Privacy Notice – Website (EU)

(last updated: April 2024)

In this privacy notice, we describe how we, the No Meat Factory Inc., 9622 Hill Drive, Coldstream, BC V1B 3C8, Canada (”No Meat Factory” or “we” or “us”) process your personal data when you visit our website or use our services and which rights you have in connection with the processing of your data.

We take the protection and security of your personal data very seriously. We process your data only to the extend permitted by law, in particular the General Data Protection Regulation (“GDPR”).

I. Who can I contact?

If you have any questions or concerns regarding the use of your personal data or would like to exercise your rights, please feel free to contact us or our data protection officer.

II. Visiting our website

When you visit our website, your internet browser automatically transmits the following data (“Log Data”) to the server of our website:

  • Your current IP address assigned to the device you are using (e.g., your computer or mobile device);
  • If you visit our website via an external link, the internet address of the website from which you were redirected to our website (so-called “referrer URL”);
  • The pages you visit on our website;
  • The date, time, and duration of your visit;
  • The operating system you are using, the browser name (e.g., Internet Explorer, Firefox, etc.), the browser version and installed add-ons;
  • The name of your internet access provider;
  • The transferred data volume.

We process the Log Data to enable your use and the failure-free operation of our website, to provide information on our company, products, and services, and to protect our IT-systems from attacks and misuse. The processing is based on our and our website visitors’ legitimate interest in the safe use of our website and systems (Art. 6 para. 1 lit. f GDPR).

For the provision of our website, we use dogado GmbH, Antonio-Segni-Straße 11, 44263 Dortmund, Germany, (“dogado”) as a hosting provider. To ensure the safety of your data, we have concluded a data processing agreement with this provider which will only process your data in accordance with our instructions.

The Log Data will be deleted after 7 days at the latest, unless we are under a legal obligation to further store your data.

III. Cookies

1. General Information

On our website, we use so-called cookies and similar technologies such as web beacons. Cookies are small text files that your browser automatically creates and stores on your device when you visit our website. Cookies do not cause any damage to your device and do not contain viruses, Trojans or other malware. Basically, cookies can be distinguished by their purpose:

  • Necessary cookies: cookies that are essential to display the website correctly;
  • Functional cookies: cookies to store user information so that it does not have to be entered again (e.g., language setting);
  • Performanceandanalysiscookies: cookies to optimize our website;
  • Marketing cookies: cookies to display targeted advertising;
  • Sharing cookies: cookies to improve the interactivity of our website with other services (e.g., social networks)).

Unless cookies are strictly necessary to display the website to you (necessary cookies), we will use cookies only with your express consent.

2. Consent Management

To record and manage your consent, we use the cookie consent manager CCM19 provided by Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany (“Papoo”). To ensure the protection of your data, we have concluded a data processing agreement with Papoo which will only process your data on our instructions. We will process your data in Germany.

For the consent management, we process the following data:

  • Consent data (consent ID, time of consent, opt-in/opt-out, language);
  • Device data (HTTP agent, HTTP referrer, HTTP page);
  • Anonymized IP data.

We process your data to comply with our legal obligations to manage and record your consent. Legal basis for this processing is Art. 6 (1) lit. c GDPR. Furthermore, we base the processing on our legitimate interest in complying with such obligations (Art. 6 (1) lit. f GDPR).

We will delete your data after […] unless we are under a legal obligation to further store your data.

3. Google Analytics

If you have given your consent, we will use Google Analytics 4 (“GA4”), a web analytics service provided by Google LLC (“Google”) on our website.

Nature of the processing

GA4 uses cookies that enable an analysis of your use of our websites. The information collected by means of the cookies about your use of this website is generally transferred to a Google server in the USA and stored there.

GA4 has IP anonymisation enabled by default. Due to IP anonymisation, your IP address will be shortened by Google within Member States of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. According to Google, the IP address transferred by your browser as part of GA4 will not be merged with other Google data.

