Privacy Policy
1. Controller and Contact Details
The controller responsible for the processing of personal data on this website is:
3-core GmbH
Noeggerathstraße 13
53111 Bonn
Germany
Phone: +49 228 97274760
Email: [email protected]
If you have any questions regarding data protection or wish to exercise your rights, you can contact us using the contact details above.
2. General Information on Data Processing
We process personal data when you visit our website, contact us, use a form, request a download, take part in the Quick Check, subscribe to our newsletter, use our online tool, visit our social media profiles or apply for a position with us. The data processed depends on how you use our services.
We use service providers for the operation of our website and the handling of enquiries, for example for hosting, technical support and email communication. These service providers receive data only to the extent necessary to perform their respective tasks. Where service providers process personal data on our behalf, we enter into the required data processing agreements with them.
Personal data may be transferred to countries outside the EU or the European Economic Area, in particular in connection with the services provided by Google, Cloudflare, Meta, LinkedIn or TikTok described below. Where such transfers take place, we rely on an adequacy decision of the European Commission or appropriate safeguards, in particular the EU Standard Contractual Clauses.
3. Accessing the Website, Hosting and Server Logs
When you access our website, technically necessary connection data is processed. This may include, in particular, your IP address, the date and time of access, the page accessed, the amount of data transferred, information about your browser and operating system, the previously visited page (referrer), as well as status and error messages.
This processing is necessary to deliver the website, ensure its stability and security and identify technical faults. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of our website.
### Hosting by STRATO
We use STRATO GmbH to host our website. When the website is accessed, STRATO processes technical connection data as part of the hosting service. Under the current configuration, the access logs made available to us are retained for six days.
### Cloudflare as CDN and Proxy
Our website uses services provided by Cloudflare, Inc. Cloudflare is used as a Content Delivery Network (CDN) and proxy service and is technically positioned between visitors to our website and our hosting provider.
In this context, IP addresses, connection and device data as well as information about requested content may in particular be processed. The processing is used to provide the website quickly and reliably, manage data traffic and protect the website against abusive access and attacks.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and efficient provision of our website.
We do not use Cloudflare Web Analytics.
Further information on data processing by Cloudflare is available at:
https://www.cloudflare.com/privacypolicy/
The website uses an encrypted HTTPS connection.
4. Cookies, Similar Technologies and Consent
Our website uses cookies and comparable technologies. Some of these are necessary for the provision and functionality of the website. For services requiring consent for statistical analysis, advertising and the display of external content, we ask for your consent before they are activated.
Section 25 TDDDG applies to the storage of information on your device or access to such information. Where consent is required, we obtain it via our consent dialog. The subsequent processing of personal data by services requiring consent is based on Article 6(1)(a) GDPR.
Strictly necessary technical functions are based on Section 25(2) TDDDG; any associated processing of personal data is based, where applicable, on Article 6(1)(f) GDPR.
You can change your selection at any time via the “Cookie Settings” link in the footer of the website and withdraw any consent you have given with effect for the future. The consent dialog provides details of the individual services used and their respective storage periods.
Google Tag Manager, Google Analytics 4 and Google Ads are only loaded after the respective required consent has been given. Without consent, or if you select only essential services, these services are not loaded and no corresponding requests are sent to Google.
### Borlabs Cookie
We use Borlabs Cookie to save your selections in the consent dialog and document consent that has been given. The software is provided by Borlabs – Benjamin A. Bornschein, Rübenkamp 32, 22305 Hamburg, Germany.
Under the current configuration, the consent decision is stored for 365 days where consent is given. Where only essential services are accepted, the storage period is 182 days.
The stored selections are not transmitted to the provider solely through the use of Borlabs Cookie. The processing serves to manage and document your data protection choices.
The legal bases are Section 25(2) TDDDG and Article 6(1)(c) and (f) GDPR.
### Language Selection with WPML
We provide parts of our website in several languages and use WPML for this purpose. Cookies may be used to store the selected language and to check whether a language redirect is required, in particular _icl_visitor_lang_js, wpml_browser_redirect_test and wp-wpml_current_language.
According to our consent dialog, these cookies are stored either for the respective session or for one day, depending on their function. The processing is necessary to provide the selected language version of the website.
The legal bases are Section 25(2) TDDDG and Article 6(1)(f) GDPR.
5. Audience Measurement and Technical Analytics
### Google Tag Manager and Google Analytics 4
We use Google Tag Manager to manage website tags and Google Analytics 4 to statistically analyse the use of our website. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Tag Manager is used for the technical management and deployment of the tags used on our website. In particular, it is used to manage Google Analytics 4 and Google Ads.
