Skip to content
Deutsch: deen
Legal

Privacy Policy

At a glance

This privacy policy describes which personal data we process when you visit this website and which rights you have. Personal data is any data that can be used to identify you personally.

  • This website sets no cookies and stores nothing in your browser (no local storage, no session storage). That is why there is no cookie banner.
  • We use no advertising or tracking services such as Google Analytics, Google Tag Manager or social media plugins. Visitor statistics are anonymous and work without cookies.
  • Fonts and images are served from our own server. Third-party content (YouTube videos, the JOIN job widget) is only loaded where it is needed. YouTube videos only load once you click “Play”.

Information on data protection when using our software products is available at Privacy Notice for Software Products.

Controller and data protection officer

The controller responsible for data processing on this website is:

IRS Systementwicklung GmbH
Pfaffenthanner Weg 5
93179 Brennberg, Germany
Phone: +49 (0) 9484/9500-0
E-mail: info@irs.systems

The controller is the natural person or legal entity that, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, e-mail addresses).

For questions or concerns regarding data protection, you can reach our data protection team at datenschutz@irs.systems. Alternatively, you can contact our data protection officer:

Daniel Steffen
NOVINET GmbH & Co. KG
datenschutzbeauftragter@novidata.de

Hosting and server log files

This website is hosted by Vercel. The provider is Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel delivers the pages through a global content delivery network and runs the website's server functions (e.g. contact form, search, “Ask AI”).

With every request, Vercel automatically processes the data your browser transmits and stores it in server log files:

  • IP address
  • date and time of the request
  • requested page or file, referrer URL
  • browser type and version, operating system

This data is not merged with other data sources. Processing is based on Art. 6(1)(f) GDPR; our legitimate interest lies in delivering the website securely, quickly and free of technical errors. Vercel deletes the log files automatically after a short time, at the latest after 30 days.

Vercel processes the data on our behalf. Data may be transferred to the USA; such transfers are based on the European Commission's Standard Contractual Clauses, which are part of Vercel's data processing terms. More information: https://vercel.com/legal/privacy-policy and https://vercel.com/legal/dpa.

Cookies and browser storage

This website sets no cookies and stores no data in your browser. Neither cookies nor local storage, session storage or comparable technologies are used, and no device fingerprinting takes place. Consent under Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act) is therefore not required.

Exception: if you play a YouTube video, YouTube may store data in your browser within its embedded player (see YouTube videos).

Visitor statistics and page performance

Vercel Web Analytics

To understand which pages are visited and how often, we use Vercel Web Analytics. The service works without cookies and stores nothing in your browser. Visitors are only told apart by a hash derived from the request, which is discarded after 24 hours. Visits therefore cannot be followed across several days or across other websites, and no profiles are built.

For each page view, the following is recorded: time, requested URL, referrer, country or region, device type, operating system and browser (each with version). Your IP address is not stored. We only see aggregated statistics.

Vercel Speed Insights

With Vercel Speed Insights we measure how quickly our pages load and respond (Core Web Vitals). The measurements are transmitted together with the page visited, device type, browser and country. Speed Insights sets no cookies either.

The legal basis for both services is Art. 6(1)(f) GDPR. Our legitimate interest lies in designing our website to meet our visitors' needs and in optimizing it technically. For the provider, see Hosting. You may object to this processing at any time, e.g. by e-mail to datenschutz@irs.systems or by blocking the scripts with a content blocker.

Search and “Ask AI”

Search

The search on this website runs in your browser. So that we can improve the search and our content, the search term, the number of results and, if applicable, the result you click are sent to our server and logged there.

Ask AI

“Ask AI” lets you ask questions about our products and documentation. The answer is generated by an AI language model based solely on the content of this website. To do this, your question (and, for follow-up questions, the conversation so far) is sent together with excerpts from our pages via Vercel's AI Gateway to the Claude language model of Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA. Depending on availability, the gateway may also have the model run by Amazon Web Services or Google Cloud, which also provide Claude. According to the providers, inputs are not used to train AI models.

The question, the answer, the pages consulted and the number of tokens used are logged.

Please do not enter personal data into “Ask AI” or the search. For personal matters, please use the contact form or send us an e-mail.

Logging

The logs for search and Ask AI contain neither your IP address nor browser data or cookies. So that we can tell which searches and questions belong to the same visit, a random identifier is sent along. It is created when the page loads, held only in the memory of the browser tab and is gone once you close the tab; it cannot be used to identify you. The logs are stored in Vercel's server logs and deleted automatically after 30 days at the latest.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in answering questions about our products directly and in improving the search, the answers and our documentation. Transfers to the USA are based on the European Commission's Standard Contractual Clauses.