During your website visit, your user behavior is recorded in the form of "events". Events can be:

  • Page views;
  • First visit to the website;
  • Start of session;
  • Web pages visited;
  • Your "click path", interaction with the website;
  • Scrolls (whenever a user scrolls to the bottom of the page (90%));
  • Clicks on external links;
  • Internal search queries;
  • Interaction with videos;
  • File downloads;
  • Seen Ads / clicked Ads.

Also recorded:

  • Your approximate location (region);
  • Date and time of your visit;
  • Your IP address (in shortened form);
  • Technical information about your browser and the end devices you use (e.g. language setting, screen resolution);
  • Your internet service provider;
  • The referrer URL (via which website/advertising medium you came to this website).
Purposes of the data processing

Google will use this information to evaluate your use of our website and compile reports on website activity for us. The reports provided by GA4 serve to analyze the performance of our website.

Recipients

Recipients of the data are/may be

  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor under Art. 28 DSGVO);
  • Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA;
  • Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.
Third country transfer

For the USA, the European Commission adopted a new adequacy decision on 10 July 2023. Google LLC is certified under the EU-US Privacy Framework. Since Google servers are distributed worldwide and a transfer to third countries (for example to Singapore) cannot be completely ruled out, we have also concluded the EU standard contractual clauses with Google to establish an appropriate level of data protection in those countries.

Retention period

The data sent by us and linked to cookies are automatically deleted after 2 months. The maximum lifespan of Google Analytics cookies is 2 years. The deletion of data whose retention period has been reached occurs automatically once a month.

Legal basis

The legal basis for this data processing is your consent pursuant to Art.6 (1) lit. a GDPR and § 25 (1) TTDSG.

Withdrawal

You can withdraw your consent at any time with effect for the future by accessing the cookie settings [SET THE LINK TO COOKIE SETTINGS HERE] and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.

You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may result in a restriction of functionalities on this and other websites. You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google, and the processing of this data by Google, by

  1. not giving your consent to the setting of the cookie or
  2. downloading and installing the browser add-on to deactivate Google Analytics HERE.

For more information on Google Analytics' terms of use and Google's privacy policy, please visit https://marketingplatform.google.com/about/analytics/terms/us/ and at https://policies.google.com/?hl=en.

IV. Applications

We are delighted that you are interested in working with us.

For your application, we will process the data you provide, that might include:

  • Master data (e.g., title, name, date and place of birth, nationality, private contact details, etc.);
  • Applicationdata (e.g., cover letter, CV, references, qualifications, certificates, etc.);
  • Informationonmaritalstatus (marriage, registered civil partnership, children), which may include sexual orientation, if you have provided this in your application;
  • Health data (severe disability or equalization): You have the option to provide voluntary information regarding sensitive personal data related to severe disability or equalization. By doing this, you can ensure that the representative body for severely disabled persons is involved in the selection process.

[If you apply via our career portal, we will use the following data to get you registered and to set up a user account:

  • Contact data (title, name, email address);
  • Username;
  • Password.

To activate your user account, we use a double opt-in procedure. You will receive an email requesting confirmation of your request to create a user account. As soon as we receive your confirmation, we will activate your account.]

While you are under no statutory or contractual obligation to provide us with your data, we might not be able to consider your application without it.

We process this data to assess your suitability for the position you are applying for (or any other open positions in our companies) and to carry out the application process. Legal basis for the processing is Art. 6 (1) lit. b GDPR and Sec. 26 (1) German Federal Data Protection Act (“BDSG”).

If your application includes special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g., information on health, religion, ethnic origin, political views), we will only process such data if you have given us your prior express consent (Art. 9 (2) (a) GDPR) or such processing is permitted by employment, social security, and/or social protection law (Art. 9 (2) lit. b GDPR).

We process your data in Canada which provides an adequate level of protection for your data as confirmed by an Adequacy Decision issued by the European Commission (Art. 45 (1) GDPR).

If we reject your application, we will delete your data after 6 months at the latest, unless you have expressly given us your consent (Art. 6 (1) (a), Art. 7 GDPR) to the further storage of your data. In such case, we will keep your data in the pool of applicants and inform you of any vacancies that might suit you. We will delete the data stored in the pool of applicants after 2 years. We might keep your data for a longer period, if we are legally obliged or entitled to do so (e.g., in case of a legal dispute, we will retain your personal data as long as necessary for the establishment, exercise or defence of legal claims).