Google Tag Manager and Google Analytics 4 are only loaded after you have given the relevant consent. Google Analytics 4 is assigned to the Statistics category in our consent dialog. If you consent only to statistical services, Google Analytics 4 is activated, while Google Ads tags remain disabled.
As part of Google Analytics 4, information about pages viewed, events and interactions on our website as well as technical browser, device and connection information may in particular be processed.
Google Signals is disabled. The collection of detailed location and device data is also disabled in all regions.
We use the information obtained through Google Analytics to statistically analyse the use of our website, assess its functionality and usability and improve our content.
The legal bases for storing or accessing information on your device and the subsequent processing of personal data are your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via our “Cookie Settings”.
The retention period for user-level and event-level data in our Google Analytics property is two months. The setting to reset the retention period on new activity is disabled. Aggregated standard reports may remain available for a longer period.
Our Google Analytics 4 property is linked to our Google Ads account. Personalised advertising is enabled within this link. Google Ads tags on our website are, however, only activated if you have additionally consented to the Marketing category.
Where data is processed outside the European Economic Area in connection with the use of Google services, data may in particular be transferred to Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework.
Further information on data processing by Google is available at:
https://business.safety.google/privacy/?hl=en
6. Google Ads
We use Google Ads with website tags for conversion measurement and remarketing. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Ads is only activated on our website after you have consented to the Marketing category via our consent dialog. Without this consent, the corresponding Google Ads tags are not loaded.
After you have given your consent, Google may in particular recognise whether you perform certain actions on our website after clicking on an advertisement. This enables us to measure the effectiveness of our advertising activities. Depending on the Google Ads functions used, the information obtained may also be used to display targeted or personalised advertising.
Cookies, advertising and click identifiers as well as information about your device, pages viewed and actions performed may in particular be processed.
Our Google Analytics 4 property is linked to our Google Ads account. The option for personalised advertising within this link is enabled.
The automatic collection of user-provided data via the Google tag, such as email addresses entered in forms, is disabled.
The legal bases are your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via “Cookie Settings”.
Further information:
https://business.safety.google/privacy/?hl=en
7. Contacting Us
If you contact us via our contact form, by email or by telephone, we process the contact details you provide as well as the content of your message in order to handle your enquiry and, where necessary, respond to follow-up questions.
If you contact us in connection with a specific project or contractual enquiry, the legal basis is Article 6(1)(b) GDPR for taking steps prior to entering into a contract or for the performance of a contract. For other enquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest consists in appropriately handling enquiries addressed to us and communicating with you.
The information submitted via our contact forms is not additionally stored in the WordPress system of our website.
We delete personal data processed in connection with your enquiry once the enquiry has been finally resolved and there are no statutory or other legitimate grounds requiring further storage. If the enquiry results in a contractual relationship or statutory retention obligations apply, the data required for these purposes will be retained for the corresponding longer period.
### Appointment Booking via Zeeg
The “Book an Appointment” button takes you to an external booking page provided by Zeeg, Zeeg GmbH, Friedrichstraße 155, 10117 Berlin, Germany.
Merely visiting our website does not establish a connection to Zeeg and no data is transmitted to Zeeg. The external Zeeg booking page is only opened in a new window when you click on the “Book an Appointment” button.
For a booking, the information requested there is processed, in particular your name, email address, preferred appointment time and, where applicable, voluntary information regarding the purpose of the meeting. We use this information to organise, confirm and conduct the appointment you have requested.
The legal basis is Article 6(1)(b) GDPR where you request a business meeting or the appointment relates to the preparation of a contract. For other appointments, processing is based on Article 6(1)(f) GDPR due to our legitimate interest in efficient appointment scheduling.
Zeeg processes the information required for the booking as a service provider on our behalf. We delete appointment details once the matter has been concluded and there are no contractual or statutory grounds requiring further retention.
Further information:
https://zeeg.me/de/legal/privacy
8. Quick Check and Downloads
On certain pages, we provide a Quick Check to help assess requirements for operators of critical infrastructure, as well as materials for download. As part of the Quick Check, we may request information about the company, its field of activity and its role in the provision of essential services. To send you the result or requested material, we also process the contact details and email information entered in the relevant form.
We process this data in order to carry out the requested Quick Check, communicate the result and provide the requested content. The legal basis is Article 6(1)(b) GDPR where your request concerns a pre-contractual service; otherwise, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in processing the enquiry initiated by you.
You provide the data required for a download or result voluntarily. Without a valid email address, we may be unable to send you the requested result.
