of data

We delete personal data as soon as the legal basis for its processing expires. If there are several legal bases for a situation, the deletion occurs with the expiration of the last legal basis, for instance, after fulfillment of all legal storage obligations.

III. Data processing fort he provision of this website

In order to display the website, it is necessary to process certain information. This commences with your visit on our website. In addition, we offer functionalities on our website which require further data processing.The storage of this data including your IP address serves our legitimate interest in providing our website. The data will be deleted as soon as you leave our site.

1. Contact by e-mail

We also use the e-mail-address we have received from you within an ongoing business relationship to inform you about services of us, that are similar to those already purchased. You can object to the use of your e-mail address for this purpose at any time with effect for the future without incurring additional costs.

2. Social-media-plugin

If you like articles on our website, you can share them directly via buttons in various social-media-networks. The respective social-media-plug-ins are integrated in our website for this purpose. To regulate the flow of data to the social-media-platforms, we use a tool that prevents information from being automatically sent to the various platforms every time a website is visited. The social-media-buttons are initially deactivated and are only activated when the slider is pressed. Only then does the following data flow occur.

If you press the button of a social media network, your browser establishes a direct connection to the servers of the respective providers. When the connection is established, various information including your IP address is sent to the providers and stored by them. Since most of the providers are based in the USA, the data is also stored there. This tells the providers that your browser has called up the relevant subpage of our website. This also applies if you do not have a user account on the social-media- network or are not logged in at the time you visit our website.

If you are simultaneously logged into your social-media-account, the provider can attribute your visit to our website and any further interaction with the plugin (actuation of the respective consent buttons, comments) directly to your account and stores this information. These actions may also be visible to other users of the network. You can prevent this data processing by not pressing the buttons. You can also log out of the social-media-network before visiting our site. You can also use add-ons such as the “NoScript” script blocker ( for your browser to generally prevent social media plug-ins from being executed.

The legal basis for data processing is our legitimate interest in offering you a comfortable way to share information on our website on social media networks and thus increase our visibility.

For further information on data processing, in particular its scope and legal basis and rights in this respect, please refer to the data protection information and terms of use of the respective networks.

Our website uses the following social media plugins:


Our website contains a social plugin of the social media network Facebook from Facebook Inc, 1 Hacker Way, Menlo Park, CA 94025, USA (“Facebook”). The corresponding button can be recognized by the Logo and the word “Recommend”.

You can find Facebook’s privacy policy here:


Our website contains a social plugin of the microblogging service Twitter of Twitter Inc, 1355 Market St, Suite 900, San Francisco, CA 94103, USA (“Twitter”). The corresponding button can be recognized by the Twitter-bird and the word “Twitter”.

You can find Twitter’s privacy policy here:


Our website contains a social plugin of the social media network LinkedIn of LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA, (“LinkedIn”) represented in Europe by LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland. The corresponding button can be recognized by the “in” logo and the word “share”.

You can find LinkedIn’s privacy policy here:

IV. Usage analysis und tracking

We would like to further improve the usability of this website and the attractiveness of our services. For this reason, when you visit our website, we also collect data on usage behavior, which we evaluate for this purpose. For this reason, the following tracking and analysis cookies are also used on our website in addition to the technically conditional cookies shown above.

1. Google (Universal) Analytics

This website uses Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google collects information about your use of this website (including your IP address) in the USA via a cookie, and stores the information. However, we only use Google Analytics with an anonymisation function in which the IP address is shortened within a Member State of the European Union or the European Economic Area before it is transmitted to Google. Only in exceptional cases, the full IP address is sent to and shortened by Google servers in the USA. Google analyses the information collected and sends us reports on the usage activities on our website and provides us with additional services for this purpose. The IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data. In addition to blocking all cookies by your browser, you can also prevent Google from processing your data by downloading and installing the browser plug-in available under the following link:

As an alternative to the browser plug-in or within browsers on mobile devices, please click on the following link to set an opt-out cookie that will prevent Google Analytics from collecting data within this website in the future (this opt-out cookie works only in this browser and only for this domain, if you delete your cookies in this browser, you have to click this link again.): deactivate Google Analytics

You can find more information about Google Analytics in Google’s privacy notice:

The legal basis of data processing for analysis purposes is our legitimate interest in a statistical evaluation of the usage in order to identify errors on our website and adapt the service to the demands of users.

It is technically impossible for us to assign the analysis data to a specific person. This analysis data are therefore anonymous information. We are consequently unable to provide any personal information regarding this data.

2. Doubleclick

We also use Google’s Doubleclick service. Using this service, a cookie is set and a pseudonymous identification number (ID) is assigned to your browser. The cookie determines whether and which advertisements were displayed and clicked in your browser. This enables us to tailor your advertising even better to your interests. Since we have activated Google’s IP anonymisation on this website, your IP address will also be shortened within member states of the European Union or of the European Economic Area in the context of Doubleclick before Google transmits it. Only in exceptional cases will the full IP address be transmitted to Google in the USA and only shortened there. Google analyses the information collected and sends us reports on the usage activities on our website and provides us with additional services for this purpose. The IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data.

