Data Protection Social Media

Data Protection Overview

In addition to the following information, we provide you with an overview of the processing of your personal data and your rights under data protection law.

Zur Übersicht

Data Protection Notice for Visiting Social Media Platforms

1. Who is responsible for data processing and to whom can I address inquiries?

grenke AG (hereinafter “grenke AG” or “We”) welcomes your visit to our social media presences (hereinafter also “presence”, “profile” or “channel”) and your interest in our company. In addition to the general data protection notices, we inform you below about the handling of your data on our social media presences. Whenever you provide us with personal data, we treat it with the care required in the market and in accordance with data protection regulations. For confidential messages to us, please use postal mail for security reasons.

Data controller:
grenke AG
Neuer Markt 2
76532 Baden Baden
Phone: 07221 5007 0
Fax: 07221 5007 222

You can reach our corporate Data Protection Officer at:
grenke AG – Data Protection Officer
Neuer Markt 2
76532 Baden Baden
E mail: [email protected]

2. Purposes of data processing in the context of our social media presences

We maintain publicly accessible profiles on various social networks. Your visit to these profiles triggers a multitude of data processing operations. When you visit our profiles, your personal data (e.g., name, age, address, photos, e mail address, possibly also IP addresses) are processed not only by us but also by the operators of the respective social network. This also applies if you do not have a personal profile on the network. Generally, the social networks allow you to create your own posts, react to our posts, or exchange private messages. If you contact us via a social media presence – for example by commenting on a post or sending us a message – we process the associated personal data (e.g., your name and the content of the communication) solely to handle your request. The specific processing steps and their scope differ depending on the operator of the respective network. Details on the collection and storage of your personal data, as well as on the type, scope and purpose of its use by the network operator, can be found in the privacy information of the respective operator (see below).

3. Alternative information and communication offers

Using our social media presences is not required to contact us or to obtain information. Our social media channels are merely an additional offering. On our website www.grenke.de (where you will also find further contact options) we provide alternative information and communication possibilities that can be used without accessing the social media channels.

4. Legal basis for data processing

The legal basis for the processing in the respective presences is, pursuant to Art. 6 (1) f GDPR, our legitimate interest in providing a contemporary, targeted and supportive information and interaction possibility (including recruitment) for and with our users and visitors.

5. Recipients of the data

Within our company, only those units that need the data to handle your request have access to them – especially the departments responsible for managing our social media presences (e.g., corporate communications, marketing, recruitment) and, where necessary, the business units to which we forward your inquiry.

Additional recipients of your personal data are:

The operators of the respective social media platforms – when you visit our presences or contact us through them, your data are processed by the platform operator. Details, including possible transfers to third countries, are provided in the platform specific notices and the operators’ privacy information.
Our service providers (data processors) – where required, we employ service providers that support us in managing and operating our social media presences (e.g., providers of social media and community management tools such as Meta Business Suite). They process your data only on our instructions and under a data processing agreement. Our processors are carefully selected and regularly reviewed.

A further transfer of your data to other recipients occurs only if a legal obligation exists, if it is necessary for the assertion, exercise or defence of legal claims, or if you have given us your consent.

If your data are transferred by the platform operators to countries outside the EU/EEA (third countries), this is done on the basis of guarantees provided by the operators (e.g., EU standard contractual clauses or certification under the EU US Data Privacy Framework).

6. Joint responsibility with platform operators

For some of our social media presences we share responsibility with the platform operator for certain data processing activities (joint responsibility according to Art. 26 GDPR). This mainly concerns the processing of personal data to create aggregated usage statistics (“Insights”) that the operator provides to us. These statistics are provided in an aggregated, anonymised form and do not allow any conclusions about individual persons. They give us a general overview of how our presences are used (e.g., which posts are most frequently viewed). We use these insights to continuously improve our content and tailor it to target groups.

The processing under joint responsibility is based on our legitimate interest under Art. 6 (1) f GDPR for a needs based and optimised design of our social media presences. We and the respective platform operator have agreed, in accordance with Art. 26 GDPR, who fulfills which GDPR obligations. The operators have regularly committed to assume primary responsibility for the data processed within the Insights and to provide the data subjects with the essential contents of the agreement. Regardless of this division, you can assert your data subject rights both against us and against the respective platform operator.