Contact form and contact by e-mail or phone

If you send us a request via the contact or support form, your details, including the contact data you provide, are sent to us by e-mail and stored for the purpose of handling your request and any follow-up questions. To send these e-mails we use the e-mail service of STACKIT (STACKIT GmbH & Co. KG, Stiftsbergstraße 1, 74172 Neckarsulm, Germany), which processes the data in data centres in Germany. The form itself does not store any data on the website.

If you contact us by e-mail or phone, your request, including all resulting personal data (name, request), is stored and processed by us for the purpose of handling your concern.

Processing is based on Art. 6(1)(b) GDPR if your request relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in handling the requests addressed to us effectively (Art. 6(1)(f) GDPR). We do not pass this data on without your consent.

The data remains with us until you ask us to delete it or the purpose for storing it no longer applies (e.g. after your request has been handled). Mandatory statutory provisions – in particular retention periods – remain unaffected.

Careers and applications

Job listings and applicant software (JOIN)

The job listings on our careers page are displayed via a widget of JOIN Solutions GmbH (“JOIN”), and we receive applications through JOIN's applicant software. When you open the careers page, your browser loads the widget from JOIN's servers; in the process, your IP address and the page visited are transmitted to JOIN. We set no cookies in doing so.

JOIN stores data exclusively on European servers. As JOIN uses sub-processors based in the USA, access from the USA cannot be ruled out; JOIN has concluded Standard Contractual Clauses with these sub-processors. JOIN processes the data on our behalf. The legal basis for displaying the widget is Art. 6(1)(f) GDPR; our legitimate interest lies in presenting our current vacancies.

Scope and purpose of data collection

You can apply to us by e-mail, by post or via JOIN. If you send us an application, we process the associated personal data (e.g. contact and communication data, application documents, notes taken during interviews) to the extent necessary to decide on establishing an employment relationship. The legal basis is Section 26 BDSG (initiation of an employment relationship) under German law, Art. 6(1)(b) GDPR (general contract initiation) and – if you have given consent – Art. 6(1)(a) GDPR. Consent can be withdrawn at any time. Within our company, your data is only passed on to persons involved in processing your application.

If your application is successful, the data you submitted is stored in our data processing systems for the purpose of carrying out the employment relationship, on the basis of Section 26 BDSG and Art. 6(1)(b) GDPR.

Retention period

If we cannot offer you a position, you decline an offer or withdraw your application, we retain the data you submitted on the basis of our legitimate interests (Art. 6(1)(f) GDPR) for up to 6 months from the end of the application process. The data is then deleted and physical application documents are destroyed. Retention serves in particular as evidence in the event of a legal dispute. If it is apparent that the data will be needed after the 6-month period (e.g. due to an impending or pending legal dispute), it will only be deleted once the purpose of further retention no longer applies. Longer retention may also take place if you have given consent (Art. 6(1)(a) GDPR) or if statutory retention obligations prevent deletion.

YouTube videos

On some pages we embed videos from YouTube. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

As long as you do not play a video, no connection to YouTube is established: the preview image is served from our own server. Only when you click “Play” does your browser load the player in privacy-enhanced mode from youtube-nocookie.com. In the process, in particular your IP address and the page visited are transmitted to YouTube. If you are signed in to your YouTube or Google account, YouTube can associate the request with your account; you can prevent this by signing out first. According to YouTube, privacy-enhanced mode sets no cookies, but it may store local storage elements in your browser that can be used for recognition. Once the video has started, further data processing may be triggered over which we have no control.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you give by clicking “Play” after we have informed you of the data transfer directly at the video. Consent applies only to that video and that page view.

Google is certified under the EU-US Data Privacy Framework (DPF): https://www.dataprivacyframework.gov/participant/5780. For more information, see Google's privacy policy: https://policies.google.com/privacy?hl=en.

This website contains links to third-party services, e.g. route planners (Google Maps), our social media profiles or the download of our AnyDesk remote support client. No data is transmitted to the respective provider unless you click such a link. Once you have clicked, the privacy policy of the respective provider applies.

Our social media profiles

This privacy policy also applies to our profiles on the following social networks:

No social media plugins are embedded on this website itself; these are plain links.

Data processing by social networks

Social networks can generally analyse your user behaviour comprehensively when you visit their website. If you are signed in to your account and visit our profile, the operator can associate this visit with your user account. Your data may also be collected if you are not signed in or do not have an account, for example via cookies or your IP address. The operators can use this data to create user profiles and show you interest-based advertising. We cannot trace all processing operations on the platforms; for details, please refer to the privacy policies of the respective operators.

Legal basis

Our social media profiles are intended to ensure the broadest possible presence on the internet. This is a legitimate interest within the meaning of Art. 6(1)(f) GDPR. The analysis processes initiated by the social networks may be based on different legal bases, which must be specified by the operators (e.g. consent within the meaning of Art. 6(1)(a) GDPR).

