Thank you for visiting our website. In the privacy policy, we would like to inform you about the handling of your data in accordance with Art. 13 of the General Data Protection Regulation (GDPR).

Controller

The controller for the data processing described below is EW GROUP GmbH, Hogenbögen 1, D-49429 Visbek, Telefon: +49 4445 950 59 0, E-Mail: holding@ew-group.de

Usage data

When you visit our websites, our web server temporarily evaluates so-called usage data for statistical purposes in order to improve the quality of our website. This data consists of the following data categories:

• the name and address of the requested content,
• the date and time of the query,
• the amount of data transferred,
• the access status (content transferred, content not found),
• the description of the used web browser and operating system used,
• the referral link, which indicates from which page you reached ours,

The legal basis for the processing of usage data is Art. 6 (1) (f) GDPR. The processing is based on the legitimate interest of providing the contents of the website and ensuring a device- and browser-optimised display.

Storage of IP adresses for security purposes 

In addition, we store the complete IP address transmitted by your web browser with strict purpose limitation for a period of seven days in the legitimate interest of being able to detect, limit and eliminate attacks on our websites. We delete or anonymize the IP address when this period has expired.The legal basis for the processing is Art. 6 (1) (f) GDPR.

Data security

​In order to protect your data as comprehensively as possible from unwanted access, we implement technical and organisational measures. These measures include encryption procedures on our websites. Your data is transferred from your computer to our server and vice versa via the internet using TLS encryption. You can usually recognize this by the fact that the lock symbol in the status bar of your browser is closed and the address line begins with https://.

Necessary cookies

We use cookies on our websites, which are necessary for using our websites.

Cookies are small text files that can be stored on and extracted from your device. There is a difference between session cookies, which are deleted as soon as you close your browser, and permanent cookies, which are stored for more than the duration of the session.

We do not use these necessary cookies for analysis, tracking or advertising purposes.

In some cases, these cookies only contain information on certain settings and are not linked to a person. They may also be necessary to enable user guidance, security and operating of the site.

The legal basis for using these cookies is our legitimate interest according to Art. 6 (1) (f) GDPR.

You can set your browser to inform you about the use of cookies. You can also delete cookies or prevent the setting of new cookies at any time by using the appropriate browser settings. Please note that if you delete certain cookies, our websites may not be displayed correctly and some functions may no longer be available.

Name	Provider	Purpose	Maximum storage period	Adequate level of data protection
pll_language	Polylang	Storage of language settings	1 year	​Data processing within the EU/EEA
borlabs-cookie	Borlabs	Storage of cookie settings	1 year	​Data processing within the EU/EEA

Consent banner

We use a consent management platform (consent or cookie banner) on our websites. The processing in connection with the use of the consent management platform and the logging of the settings you have made is carried out on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR, in our legitimate interest to display our content according to your preferences and to be able to prove the consent(s) you have given. The settings you have made, the consent you have given and parts of your usage data are stored in a cookie. This means that it is retained for subsequent page requests and your consent can still be tracked. You can find further information on this under the heading “Necessary cookies”.

Storage period

Unless we have already informed you in detail about the storage period, we delete personal data when they are no longer required for the aforementioned processing purposes and no legitimate interests or other (legal) reasons for storage prevent deletion.

Google Analytics

We use the web analysis tool “Google Analytics” for the user-oriented design of our websites. Google Analytics creates user profiles on the basis of pseudonyms. For this purpose, permanent cookies are stored on your end device and read by us. In this way, we are able to recognize returning visitors and count them as such. The data collected is stored for a maximum period of 2 months.

As part of the Google Analytics service, Google Ireland Limited supports us as a processor in accordance with Art. 28 GDPR. Data processing may also be carried out by Google outside the EU or the EEA (in particular in the USA). With regard to Google, an adequate level of data protection is guaranteed on the basis of the adequacy decision (EU-U.S. Data Privacy Framework). Google also undertakes to conclude standard contractual clauses with other sub-processors.

Data processing takes place on the basis of your consent, provided that you have given your consent via our banner. You can withdraw your consent at any time. To do so, please follow this link and make the appropriate settings via our banner.