7. Automated decision making and profiling

Automated decision making, including profiling, pursuant to Art. 22 GDPR does not take place in the context of our social media presences.

8. Retention and deletion

All public posts you make on our social media presences remain in the timeline indefinitely, unless we delete them due to an update of the underlying topic, a legal violation, or you delete the post yourself. We have no influence over the deletion of your data by the platform operator. Accordingly, the platform’s privacy policies also apply.

If you use our profiles in social networks to contact us (e.g., by creating your own posts or reacting to one of ours), the personal data you provide are processed solely for the purpose of being able to communicate with you. When you send us a private direct message via a social media presence, we use your personal data (e.g., first name, last name) only to handle and answer your request or to fulfil your information request. Once the purpose of your contact is achieved, your personal data are generally deleted, unless statutory reasons or a compelling interest justify a longer retention period.

9. Data subject rights

Each data subject has the following rights against us:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to objection (Art. 21 GDPR)
Right to data portability (Art. 20 GDPR)

The rights of access and erasure are subject to the limitations of §§ 34 and 35 BDSG.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR in conjunction with § 19 BDSG).

A consent you have given to the processing of personal data can be withdrawn at any time. Please note that the withdrawal only affects future processing; processing that took place before the withdrawal remains unaffected.

For requests for information and the exercise of user rights, we point out that they are most effectively asserted with the social media providers, as only the providers have direct access to all user data and can take appropriate measures and provide information directly. Should you need assistance, you are welcome to contact us. We also refer you to our general data protection notices.

You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data based on Art. 6 (1) e GDPR (processing in the public interest) and Art. 6 (1) f GDPR (processing based on a legitimate interest). This also applies to profiling as defined in Art. 4 (4) GDPR.

If you lodge an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or the processing is necessary for the assertion, exercise or defence of legal claims.

10. Facebook

grenke AG uses the technical platform and services of Meta Platforms Ireland Ltd (heinafter: Meta), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for the following pages:

grenke: https://www.facebook.com/grenkegroup/

10.1 Data processing by Meta

When you visit our Facebook pages, Meta collects, among other things, your IP address and additional information stored as cookies on your PC. This information is used to provide us, as the page operator, with anonymised statistical data about the use of the Facebook page. By using the Facebook service, your personal data may be transferred by Meta from Ireland to countries outside the European Union (e.g., the USA) and processed there for purposes defined by Meta. Meta’s data‑processing information is available at the following links:

10.2 Data processing by grenke AG

grenke AG operates its Facebook profile primarily for corporate communication and to inform about our products, services, apprenticeship and career opportunities. As the operator of Facebook fan pages we can only view the information that is publicly available in your Facebook profile (e.g., public comments, likes, mentions). We have no access to the usage data that Meta Platforms collects for its statistics. If you send us a private (direct) message, we use your personal data solely to process and answer your request.

No further processing of personal data is carried out by us. In particular, we do not merge the data received via Facebook with other data sets and we do not create our own user profiles.

The processing is based on Art. 6 (1) f GDPR. Our legitimate interest lies in informing about our company, products and services, apprenticeship and career opportunities, communicating with interested parties and answering inquiries. Where the communication serves the initiation or execution of a contract, processing is based on Art. 6 (1) b GDPR.

10.3 Joint responsibility notes

We receive aggregated usage statistics from Meta in order to continuously improve the posts published on Facebook and to provide our corporate communication in a target‑group‑appropriate manner. The usage statistics do not allow any conclusions about the behaviour of individual users; they only give us an overview of the use of the Facebook page (e.g., which posts were clicked most often).

For the processing of personal data required to create these usage statistics, Meta and we are joint controllers pursuant to Art. 26 GDPR.

Meta has contractually committed, in the so‑called “Pages‑Insights” agreement, to assume primary responsibility under the GDPR for the processing of these data, to fulfil all GDPR obligations concerning these data, and to make the essential contents of this commitment available to the data subjects.