We will only use your contact details for further marketing communications where separate valid consent has been obtained or where the communication is otherwise permitted by law in the specific circumstances. You may object at any time to direct marketing based on Article 6(1)(f) GDPR. Any consent you have given may be withdrawn at any time with effect for the future.
The requested download or result will also be provided if you do not subscribe to our newsletter.
9. Newsletter with CleverReach
You can subscribe to our newsletter via our dedicated newsletter subscription page. The only mandatory information we collect for this purpose is your email address.
We use your email address to send you, in particular, invitations to training sessions and workshops, information about new and updated 3-core services, as well as professional information, current developments and practical guidance relating to Corporate Resilience Management, KRITIS, NIS2, Business Continuity Management, emergency and crisis management and security management.
The legal basis for sending the newsletter is your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, in particular by using the unsubscribe link included in every newsletter or by sending an email to [email protected]. The lawfulness of processing carried out on the basis of your consent before its withdrawal remains unaffected.
Subscription to the newsletter is voluntary and is independent of whether you request a report, Quick Check, template, download or any other service from us.
### Double Opt-In Procedure
We use a double opt-in procedure for subscriptions to our newsletter.
After submitting the subscription form, you will receive an email containing a confirmation link. Your email address will only be activated for newsletter delivery once you have clicked this link and confirmed your subscription.
The subscription and confirmation process is documented so that we can demonstrate that you have given your consent. For this purpose, CleverReach records in particular the date and time of subscription and confirmation, the URL of the subscription form and – unless technically disabled – the IP address used during the subscription and confirmation process.
### Use of CleverReach
We use CleverReach to manage our recipient list, carry out the subscription procedure and send our newsletter. The provider is CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany.
Merely visiting our website or the newsletter page does not result in the data entered into the newsletter form being transmitted to CleverReach. Data is only transmitted to CleverReach when you submit the newsletter form.
For this purpose, the data required for subscription and newsletter delivery, in particular your email address and data generated in connection with the subscription and sending of the newsletter, is transmitted to CleverReach and processed there on our behalf.
CleverReach processes this data for us as a processor. We have entered into a data processing agreement with CleverReach pursuant to Article 28 GDPR.
### No Measurement of Opens and Clicks
We do not use personal or statistical measurement of newsletter opens and clicks.
The functions for measuring newsletter opens and link clicks are disabled in CleverReach. Accordingly, no tracking pixel is used in our newsletters to record opens, and links are not redirected via CleverReach tracking links for the purpose of measuring clicks.
In addition, we have activated the “Data protection conformity” function in our CleverReach account.
### Storage Period and Unsubscription
Your email address and the data required for newsletter delivery are generally stored in the active newsletter recipient list for as long as you remain subscribed to our newsletter.
After you unsubscribe, your data will be removed from the active newsletter recipient list or blocked from further newsletter delivery. Where data is required to demonstrate that consent was previously given or for the establishment, exercise or defence of legal claims, it may be retained separately for the period required for these purposes.
Further information on the processing of personal data by CleverReach is available at:
https://www.cleverreach.com/de-de/datenschutz/
10. Applications
If you apply for a position advertised on our website, we process the information and documents you send to us by email, in particular your contact details, CV, evidence of qualifications and correspondence.
We use this information exclusively to conduct the recruitment process and make a decision regarding the position. The legal basis is Section 26(1) BDSG in conjunction with Article 6(1)(b) GDPR.
Where the processing of special categories of personal data is necessary for the exercise of rights or fulfilment of legal obligations under employment law, processing is additionally based on Article 9(2)(b) GDPR and Section 26(3) BDSG.
Please do not provide any additional sensitive information that is not required for your application.
If an employment relationship is established, the required documents will be transferred to the personnel file. Otherwise, we delete application data six months after notifying you that your application has been unsuccessful, unless longer retention is required for the establishment, exercise or defence of legal claims or you have expressly consented to longer storage.
Access is limited to persons involved in filling the position.
11. Embedded Content: YouTube and Google Maps
### YouTube
Videos from YouTube are embedded on our website. YouTube is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Embedded videos are initially blocked by a placeholder on our website. A connection to YouTube is only established if you enable the respective video or consent to the use of YouTube content via our “Cookie Settings”.
Once you have given your consent, a connection is established to Google or YouTube servers. In particular, your IP address, information about your browser and device and the address of the page you are visiting may be transmitted to Google. Depending on your settings and use, additional data may be processed and cookies or comparable technologies may be used.
The legal basis for activating embedded videos and the associated access to your device is your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.
You can withdraw your consent at any time with effect for the future via “Cookie Settings”.