General contact enquiries

You have the option of contacting us by e-mail for general enquiries. When you contact us, we only process the data that you send us by email (e.g. first and last name, email address, content of your enquiry).

We use this data on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR to answer your enquiry. If your enquiry serves business purposes and is necessary for the implementation of pre-contractual measures or the fulfilment of a contract, we process your data on the basis of Art. 6 para. 1 sentence 1 lit. b GDPR.

Your data will only be processed to respond to your enquiry. We will delete your data if it is no longer required and there are no legal obligations to retain it.

With regard to processing in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right to object at any time. To do so, please contact the email address provided in the legal notice.

Data processors

We share your data with service providers that support us in the operation of our websites and the associated processes as part of data processing on behalf of the controller pursuant to Art. 28 GDPR. These are, for example, hosting service providers. Our service providers are strictly bounded by our instructions and are contractually obligated accordingly.

In the following, we will name the processors with whom we work, if we have not already done so in the above text of the data protection declaration. If data may be processed outside the EU or the EEA in this context, we inform you about this in the following table.

Processor	Purpose	Adequate level of data protection
IONOS SE	​Webhosting and Support​	Processing only within EU/EEA

Your rights as a data subject

When processing your personal data, the GDPR grants you certain rights as a data subject:

Right of access (Art. 15 GDPR)

You have the right to obtain confirmation as to whether personal data of you is being processed; if this is the case, you have the right to obtain information about the processed personal data and to receive the information listed in detail in Art. 15 GDPR.

Right to rectification (Art. 16 GDPR)

You have the right to request the rectification of any inaccurate personal data relating to you and, where applicable, the completion of any incomplete data, without delay.

Right to erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data without delay, provided that one of the reasons listed in detail in Art. 17 GDPR applies.

Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of processing, for the duration of the assessment by the controller, if one of the requirements listed in Art. 18 GDPR is met, e.g. if you have objected to the processing.

Right to data portability (Art. 20 GDPR)

In certain cases, which are listed in detail in Art. 20 GDPR, you have the right to receive your personal data in a structured, commonly used and machine-readable format or to request the transfer of this data to a third party.

Right to withdraw consent (Art. 7 GDPR)

If the processing of data is based on your consent, you are entitled to withdraw your consent to the processing of your personal data at any time in accordance with Art. 7 (3) GDPR. Please note that the withdrawal of the consent only effective for the future. Processing that took place before the withdrawal is not affected.

Right to object (Art. 21 GDPR)

If data is collected on the basis of Art. 6 (1) (f) GDPR (data processing for the protection of legitimate interests) or on the basis of Art. 6 (1) (e) GDPR (data processing for the protection of public interests or in the exercise of official authority), you have the right to object to the processing at any time for reasons arising from your particular situation. We will then no longer process the personal data unless there are demonstrably compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your data violates data protection regulations. The right to lodge a complaint can be asserted in particular with a supervisory authority in the Member State of your habitual residence, your place of work or the place of the suspected infringement.

Asserting your rights

Unless otherwise described above, please contact the controller of the data processing named in the imprint to assert your rights as a data subject.

Contact details of our data protection officer

Our external data protection officer will be happy to provide you with information on the subject of data protection under the following contact details:

datenschutz nord GmbH
Konsul-Smidt-Straße 88
28217 Bremen
Web: https://www.dsn-group.de/
E-mail: office@datenschutz-nord.de

If you contact our data protection officer, please also state the controller for the data processing named in the imprint.

Status: April 2026

Compliance with data protection regulations is of great importance to us. Below, we would like to inform you about the collection and processing of your personal data:

Controller

The party responsible for data processing is EW Group GmbH, Hogenbögen 1, D-49429 Visbek, Telephone: +49 4445 950 59 0, Email: personal@ew-group.de.

Purpose and Legal Basis of Data Processing

We process your personal data for the purpose of making a decision regarding the establishment of an employment relationship. In the context of the application process, we process personal data, particularly your contact details such as your name and address, as well as all data associated with your application, e.g., CV, certificates, qualifications.
The legal basis for processing your data is Art. 88 GDPR in conjunction with Section 26 (1) Sentence 1 BDSG (Bundesdatenschutzgesetz, which is the German Data Protection Act, engl. Federal Data Protection Act) or Art. 6 (1) Sentence 1 lit. b GDPR.