11. Instagram

Instagram is an online service for sharing photos and videos that belongs to the Meta group (formerly Facebook). grenke AG uses the technical platform and services of Meta Platforms Ireland Ltd (hereinafter: Meta), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and operates the following page:

grenke_ausbildung: https://www.instagram.com/grenke_ausbildung

11.1 Data processing by Meta

When you visit our Instagram pages, Meta collects, among other things, your IP address and additional information stored as cookies on your PC. This information is used to provide us, as the page operator, with anonymised statistical data about the use of the pages. By using Instagram, your personal data may be transferred by Meta from Ireland to countries outside the European Union (e.g., the USA) and processed there for purposes defined by Meta. Meta’s data‑processing information is available at the following links:

Information about data processing in Threads can be accessed at:

https://help.instagram.com/515230437301944

11.2 Data processing by grenke AG

grenke AG operates its Instagram profile primarily for apprenticeship marketing and to inform about training and career opportunities. As the operator of Instagram pages we can only view the information that you have placed in your public profile. This includes, in particular, public comments, likes and mentions that are visible to us. We have no access to the usage data that Meta Platforms collects for the creation of its statistics.

If you send us a private (direct) message, we use your personal data solely to process and answer your request. For this purpose we use the Meta Business Suite to manage our social‑media communication.

We do not carry out any further processing of personal data. In particular, we do not merge the data received via Instagram with other data sets and we do not create our own user profiles.

The processing is based on Art. 6 (1) lit. f GDPR. Our legitimate interest is the provision of information about apprenticeship and career opportunities, communication with interested parties, and the handling of inquiries.

11.3 Joint responsibility notes

We receive aggregated usage statistics from Meta in order to continuously improve the posts published on Instagram and to provide information about our company, apprenticeship and career opportunities in a target‑group‑appropriate manner. The usage statistics do not allow any conclusions about the behaviour of individual users; they only give us an overview of the use of the Instagram page (e.g., which posts were clicked most often).

For the processing of personal data required to create these usage statistics, Meta and we are joint controllers pursuant to Art. 26 GDPR.

12. LinkedIn

grenke AG operates the following LinkedIn pages (hosted by LinkedIn Ireland Unlimited Company, Dublin 2, Ireland):

grenke: https://www.linkedin.com/company/grenkegroup/
grenke Investor Relations: https://www.linkedin.com/showcase/grenke-investor-relations/

12.1 Data processing by LinkedIn

When you visit our LinkedIn page, LinkedIn collects usage data for which it is solely responsible. LinkedIn may also transfer the processed data to servers outside the EU, in particular to LinkedIn Corp. in the USA. LinkedIn’s data‑processing information is available at:

12.2 Data processing by grenke AG

grenke AG uses its LinkedIn profile mainly for corporate communication and to inform about our products, services, apprenticeship and career opportunities. As the operator of LinkedIn pages we can only view the information that you have placed in your public profile. This includes, in particular, public comments, reactions, recommendations and mentions that are visible to us.

If you send us a private (direct) message, we use your personal data solely to process and answer your request.

We do not carry out any further processing of personal data. In particular, we do not merge the data received via LinkedIn with other data sets and we do not create our own user profiles.

The processing is based on Art. 6 (1) lit. f GDPR. Our legitimate interest is the provision of information about our company, products and services, apprenticeship and career opportunities, communication with interested parties, and the handling of inquiries. Where the communication serves the initiation or execution of a contract, processing is based on Art. 6 (1) lit. b GDPR.

12.3 Joint responsibility

We receive aggregated usage statistics (anonymous, non‑personal information) from LinkedIn in order to continuously improve the posts published on our LinkedIn pages and to provide information about our company, products, services and apprenticeship and career opportunities in a target‑group‑appropriate manner. We have no influence on the creation of these statistics by LinkedIn and cannot draw conclusions about individual users from them.

For the processing of personal data required to create these statistics, LinkedIn and we are joint controllers pursuant to Art. 26 GDPR.

The “Insights Joint Controller Addendum” contractually specifies, among other things, which obligations under the GDPR are fulfilled by each party.

