Last updated: 25.09.2026
This privacy policy explains which personal data we process when you visit our website fc-gruppe.de, for what purposes and on which legal basis. Personal data is any information that can be used to identify you personally.
Contents
Controller and Data Protection Officer
Your data at a glance
General information and mandatory disclosures
Hosting and delivery of the website
Data collected on this website
Consent management, analytics and statistics
Social media profiles
Audio and video conferencing
Job applications and careers portal
1. Controller and Data Protection Officer
The controller responsible for data processing on this website is:
FC-Gruppe GmbH
Am Storrenacker 8
76139 Karlsruhe, Germany
Phone: +49 721 96196-1100
Email: v-ka@fc-gruppe.de
The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
You can reach our Data Protection Officer at:
Moritz Graf
D-Compliance Datenschutz & Mehr
Schwarzwaldstraße 139
76532 Baden-Baden, Germany
Phone: +49 7221 216817
Email: datenschutz@fc-gruppe.de
2. Your data at a glance
How do we collect your data? Some data you provide yourself, for example when you fill in the contact form or send us an email. Other data is collected automatically by our IT systems when you visit the website, mainly technical data such as your browser, operating system or the time of your visit. Further data, for example on how you use the website, is only collected if you have given your consent.
What do we use your data for? To provide the website without errors, to handle your enquiries and applications and – with your consent – to analyse and improve the use of the website.
What rights do you have? You can request information about your stored data at any time, ask for it to be corrected, deleted or its processing restricted, object to processing, withdraw your consent and lodge a complaint with a supervisory authority. Details are set out in section 3.
3. General information and mandatory disclosures
Legal bases
We process personal data on the following legal bases under the General Data Protection Regulation (GDPR):
Art. 6(1)(a) GDPR where you have given consent. Where consent covers storing information on, or accessing information from, your device (e.g. cookies), this is additionally based on Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
Art. 6(1)(b) GDPR where processing is necessary for the performance of a contract or for steps prior to entering into a contract, for example enquiries about our services or job applications.
Art. 6(1)(c) GDPR where we are legally obliged to process data, for example under statutory retention obligations under commercial and tax law.
Art. 6(1)(f) GDPR where processing is necessary for our legitimate interests and your interests do not override them. We state the respective interest in the sections below.
Information that is strictly necessary to operate the website is stored on your device without consent on the basis of Section 25(2) no. 2 TDDDG.
Storage period
Unless a more specific storage period is stated in this policy, we store your data until the purpose of processing no longer applies, you withdraw your consent or you validly request deletion. Where statutory retention obligations apply (e.g. under commercial or tax law), we delete the data once these have expired.
Recipients
We only disclose personal data where a legal basis permits this. Service providers processing data on our behalf (e.g. hosting) are engaged only on the basis of a data processing agreement pursuant to Art. 28 GDPR.
Transfers to third countries
Some of the providers we use are based in the USA or transfer data there. The European Commission has adopted an adequacy decision for the USA (EU-US Data Privacy Framework, “DPF”), which applies to companies certified under the DPF. For each provider we state whether it is certified. In addition, we have agreed Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR with these providers.
Withdrawal of consent
You can withdraw any consent you have given at any time with effect for the future; for cookies and similar technologies via the “Cookie settings” icon at the bottom left of every page. The lawfulness of processing carried out before the withdrawal remains unaffected.
Your rights
Under the GDPR you have the following rights:
Access to your data stored by us (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure of your data (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing (Art. 21 GDPR, see below)
To exercise these rights, please contact the controller or our Data Protection Officer.
Right to object under Art. 21 GDPR: Where we process your data on the basis of Art. 6(1)(e) or (f) GDPR, you may object at any time on grounds relating to your particular situation; this also applies to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where your data is processed for direct marketing, you may object at any time without giving reasons.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.
No automated decision-making
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
SSL/TLS encryption
This website uses TLS encryption, recognisable by “https://” and the padlock icon in your browser’s address bar. Data you transmit to us cannot be read by third parties.
4. Hosting and delivery of the website
Vercel
This website is hosted by Vercel and delivered via its global server network. The provider is Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you access the website, Vercel processes in particular your IP address, date and time, the page requested, the referrer and browser and device information (server log files, see section 5). Vercel also sets a strictly necessary cookie (“__vdpl”) so that you consistently receive the same version of the website during a visit.
Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, fast and reliable provision of the website. The cookie is set on the basis of Section 25(2) no. 2 TDDDG. We have concluded a data processing agreement with Vercel. Vercel is certified under the DPF; Standard Contractual Clauses apply in addition. Further information: https://vercel.com/legal/privacy-notice.
Storyblok
We manage the content of this website in the content management system Storyblok. Images, videos and other files are delivered via Storyblok’s content delivery network. The provider is Storyblok GmbH, Peter-Behrens-Platz 10, 4020 Linz, Austria. When these files are loaded, your IP address is transmitted to Storyblok and its infrastructure partners.
Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the fast and reliable delivery of content. We have concluded a data processing agreement with Storyblok. Further information: https://www.storyblok.com/legal/privacy-policy.
5. Data collected on this website
Server log files
Each time the website is accessed, the following data is collected automatically: IP address, date and time of the request, page requested, referrer URL, browser type and version and operating system. This data is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the technically error-free presentation, stability and security of the website. Log data is deleted after 30 days at the latest unless it is needed longer to investigate a security incident.
Cookies and similar technologies
Cookies are small text files stored on your device. Entries in your browser’s local storage work in a similar way. We set strictly necessary cookies and entries without consent on the basis of Section 25(2) no. 2 TDDDG, and all others only with your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR. A complete overview of all cookies with purpose, provider and storage period can be found in the cookie settings.
Contact form
If you contact us via the contact form, we process your details (first name, last name, email address, optionally phone number, your message) to handle your enquiry and any follow-up questions. Only the email address is mandatory. To protect against misuse, the form sets a strictly necessary security cookie (“__Host-csrf”).
The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in handling the enquiries addressed to us. We delete your data once your enquiry has been fully dealt with and no statutory retention obligations apply.
Enquiries by email or phone
If you contact us by email or phone, we process your enquiry including the personal data provided in order to deal with your request. Legal bases and storage period are the same as for the contact form.
Saved jobs list
On the “Jobs” page you can add job advertisements to a saved list. This list is stored exclusively in your browser’s local storage and is not transmitted to us. The legal basis is Section 25(2) no. 2 TDDDG, as storage is necessary for this function you have requested. You can clear the list at any time or delete it via your browser settings.
6. Consent management, analytics and statistics
Cookiebot
We use the consent management platform Cookiebot to obtain, store and document your consent. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Your IP address (truncated), date and time, browser information, the URL accessed and your selection are processed. Your selection is stored in the cookie “CookieConsent” for 12 months.
The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to demonstrate consent) and Section 25(2) no. 2 TDDDG for the cookie. We have concluded a data processing agreement with Usercentrics. Further information: https://www.cookiebot.com/en/privacy-policy/.
Google Tag Manager
We use Google Tag Manager to integrate and manage analytics services on the website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager itself does not create user profiles or set cookies; however, it processes your IP address, which may also be transferred to Google LLC in the USA. It only triggers the integrated services once you have given consent (Google Consent Mode).
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in simple, consent-compliant management of the integrated services. Google is certified under the DPF.
Google Analytics 4
With your consent, we use Google Analytics 4 to analyse the use of our website statistically and to improve it. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics processes, among other things, pages viewed, time spent, clicks, source of the visit (referrer), approximate location, device, browser and operating system and a randomly generated user ID. Google Analytics 4 does not store IP addresses. The cookies “_ga” and “_ga_T44FWL84LG” are set for recognition (storage period up to 2 years). Data may be transferred to Google LLC in the USA. Analytics data is deleted after the retention period set in Google Analytics, which is 14 months at most.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you can withdraw at any time via the cookie settings. We have concluded a data processing agreement with Google. Google is certified under the DPF; Standard Contractual Clauses apply in addition. Further information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245.
Microsoft Clarity
With your consent, we use Microsoft Clarity to better understand how visitors use our website. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
Clarity records mouse movements, clicks and scrolling and creates heatmaps and recordings of individual sessions. Input in form fields is masked and not recorded. Clarity also processes device and browser information, the IP address and a user ID. For recognition, Clarity sets the cookies “_clck” (up to 1 year) and “_clsk” (1 day) and, via Microsoft domains, the cookies “CLID”, “MUID” and “SM”; servers of Microsoft Bing (c.bing.com) are also contacted. Data is stored on Microsoft servers, including in the USA.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you can withdraw at any time via the cookie settings. We have concluded a data processing agreement with Microsoft. Microsoft is certified under the DPF; Standard Contractual Clauses apply in addition. Further information: https://learn.microsoft.com/en-us/clarity/setup-and-installation/privacy-disclosure and https://privacy.microsoft.com/en-us/privacystatement.