We also collect and process personal data that you voluntarily provide to us. Fields marked as voluntary or optional do not need to be completed. The processing of this data takes place on the basis of your revocable consent in accordance with Art. 6 (1) Sentence 1 lit. a, Art. 7 GDPR in conjunction with Section 26 (2) BDSG.

Furthermore, we reserve the right to use publicly accessible information about you as part of the selection process in addition to the application documents you submit. This only applies if such information is publicly available on the internet via search engines (e.g., Google). We also only use such information when and to the extent that it is suitable to provide further or confirmatory insight into your qualifications or your suitability for the position. This may include publicly accessible reporting about you, publicly accessible user profiles (e.g., on business networks such as LinkedIn or Xing), or statements you have made online (“posts”) or photos you have posted publicly.

Talent Pool

If your application does not lead to employment but remains of interest to us or affiliated companies (subsidiaries), we may ask whether we may retain your application for future job openings. The same applies if you provide your application proactively for future vacancies without reference to a specific job posting.

This extended retention is based on your revocable consent in accordance with Art. 6 (1) Sentence 1 lit. a, Art. 7 GDPR in conjunction with Section 26 (2) BDSG. Your inclusion in our talent pool is voluntary, and not providing consent does not affect any ongoing recruitment processes.

Job Postings for Affiliated Companies

We also post job openings for our subsidiaries on our website. If you apply for such a position, your application materials will be forwarded to the subsidiaries listed in the respective job posting. The subsequent application process will then be conducted by that company.

The data transfer is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest consists of simplifying internal administration within the EW Group, organizing the application process efficiently, and, where necessary, supporting the subsidiaries in the application process. We will store your application data for no longer than the duration of the application process in order to support our affiliated companies in their selection process, if necessary.

If, in this context, data is transferred to subsidiaries based in a country outside the EU or the EEA, we ensure that this only takes place if the requirements of Art. 45 et seq. GDPR are met. This includes, in particular, the existence of an adequacy decision by the European Commission or appropriate safeguards, such as the conclusion of standard contractual clauses.

Source of Data

We process personal data about you that you have provided to third parties for the purpose of deciding whether to establish an employment relationship. The data originates from:

• Job portals such as Stepstone, if you applied for one of our advertised positions via these platforms
• Affiliated companies (subsidiaries) of EW Group GmbH, if you have consented to the transfer of your data
• Recruitment agencies

Information on Joint Responsibility under Art. 26 (2) Sentence 2 GDPR

In the context of the application process, we cooperate with the following platforms:

• Stepstone, The Stepstone Group Deutschland GmbH, Völklinger Platz 1, 40219 Düsseldorf

If you apply to one of our job postings through one of these platforms, your personal data will first be collected by the platform operators and then forwarded to us.

The processing of your personal data takes place based on a joint controller agreement pursuant to Art. 26 GDPR, which we have concluded with the respective platform operators. We hereby inform you of the key contents of this agreement:

• Responsibility of the platform operators (Scope A): The above-mentioned companies are responsible for the collection and transmission of your personal data.
  The legal basis for registered users is Art. 6 (1) lit. b GDPR; for non-registered users, Art. 6 (1) lit. a GDPR may apply. Processed data includes the information you provide on the platforms, particularly CV-related information such as name, address, telephone number, date of birth, and information on education and work experience.
• Responsibility of EW Group (Scope B): Once your application is received by us, we are responsible for further processing your personal data. This processing is carried out in accordance with the information provided in this privacy notice.

Both parties provide the required information pursuant to Art. 13 and 14 GDPR for their respective areas of responsibility. 

You may exercise your data subject rights (Art. 15 ff. GDPR) with any of the parties involved. Please contact either the platform operators mentioned above or the controller listed in this privacy notice.

Recipients of Your Data

Your data will of course be treated confidentially and will not be shared with third parties. An exception applies to the transfer of data to affiliated companies after your prior consent via the talent pool.