If your application is successful, we will generally store your data for the duration of the employment relationship and for further four years thereafter. In such case, we will provide you with detailed information on how we process your personal data and for how long we keep it in our employee data protection policy.

V. Contact form

If you have any questions or requests, please do not hesitate to contact us. When you contact us via the contact form on our website, we will process the following personal data that you have provided when contacting us:

  • Your contact details (e.g., e-mail address, name, telephone number) and
  • Other data, depending on the type of information provided by you in your request.

We process your data to answer your questions, to respond to your request and to process your matter. While you are under no statutory or contractual obligation to provide us with your data, we will not be able to respond to your request or to process your matter without it.

We process your data to pursue our legitimate interests in processing your request and to provide you with the best possible service (Art. 6 (1) lit. f GDPR).

For the provision of the contact form, we use the services of dogado. To ensure the safety of your data, we have concluded a data processing agreement with dogado which will only process your data in accordance with our instructions.

We will delete your personal data [one] year following the completion of your enquiry, unless we are legally obliged to store it for a longer period.

VI. Communication with our business partners

To establish and maintain our business relationships with our business partners (e.g., suppliers, logistic and other service providers) we process personal data of our business partners and their employees and representatives.

The personal data our business partners provide to us can include, e.g.,

  • Title;
  • Name;
  • Email address;
  • (Business) Address;
  • Phone number;
  • Information on professional tasks, company affiliation and position and
  • Bank details.

We process such personal data to establish and maintain a relationship with our business partner. We base the processing on our and our business partners’ legitimate interest in establishing and maintaining business relationships (Art. 6 (1) (f) GDPR).

While you are under no statutory or contractual obligation to provide us with your data, we will not be able to establish or maintain a business relationship with you or your company without it.

Furthermore, we might process your data to conclude contracts with you or the company you work for. If you enter into a contract with us as an individual, or we take steps at your request prior to entering into a contract, the legal basis for the data processing is Art. 6 (1) (b) GDPR.

In all other cases, e.g. if we enter into a contract with the company you are working for, we process your data pursuing our legitimate interests and those of our business partners in establishing and maintaining business relationships (Art. 6 (1) (f) GDPR).

We process your data in Canada which provides an adequate level of protection for your data as confirmed by an Adequacy Decision issued by the European Commission (Art. 45 (1) GDPR).

We will store your data for the duration of our business relationship and for additional thereafter [four years], unless we are legally obliged to store it for a longer period.

VII. Data exchange within the No Meat Factory group

As part of an international group of companies, we exchange data we obtain with our group companies to continue making our products and services better.

We exchange the following data:

  • Customer preferences;
  • Data collected during the use of our website;
  • […]

We exchange this data for the purpose of internal administrative purposes such as improvement of our products. As a company focused on customer satisfaction, we strive for bringing the best possible product on your plate. We also use the data for marketing purposes and to sustainably improve our marketing strategy in order to convince more people of our products. In doing that, we can organize our strategic orientation on the markets and steer our company in the right direction. Furthermore, we process your data to comply with applicable law – for example, to fulfill tax or reporting obligations or to comply with a lawful government request.

We process your data to pursue our legitimate interests in product improvement and the marketing of our products and services (Art. 6 (1) (f) GDPR). When processing your data to comply with legal obligations, the legal basis for the processing is Art. 6 (1) (c) GDPR.

We share your data between No Meat Factory Europe GmbH, Weidenbaumsweg 13, 21029 Hamburg and No Meat Factory, 9622 Hill Drive, Coldstream, BC V1B 3C8, Canada. Canada provides an adequate level of protection for your data as confirmed by an Adequacy Decision issued by the European Commission (Art. 45 (1) GDPR). ´

The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected and/or lawfully exchanged, unless contractual or legal obligations prevent deletion.

VIII. Social media plugin

We do not use any social media plugins on our website. Where our website contains social media icons (e.g., LinkedIn), we only use these to passively link to the social media sites.