7. Social media profiles
Our website links to our profiles on LinkedIn, Instagram, Facebook and YouTube. These are simple links; no data is transferred to these networks when you visit our website. Only when you click a link are you taken to the respective provider’s page, where its privacy policy applies.
8. Audio and video conferencing
We use Microsoft Teams for conversations with prospects, customers and applicants. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. This involves processing the data you provide to take part (e.g. name, email address), conference metadata (start, end, participants), technical data (e.g. IP address, device and connection information) and content you share in the conference (audio, video, chat, files). Recordings are only made after prior notice and with your consent.
The legal basis is Art. 6(1)(b) GDPR where the conference serves the initiation or performance of a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in efficient communication. We have concluded a data processing agreement with Microsoft. Microsoft is certified under the DPF; Standard Contractual Clauses apply in addition. Further information: https://privacy.microsoft.com/en-us/privacystatement.
9. Job applications and careers portal
Scope and purpose
You can apply to us via our careers portal karriere.fc-gruppe.de, by email to job@fc-gruppe.de or by post. We process the data from your application to decide on establishing an employment relationship. This includes in particular your name, email address, phone number, CV, optionally a cover letter and other documents, your answers to questions in the application form (e.g. how you heard about us, salary expectations, job-related questions) and notes from interviews. Only the persons involved in the selection process have access.
The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request). If you voluntarily provide special categories of personal data (e.g. severe disability), we process these pursuant to Art. 9(2)(b) GDPR in conjunction with Section 26(3) of the German Federal Data Protection Act (BDSG). If your application leads to employment, we transfer the data to your personnel file (Art. 6(1)(b) and (c) GDPR).
Careers portal and applicant management (Recruitee)
The job advertisements on this website, the careers portal karriere.fc-gruppe.de and the application form are provided using the Recruitee software. The provider is Recruitee B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands. We also manage applications received by email in Recruitee. Recruitee processes the data on our behalf; we have concluded a data processing agreement with Recruitee. Further information: https://recruitee.com/privacy.
When you visit the careers portal, Recruitee processes technical data such as your IP address, date and time, the page accessed and browser and device information in order to provide and secure the portal (Art. 6(1)(f) GDPR). The following services are used:
Visitor statistics: Recruitee records how often job advertisements are viewed and where visitors come from, so that we can evaluate the reach of our job advertisements.
Error monitoring: Recruitee uses the Sentry service (Functional Software, Inc., USA; processing on servers in Germany) to detect technical errors in the portal.
Spam protection: The application form is protected by hCaptcha (Intuition Machines, Inc., USA). Your IP address, browser information and interaction behaviour are analysed to block automated applications.
Fonts: The portal loads fonts from Google Fonts (Google Ireland Limited, Ireland). Your IP address is transmitted to Google, including Google LLC in the USA. Google is certified under the DPF.
Our legitimate interest lies in a secure, functional and abuse-protected application process and in evaluating the reach of our job advertisements. Recruitee only sets further cookies on the careers portal based on your choice in the portal's cookie notice.
Applying with XING or Indeed
On the careers portal you can apply using your XING profile (New Work SE, Am Strandkai 1, 20457 Hamburg, Germany) or Indeed profile (Indeed Ireland Operations Limited, 124 St. Stephen's Green, Dublin 2, Ireland). If you use this function, the respective provider transmits the profile data you release to us. The legal basis is Art. 6(1)(b) GDPR. Processing by the respective provider is subject to its privacy policy: https://privacy.xing.com/de/datenschutzerklaerung and https://www.indeed.com/legal.
Storage period
If no employment relationship is established, we delete your application data no later than 6 months after the end of the process. Retention during this period serves as evidence in the event of claims, for example under the German General Equal Treatment Act (Art. 6(1)(f) GDPR). If it is foreseeable that the data will be needed beyond this (e.g. in legal proceedings), we delete it only once this purpose no longer applies.
Talent pool
With your explicit consent, we add your application to our talent pool in order to contact you about suitable vacancies (Art. 6(1)(a) GDPR). Consent is voluntary, has no influence on the current process and can be withdrawn at any time. We delete data in the talent pool upon withdrawal and no later than two years after consent was given.