In addition to the above-mentioned general options for preventing cookies, you can also specifically prevent Google from saving the Doubleclick cookie by downloading an appropriate browser plug-in. You can find it here.

The legal basis of data processing for analysis purposes is our legitimate interest in a statistical evaluation of your user behavior in order to be able to continuously optimize and better market our website and our services.

Data processing for usage analysis takes place during your visit to our website and only up to the time of your effective objection.

V. Right to object and right to withdraw consent

If the data processing is based on your consent or our legitimate interest, you have the right to object to the processing or to withdraw your consent at any time. Your objection or withdrawal only has an effect for the future. Where the analysis cookies used offer their own technical options for deactivation, this explained above. You may contact at any time to exercise your right of objection or revocation. If you object to processing on the basis of our legitimate interest, we may nevertheless continue processing if we can prove compelling reasons worthy of protection which outweigh your interests, rights and freedoms.

VI. Rights of data subjects

If your personal data is processed, you are a data subject within the meaning of Art. 4 para. 1 GDPR. As data subject, you have the following rights with regard to your personal data. To exercise these rights, please contact us using the contact details above.

Right of access by the data subject according to Art. 15 GDPR

You have a right of access concerning your personal data processed by us. This includes the mandatory information set out in Art. 15 GDPR.

Right to rectification according to Art. 16 GDPR

You have the right to request the immediate correction of inaccurate personal data and the completion of incomplete personal data.

Right to erasure according to Art. 17 GDPR

You have the right to request the erasure of your personal data if one of the grounds mentioned in Art. 17 GDPR applies, in particular if there is no longer a legal basis for the processing.

Right to restriction of processing according to Art. 18 GDPR

You have the right to request the restriction of the processing of your personal data if one of the grounds mentioned in Art. 18 GDPR applies, in particular at your request instead of deleting the data.

Right to data portability according to Art. 20 GDPR

You have the right to request all personal data stored by us about you in a structured, commonly used and machine-readable format or to transmit this data to another controller without obstruction by the controller to whom the personal data was made available.

Right to lodge a complaint with a supervisory authority according to Art. 77 GDPR

According to Art. 77 GDPR, you have the right to file a complaint with the supervisory authority responsible for you.

VII. Recipient of data

Some of the processing of your personal data within the framework of the website is also carried out by processors, in particular the hosting of the website and the use of analysis tools. These are included exclusively on the basis of an agreement about the commissioned data processing in accordance with Art. 28 para. 3 GDPR.

VIII. Data transfer to third countries

The personal data we collect from you through this website will not be transferred to countries outside the European Economic Area. Only when using Google Analytics and Doubleclick, and in the exceptional cases described above, your IP address may be transmitted to Google in full and only shortened there.

Google is situated in the US and thus in a so-called “third country” according to Art. 44 GDPR. Google is certified under the EU-US Privacy Shield, which guarantees compliance with a European level of data protection.

IX. Online application

You can apply via the career portal to us, the Hirschen Group GmbH and to other subsidiaries at any time.

An overview of the companies with address and contact details can be found here.

The career portal is operated by the Hirschen Group GmbH and is also made available to us and the other Hirschen companies for applicant management. In this respect, the companies are joint controllers according to Art. 26 GDPR.

You can claim your rights of data subjects listed in section XI. against us using the contact data given in section I. You are also entitled to claim your rights against the Hirschen Group GmbH as well as the above-mentioned subsidiaries.

For the purpose of applicant management, we need your contact data (name, first name, address, date of birth, telephone number, mobile phone number, e-mail), your educational data and information on your professional career. Additional personnel master data, such as nationality, marital status/children and, if applicable, your bank data, as well as on competences and, if applicable, further education and training data are optional.

We process this data insofar as this is necessary to carry out the application process in accordance with paragraph 26 of the Federal Data Protection Act (BDSG) or if you have given us your consent in accordance with Art. 6 para. 1 lit. a) GDPR. In addition, we may be obliged to process the data on the basis of statutory provisions, Art. 6 Para. 1 lit. c) GDPR.

The data transmitted in the context of your application will be transmitted using TLS encryption and stored in a database. The database is operated by our service provider Personio GmbH, Rundfunkplatz 4, 80335 Munich. We have concluded processing agreement Personio GmbH according to Art. 28 GDPR. Further information about Personio GmbH can be found here.

Your data will always be processed by the company to which you apply. In addition, we offer you the opportunity to add your profile to our talent pool in order to identify interesting positions for you in the future. With your consent, the data on job placements within the Hirschen Group will be processed and stored in our Talent Pool.

The storage period of your data is generally 6 months. The data contained in our Talent Pool will be stored for 2 years.

Only authorized persons have access to the stored data to the extent required for the execution of the applicant management or to fulfill legal obligations.

Revocation of your consent

You have the possibility to revoke your consent to the processing of your data in writing or in text form at any time without stating reasons for the future. Please use the contact data stated here.

Last updated: February 2020