If, in this context, data is transferred to subsidiaries based in a country outside the EU or the EEA, we ensure that this only takes place if the requirements of Art. 45 et seq. GDPR are met. This includes, in particular, the existence of an adequacy decision by the European Commission or appropriate safeguards, such as the conclusion of standard contractual clauses.

If applicable, we may use strictly instruction-bound service providers that support us, e.g., in IT services or the archiving and destruction of documents, with whom separate data processing agreements have been concluded. Unless you explicitly consent, we do not transfer your data to entities outside the EU or EEA.

Retention Period / Criteria for Determining the Retention Period

Where no statutory retention period exists, data is deleted as soon as storage is no longer required or the legitimate interest in storage ceases. If no employment relationship is established, this is typically no later than six months after completion of the application process or after receipt of a rejection.
We also delete data if you revoke your consent to its processing.

Applications included in the talent pool are stored for one year. After that, the documents are deleted. Your declaration of consent for inclusion in our talent pool is retained for an additional three years to fulfil our accountability obligations under Art. 5 (2) GDPR. In individual cases, certain data may be stored longer (e.g., travel expense reimbursements). The duration depends on statutory retention obligations, such as those under the German Fiscal Code (6 years) or the German Commercial Code (10 years).
Further storage is also permissible if continued processing is necessary, following a balancing of interests, for the assertion, exercise, or defense of legal claims.

Your Data Protection Rights

You have the right to request information free of charge about the personal data stored about you (Art. 15 (1) GDPR). Additionally, subject to legal requirements, you have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR).

You have the right to revoke your consent at any time with effect for the future if data is processed based on Art. 6 (1) Sentence 1 lit. a or Art. 9 (2) lit. a GDPR.

You have the right to object to data processing pursuant to Art. 21 GDPR if the data is processed on the basis of Art. 6 (1) Sentence 1 lit. e or f GDPR.

To exercise your rights, please contact: personal@ew-group.de.

Under Art. 77 GDPR, you also have the right to lodge a complaint with a data protection supervisory authority. The right to lodge a complaint may be exercised in particular with a supervisory authority in the Member State of the place of residence or workplace of the data subject or of the place of the alleged infringement.

Our Data Protection Officer

Our Data Protection Officer at datenschutz nord GmbH can be reached at office@datenschutz-nord.de. Please include the controller mentioned above when submitting inquiries to our Data Protection Officer.

Status: April 2026

When you visit our social media pages, data relating to you will be processed. Therefore we would like to inform you, in accordance with Art. 13 of the General Data Protection Regulation (GDPR), about our handling of your data and your rights resulting from this.

Controller

We, EW Group GmbH, are operating the following social media pages:

LinkedIn: https://www.linkedin.com/company/ew-group-gmbh/

 

You can find our contact details in the imprint.

Data processing by us

Public relations

The data you provide on our social media pages, such as usernames, comments, videos, pictures, likes, public messages, etc. are published by the social media platform and are not processed by us for any other purpose at any time. We only reserve the right to delete content if this is necessary. Where appropriate, we share your content on our site if this is a function of the social media platform and communicate with you via the social media platform. 

If we get in contact with you or you send us an enquiry on the social media platform, depending on the content, we may also refer you to other secure communication channels that guarantee confidentiality. For example, you have the option at any time to send us your enquiries to our address or personal@ew-group.de stated in the imprint. It is your own responsibility to choose the appropriate communication channel.

The legal basis for the aforementioned processing of your data is Art. 6 (1) (f) GDPR. We process the data in our legitimate interest of carrying out public relations work for our company and being able to communicate with you.

We use professionally oriented social networks (e.g. LinkedIn) to actively address potential candidates as part of our recruitment (active sourcing). If your profile is of interest to a vacancy, we will contact you via the message function of the respective network. As part of the contact, we only process the information provided in your publicly available profile, such as your name, professional qualifications and experience, as well as your education and knowledge. The legal basis for the processing of your personal data is our legitimate interest in identifying and approaching qualified specialists to fill vacancies in accordance with Art. 6 (1) (f) GDPR.

Data processing as a joint controller

For some processing activities we act as a joint controller with the respective operator of the social media platform.

Therefore, we have concluded the necessary agreement in accordance with Art. 26 GDPR, provided that the operator of the social media platform offers this option.