IX. What rights do you have?

You have the right

  • to obtain confirmation as to whether or not personal data concerning you are being processed and, where that is the case, to access the personal data as well as to obtain information regarding the data processing (e.g. purposes of data processing, envisaged period for which the data is stored, recipients or categories of recipients to whom the personal data is disclosed, data transfer performed by us etc.) and to obtain a copy of the personal data stored concerning you (Art. 15 GDPR).
  • to obtain without undue delay the rectification of inaccurate personal data concerning you as well as the completion of incomplete personal data concerning you stored by us (Art. 16 GDPR).
  • to obtain the erasure of the personal data concerning you stored by us without undue delay if the statutory requirements are met (Art. 17 GDPR). This may be the case, in particular,
    • if your personal data is no longer necessary in relation to the purposes for which they were collected;
    • the sole legal ground for the processing was your consent and you have withdrawn it;
    • you have objected to the processing based on the legal ground of legitimate interests on grounds relating to your particular situation and we cannot prove that there are overriding legitimate grounds for the processing;
    • your personal data has been unlawfully processed, or
    • your personal data has to be erased for compliance with a legal obligation.
  • to obtain, under certain conditions, restriction of processing (i.e., the marking of stored personal data in order to restrict their future processing) (Art. 18 GDPR). The requirements are, in particular:
    • the accuracy of your personal data is contested and we must verify the accuracy of your personal data;
    • the processing is unlawful, but you oppose the erasure of the personal data and instead request the restriction of the use of the personal data;
    • we no longer need your personal data for the purposes of processing, but you require the data for the establishment, exercise, or defense of legal claims, or
    • you have objected to the processing and the verification is pending whether our legitimate grounds override yours.
  • to receive the data in a structured, commonly used, and machine-readable format and to transfer that data to another controller without hindrance from us, provided that
    • the processing is based on consent or on a contract,
    • the processing is carried out by automated means and
    • the rights and freedoms of others are not adversely affected (Art. 20 GDPR).

You also have the right to have the personal data transferred directly from us to another controller where technically feasible.

  • to object at any time to the processing of your personal data on grounds relating to your particular situation, if we process your personal data on the basis of legitimate interests or in the public interest (Art. 21 GDPR). In addition, you have an unrestricted right to object if we process your data for our direct marketing purposes. Please see our separate note in the "Information on your right to object" section highlighted below.
  • to withdraw your consent to the processing of your personal data at any time (Art. 7 (3) GDPR). Please note that the withdrawal shall only be effective for the future. Processing that occurred before the withdrawal shall not be affected.
  • to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data is unlawful (Art. 77 (1) GDPR). The right to lodge a complaint is without prejudice to any other administrative or judicial remedy. The address of the data protection supervisory authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
(The Hamburg Representative for Data Protection and Freedom of Information)
Ludwig-Erhard-Str. 22
20459 Hamburg
Deutschland / Germany

However, you can also lodge a complaint with any other data protection supervisory authority competent for you within or outside the EU, in particular with the one in the Member state of your habitual residence, place of work or place of the alleged infringement. Please find hereinafter a link where you can find all contact details of the national authorities in all member states: https://edpb.europa.eu/about-edpb/board/members_en.

Information on your right to object (Art. 21 GDPR)

Right to object on grounds relating to your particular situation

You have the right to object to the processing of your personal data on grounds relating to your particular situation. The prerequisite for this is that the data processing takes place in the public interest or on the basis of legitimate interests. This also applies for any profiling. In the event of an objection, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing of such data which override your interests, rights, and freedoms or your personal data are used for the establishment, exercise, or defense of legal claims or there are grounds permitting the processing of your personal data, notwithstanding your objection, under applicable local laws, provided that such processing is not restricted under the GDPR.

Objection to the processing of your data for our direct marketing purposes

Where we process your personal data for direct marketing purposes, you will be informed at the latest at the time of the first communication with you about this and have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object to the processing for direct marketing purposes, we will no longer process your personal data for such purposes.

Exercise of the right to object

The objection can be exercised in any form and should preferably be addressed to the contact details listed in Section I.