### Google Maps
Maps provided by Google Maps may be embedded on certain pages of our website. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Maps is initially blocked. A connection to Google is only established if you actively enable the map or consent to the use of Google Maps via our “Cookie Settings”.
Once enabled, your IP address, information about your browser and device, the page accessed and information about your use of the map may in particular be transmitted to Google. If you expressly allow access to your location on your device, location data may also be processed.
Google may use cookies and comparable technologies.
The legal bases are your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via “Cookie Settings”.
In connection with YouTube and Google Maps, data may also be processed outside the European Economic Area, in particular in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework.
Further information on the processing of personal data by Google is available at:
https://policies.google.com/privacy?hl=en
The footer of our website also contains simple links to our profiles on LinkedIn, YouTube and Instagram. Merely displaying our website does not establish a connection to the respective platforms through these links. A connection to the respective external platform is only established when you click on one of these links. The respective platform provider is responsible for the data processing that takes place there.
12. Our Social Media Profiles
We operate company profiles on YouTube, Instagram, TikTok, LinkedIn and Facebook.
If you visit our profiles, follow us, comment on, share or like posts, or send us a message, we may, depending on the platform, view and process your publicly visible profile name, the content of your interaction and other information you provide.
We process this data in order to manage our social media presence, communicate with users and respond to enquiries. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in our public relations activities, communication with prospective clients, customers and other users, and the management of our social media profiles.
Where your communication relates to the initiation or performance of a contractual relationship, Article 6(1)(b) GDPR may additionally apply.
Where we transfer messages or other personal data from social networks to our own systems, we store this data only for as long as necessary to process the relevant enquiry or as required by statutory retention obligations. We have only limited influence over the storage and deletion of data by the respective platform providers.
### Statistics and Insights
Platform providers may provide us with statistical analyses relating to the use and reach of our company profiles. These may include information about reach, views and interactions with our content. We use such statistics to analyse the use of our social media presence and further develop our content.
For so-called Page Insights on Facebook and Instagram, we may be jointly responsible with Meta Platforms Ireland Limited for certain processing activities within the meaning of Article 26 GDPR. Meta provides an agreement on joint controllership for this purpose (“Page Insights Controller Addendum”). The Insights made available to us generally contain aggregated statistical information.
For the creation of Page Insights on our LinkedIn company page, we and LinkedIn Ireland Unlimited Company are also jointly responsible pursuant to Article 26 GDPR in relation to users in the European Economic Area and Switzerland. LinkedIn provides Page Insights to us in aggregated form; individual users cannot be identified by us on the basis of these statistics.
The legal basis for our use of the statistical information provided to us is Article 6(1)(f) GDPR. Our legitimate interest is to assess the reach and use of our social media content and adapt our public relations activities accordingly.
### Data Processing by Platform Providers
When you access our company profiles, the respective platform providers process personal data under their own responsibility. This may include, in particular, usage, device, connection and interaction data.
The nature, scope, purposes and duration of such processing are governed by the privacy policies of the respective platform providers. Processing by the platform providers may also involve the transfer or processing of personal data outside the European Economic Area.
Further information on data processing by the respective providers is available here:
YouTube / Google:
https://policies.google.com/privacy?hl=de
Instagram and Facebook / Meta:
https://www.facebook.com/privacy/policy/
LinkedIn:
https://www.linkedin.com/legal/privacy-policy
TikTok:
https://www.tiktok.com/legal/page/eea/privacy-policy/de
The footer of our website contains simple links to our profiles on LinkedIn, YouTube and Instagram. Merely displaying our website does not establish a connection to the respective platforms through these links. A connection to the respective external platform is only established when you click on one of these links.
The provisions of Section 11 “Embedded Content: YouTube and Google Maps” additionally apply to YouTube videos embedded on our website.
13. Your Rights
Subject to the applicable statutory requirements, you have the right to obtain information about your personal data (Article 15 GDPR), the right to rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR) and data portability (Article 20 GDPR).
Where we process data on the basis of your consent, you may withdraw that consent at any time with effect for the future. For optional website services, you can do so via the “Cookie Settings” link in the footer of the website.
Right to Object:
Where we process your data on the basis of Article 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.
You may object to the processing of your personal data for direct marketing purposes at any time without providing reasons. Following such an objection, we will no longer process your personal data for these marketing purposes.
You also have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us in North Rhine-Westphalia is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen). You may also contact another competent supervisory authority:
14. Updates to this Privacy Policy
We update this Privacy Policy when the functions of our website, the services we use or the applicable legal requirements change. The current version is available on this page.