Controller and exercising your rights

When you visit one of our social media profiles, we are jointly responsible with the operator of the platform for the data processing triggered by this visit. You can in principle assert your rights both against us and against the operator. Despite the joint responsibility, we do not have full influence over the data processing of the platforms. We have no influence on how long the operators store data for their own purposes.

The networks in detail

LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies; you can deactivate them here: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. Privacy policy: https://www.linkedin.com/legal/privacy-policy. DPF certification: https://www.dataprivacyframework.gov/participant/5448.

Facebook and Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. For our Facebook page, Meta's joint controller agreement (Page Controller Addendum) applies: https://www.facebook.com/legal/terms/page_controller_addendum. You can adjust your advertising settings in your account: https://www.facebook.com/settings?tab=ads. Privacy policies: https://www.facebook.com/about/privacy/ and https://privacycenter.instagram.com/policy/. DPF certification: https://www.dataprivacyframework.gov/participant/4452.

YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy?hl=en. DPF certification: https://www.dataprivacyframework.gov/participant/5780.

For all of the networks named, data transfers to the USA are based on the EU-US Data Privacy Framework and on the European Commission's Standard Contractual Clauses.

Internal whistleblower system

As part of our internal whistleblower system, we process personal data on the basis of the German Whistleblower Protection Act (HinSchG) and the GDPR in order to receive and investigate reports of unlawful conduct or violations within our company and to take appropriate action.

  • Data subjects: whistleblowers, persons named in reports, and investigation and compliance officers
  • Categories of data: identification data (e.g. name and contact details of the whistleblower), information on the incidents or persons reported, communication related to the report
  • Legal basis: compliance with legal obligations pursuant to Art. 6(1)(c) GDPR and legitimate interest pursuant to Art. 6(1)(f) GDPR in conjunction with the Whistleblower Protection Act
  • Disclosure: only where necessary to investigate the incident or to comply with legal obligations
  • Storage period: as long as necessary for the purposes stated or as required by statutory retention obligations

General and mandatory information

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose of processing no longer applies. If you submit a justified request for deletion or withdraw your consent, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once these reasons cease to apply.

Legal bases for processing

If you have consented to data processing, we process your data on the basis of Art. 6(1)(a) GDPR or – for special categories of personal data – Art. 9(2)(a) GDPR. Where consent involves access to your device, Section 25(1) TDDDG applies in addition. If your data is required to perform a contract or for pre-contractual measures, we process it on the basis of Art. 6(1)(b) GDPR; to comply with a legal obligation, on the basis of Art. 6(1)(c) GDPR. Data may also be processed on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. The legal basis applicable in each case is stated in the respective sections of this privacy policy.

Recipients of personal data

We only pass personal data on to external parties if this is necessary to perform a contract, if we are legally obliged to do so (e.g. to tax authorities), if we have a legitimate interest in the disclosure pursuant to Art. 6(1)(f) GDPR or if another legal basis permits it. Service providers that process data on our behalf may only use it in accordance with our instructions.

Transfers to third countries

Some of the service providers named in this privacy policy are based in the USA or use sub-processors in the USA. We only transfer data to third countries if there is an adequacy decision of the European Commission (e.g. for companies certified under the EU-US Data Privacy Framework) or appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Your rights

Information, rectification and erasure

Within the scope of the applicable statutory provisions, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients and the purpose of the processing, and, where applicable, the right to have this data rectified or erased. Please contact us at any time with these or other questions about personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. This right applies in particular if you dispute the accuracy of the data we store (for the duration of the review), if the processing was or is unlawful and you request restriction instead of erasure, if we no longer need your data but you need it to exercise, defend or assert legal claims, or if you have lodged an objection pursuant to Art. 21(1) GDPR and the weighing of your interests against ours is still pending. Where processing has been restricted, this data – apart from being stored – may only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a member state.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where technically feasible.

Withdrawal of consent

You can withdraw any consent you have given at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Right to object to data collection in special cases and to direct advertising (Art. 21 GDPR)

IN THE EVENT THAT DATA ARE PROCESSED ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. THE LEGAL BASIS ON WHICH ANY PROCESSING IS BASED IS STATED IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ASSERTION, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH ADVERTISING. THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT ADVERTISING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged violation. This right exists without prejudice to any other administrative or judicial remedies.

Other

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as requests you send to us, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the browser's address bar starting with “https://” and by the lock icon in your browser bar. When encryption is active, the data you transmit to us cannot be read by third parties. Please note that data transmission over the internet (e.g. communication by e-mail) may have security gaps; complete protection of data against access by third parties is not possible.

Objection to promotional e-mails

We hereby object to the use of contact data published in connection with the mandatory imprint for sending us unsolicited advertising and information material. The operators of this website expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam e-mails.