LinkedIn https://www.linkedin.com/legal/l/page-joint-controller-addendum

You can find the essential components of joint responsibility in the following section.

Statistics (Insights)

The social media platforms regularly provide statistics (insights) based on usage data that contain information about your interaction with our social media site. We cannot determine the performance and provision of these statistics.

We process the aforementioned information (statistics) in accordance with Art. 6 (1) (f) GDPR in the legitimate interest of validating the use of our social media pages and improving our content in target group-oriented manner.

Target group advertising

We also use the mentioned social media platforms to place target group-oriented advertising.  

For this purpose, we use target group definitions that are provided to us by the social media provider. We use only anonymous target group definitions – we define characteristics based on, for example, general demographics, behaviour, interests and connections. The social media provider uses this information to display advertisements to its users. The legal basis for this is the consent that the provider of the social media platform has requested from its users.

If you wish to withdraw your consent, please use the withdrawal options provided by the the social media provider, as the social media provider acts as controller for this processing. 

We or the social media provider also use publicly available data for target group definition. The legal basis for this processing is then Art. 6 (1) (f) GDPR. The legitimate interest on our part in this context is to define a target group that is as suitable as possible. We never use sensitive categories of personal data mentioned in Articles 9 and 10 GDPR (e.g. political opinions, sexual orientation) to define target groups.

Data processing by the social media provider

The social media provider uses web tracking methods. The web tracking can also take place regardless of whether you are registered on the social media platform or not.

Therefore we would like to point out that it cannot be excluded that the social media provider uses and evaluates your profile and behavioural data for its own purposes. We have no influence on the processing of your data by the social media provider. Please keep this in mind when using the social media platform.

For more information on data processing by the social media provider, configuration options to protect your privacy and further objection options, please refer to the operator’s privacy policy.

Storage period

We delete your personal data when they are no longer required for the aforementioned processing purposes and there are no legal retention obligations that prevent us from deleting the data.

Your rights as a user

As a user, you have the possibility to demand the following rights from us as well as from the operator of the social media platform if the requirements are fulfilled:

Right of access (Art. 15 GDPR)

You have the right to obtain confirmation as to whether personal data of you is being processed; if this is the case, you have the right to obtain information about the processed personal data and to receive the information listed in detail in Art. 15 GDPR.

Right to rectification and erasure (Art. 16 and 17 GDPR)

You have the right to request the rectification of any inaccurate personal data relating to you and, where applicable, the completion of any incomplete data, without delay. You also have the right to request that personal data concerning you will be deleted without delay if one of the reasons listed in detail in Article 17 GDPR applies, e.g. if the data is no longer required for the purposes for which they were collected.

Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of processing if one of the conditions listed in Art. 18 GDPR applies, for example if you have objected to the processing, for the duration of any review.

Right to data portability (Art. 20 GDPR)

In certain cases, which are listed in detail in Art. 20 GDPR, you have the right to receive your personal data in a structured, commonly and machine-readable format or to request the transfer of this data to a third party.

Right of objection (Art. 21 GDPR)

If data is processed on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR, you have the right to object to the processing at any time for reasons arising from your particular situation. We will then no longer process the personal data unless there are demonstrably compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If the data is processed on the basis of legitimate interest for the purpose of direct marketing, you have a specific right of objection which you may exercise at any time without providing reasons and the exercise of which will result in the termination of the processing for the purpose of direct marketing.

Right of withdrawal (Art. 7 GDPR)

If the processing of data is based on your consent, you are entitled to withdraw your consent to the processing of your personal data at any time in accordance with Art. 7 (3) GDPR. Please note that the withdrawal of the consent only effective for the future.

Right of appeal to a supervisory authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of data violates data protection regulations. The right to lodge a complaint can be asserted in particular with a supervisory authority in the member state of your place of residence, your place of work or the place of the alleged infringement.

Contact details of our data protection officer

Our external data protection officer will be happy to provide you with information on the subject of data protection under the following contact details:

datenschutz nord GmbH

E-Mail: office@datenschutz-nord.de

Tel.: +49 421 69 66 32-0 

If you contact our data protection officer, please also state the controller of the data processing named in the imprint.