Privacy Notice

I. Data Controller

The controller responsible for the processing of personal data described in this Privacy Notice is:

II. Data Protection Officer

You can contact our Data Protection Officer at:

datenschutz@abx-cro.com

You may contact our Data Protection Officer directly with any questions or concerns relating to the processing of your personal data or the exercise of your rights under applicable data protection rights.

III. Contacting us by e-mail

If you contact us by e-mail, we process the personal data contained in your message, including your contact details and any other information you chose to provide, in order to respond to and handle your enquiry.

Where your enquiry relates to contract, the legal basis for the processing is Article 6(1)(b) GDPR. In all other cases, the legal basis is Article 6(1)(f) GDPR. Our legitimate interests are to communicate with persons who contact us and to respond appropriately to enquiries concerning our company and its activities.

We retain the data for as long as needed to respond to and deal with your enquiry. Longer retention may apply where required by statutory retention obligations or where the data is required for the establishment, exercise or defence of legal claims.

IV. Visiting our Website / Server Log Files

When you visit our website, certain technical information is processed automatically in order to establish the connection and deliver the website content. Each visit to the website is logged with the visitor’s IP address and a timestamp.

The log data are processed to ensure the secure, stable and reliable operation of our website, to protect out IT systems and to generate statistical information about geographical distribution of website visitors.

The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable operation of our website, the protection of our IT systems and the generation of general geographic usage statistics.

Server log data are retained for a maximum of 12 months.

V. Hosting

Our website is hosted by Dogado GmbH, Germany on servers is located in Germany. Website data stored on our infrastructure is stored within the European Economic Area,

VI. Cookies and Similar Technologies

Our publicly accessible website does not use cookies or similar browser storage technologies.

VII. Web Analytics

We do not use web analytics tools, tracking pixels, visitor-specific identifiers or profiling technologies on our publicly accessible website. However, server log data are used to generate general statistical information about the countries from which visitors access our website.

VIII. Job Applications

If you apply for a position advertised on our website by e-mail, we process the personal data you provide as part of your application for the purpose of assessing your application and deciding whether to establish an employment relationship with you.

For applications relating to employment in Germany, the legal basis for this processing in Section 26 (1) sentence 1 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).

Further information on the processing of personal data in connection with job applications is available in our Applicant Privacy Notice.

IX. Recipients of Personal Data

We use external service providers acting on our behalf, in particular hosting and IT service providers, to operate and maintain the website. Where they process personal data on our instructions, they act as processors in accordance with Article 28 GDPR.

X. Data Subject Rights

Subject to the conditions set out in applicable data protection law, you have the following rights regarding your personal data:

• the right of access in accordance with Article 15 GDPR;
• the right to rectification in accordance with Article 16 GDPR;
• the right to erasure in accordance with Article 17 GDPR;
• the right to restriction of processing in accordance with Article 18 GDPR;
• the right to data portability in accordance with Article 20 GDPR;
• the right to object to processing in accordance with Article 21 GDPR.

Where processing is based on your consent, you also have the right to withdraw your consent at any time with effect for the future in accordance with Article 7 (3) GDPR.

XI. Right to Object

Where we process your personal data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.

XII. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes applicable data protection law.

The supervisory authority competent for us is:

Sächsische Datenschutz- und Transparenzbeauftragte

(Saxon Data Protection and Transparency Commissioner)

Maternistraße 17

01067 Dresden

Germany

Email: post@sdtb.sachsen.de

You may also lodge a complaint with another competent supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.

XIII. Retention of Personal Data

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Where specific retention periods apply to individual processing activities, these are described in the relevant sections of this Privacy Notice.

Retention periods are determined based on the purpose of the processing, statutory retention obligations and applicable limitation periods.

XIV. Requirement to Provide Personal Data

When you merely visit our website, you are generally not required by law or contract to provide personal data. Certain technical data is nevertheless required to establish a connection with the website and make its content available.

Where you contact us or apply for a position by e-mail, you decide which information you provide. However, certain information may be necessary in order for us to respond to your enquiry or process your application.

XV. Automated Decision-Making

We do not use personal data collected through this website for automated decision-making within the meaning of Article 22 GDPR.

XVI. Changes to this Privacy Notice

We may update this Privacy Notice to reflect changes to our website, our data processing activities or applicable legal requirements.

The version currently published on this website applies.

Last updated: 11 September 2026