13. XING

Our XING profile is operated in Germany by New Work SE (“XING”), Dammtorstraße 30, 20354 Hamburg, Germany, and is reachable at:

grenke: https://www.xing.com/pages/grenke

13.1 Data processing by XING

When you visit our XING profile, XING is responsible for the data processing. XING’s privacy notice and contact options are available at:

https://privacy.xing.com/de/datenschutzerklaerung

13.2 Data processing by grenke AG

grenke AG uses its XING profile mainly for corporate communication and to inform about our products, services, apprenticeship and career opportunities. As the operator of a XING profile we can only view the information that you have placed in your public profile. This includes, in particular, public comments, recommendations and other interactions that are visible to us.

If you send us a private (direct) message, we use your personal data solely to process and answer your request.

We do not carry out any further processing of personal data. In particular, we do not merge the data received via XING with other data sets and we do not create our own user profiles.

14. kununu

grenke AG maintains a company profile (“grenke”) on kununu. kununu is a XING website and therefore also a service of New Work SE. Information on data processing on kununu is provided at the following links:

14.1 Data processing by kununu

When you visit our company profile on kununu, kununu (or New Work SE) is responsible for processing your personal data. Information about your rights as a data subject can be found in kununu’s (or New Work SE’s) privacy information.

14.2 Data processing by grenke AG

grenke AG uses its kununu company profile mainly for corporate communication and to inform about apprenticeship and career opportunities. As the operator of a kununu company profile we can only view the publicly accessible information that you provide in connection with your profile or your interactions on kununu.

If you contact us via kununu or send us a message, we use your personal data solely to process and answer your request.

We do not carry out any further processing of personal data. In particular, we do not merge the data received via kununu with other data sets and we do not create our own user profiles.

The processing is based on Art. 6 (1) lit. f GDPR. Our legitimate interest is the provision of information about our company as well as apprenticeship and career opportunities, communication with interested parties, and the handling of inquiries.

15. YouTube

grenke AG uses the video portal “YouTube” of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: Google) and operates the following channel:

grenke: https://www.youtube.com/channel/UCk-jcQdjNlig6RPtIEHDUbQ

15.1 Data processing by Google

When you visit our YouTube channels, Google is solely responsible for the data processing. Google collects your personal data and may transfer it to the USA, Ireland or any other country where Google operates, regardless of your place of residence. Google’s data‑processing information is available at:

15.2 Data processing by grenke AG

grenke AG uses its YouTube channels mainly for corporate communication and to inform about our products, services, apprenticeship and career opportunities. Google uses certain data collected from YouTube users (e.g., which videos are watched) to create aggregated usage statistics (“YouTube‑Insights”) that are provided to the channel operator. We also receive such aggregated statistics. These reports help us adapt our YouTube channel to user needs and continuously optimise it.

We are generally unable to identify individual users based on these usage statistics.

If you contact us via our YouTube channel, for example by commenting on a video, we process your data (e.g., your name and the communication content) solely to handle and answer your request.

We do not carry out any further processing of personal data. In particular, we do not merge the data received via YouTube with other data sets and we do not create our own user profiles.

16. Glassdoor

Glassdoor is a website of Glassdoor LLC, 300 Mission Street, 16th Floor, San Francisco, CA 94105, USA. grenke AG’s company profile is available at:

https://www.glassdoor.de/%C3%9Cberblick/Arbeit-bei-grenke-EI_IE728353.11,17.htm

16.1 Data processing by Glassdoor

When you visit our company profile on Glassdoor, Glassdoor is responsible for processing your personal data. Glassdoor processes personal data primarily to provide and improve the platform, to display and manage employer reviews, and to offer additional services. Glassdoor’s privacy information is available at:

16.2 Data processing by grenke AG

grenke AG uses its Glassdoor company profile mainly for corporate communication and to inform about our company and employer attractiveness. As the operator of a Glassdoor company profile we can only view the publicly accessible information that you provide in connection with your profile, reviews or other interactions on Glassdoor, insofar as it is visible to us.

If you contact us via Glassdoor or respond to a review, we use your personal data solely to process, answer your request and, if necessary, communicate with you.

We do not carry out any further processing of personal data. In particular, we do not merge the data received via Glassdoor with other data sets and we do not create our own user profiles.

The processing is based on Art. 6 (1) lit. f GDPR. Our legitimate interest is the provision of information about our company, communication with interested parties, and the maintenance of our employer communication.

As of July 2026