Privacy Statement

CorTec GmbH takes the protection of your personal data very seriously. This privacy statement explains what personal data we collect when you visit our website at www.cortec-neuro.com, how we use it, and which rights you have. We process personal data exclusively in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

The controller responsible for data processing on this website within the meaning of Art. 4 (7) GDPR is:

CorTec GmbH
Neuer Messplatz 3
79108 Freiburg, Germany

Telephone: +49 (0) 761 70 888 100
Telefax: +49 (0) 761 70 888 0
E-Mail: info@cortec-neuro.com

Managing Directors: Dr. Frank Desiere, Dr. Oliver Bärtl, Dr. Martin Schüttler
Register court: Local Court (Amtsgericht) Freiburg, HRB 705960

We have appointed an external data protection officer, whom you can contact with any questions regarding data protection at CorTec:

DSBONE GmbH
Todtmooser Straße 43
D-79664 Wehr

E-Mail: datenschutz@cortec-neuro.com

You have the following rights regarding the personal data we hold about you. To exercise them, please contact us using the details in section 1.

• Right of access (Art. 15 GDPR) – to obtain confirmation as to whether we process your data and, if so, to receive information about it.
• Right to rectification (Art. 16 GDPR) – to have inaccurate data corrected or incomplete data completed.
• Right to erasure (Art. 17 GDPR) – to have your data deleted, provided no statutory retention obligations prevent this.
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR).
• Right to object (Art. 21 GDPR) – see section 4.
• Right to withdraw consent (Art. 7 (3) GDPR) – you may withdraw any consent you have given at any time with effect for the future.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

The supervisory authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de.

Where we process your personal data on the basis of our legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object to that processing at any time on grounds relating to your particular situation. If you object, we will no longer process the affected data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

If we process your data for direct marketing purposes, you have the right to object at any time to processing for such marketing. To object, an informal message to the contact details in section 1 is sufficient.

This website uses TLS/SSL encryption for security reasons and to protect the transmission of confidential content. You can recognise an encrypted connection by the “https://” prefix in your browser’s address bar. We also apply appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

Our website is hosted by an external service provider (processor) on our behalf:

[Please insert the name and address of your hosting provider.]

When you visit our website, the provider’s server automatically collects and stores information in so-called server log files, which your browser transmits automatically. This is:

• the anonymised or shortened IP address of the requesting device,
• date and time of the request,
• the specific page or file requested and the amount of data transferred,
• the HTTP status code / access status,
• the referring website,
• browser type and version, operating system and interface, and the language of the browser software.

This data is technically necessary to display our website to you and to ensure its stability and security. The legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR. We have concluded a data processing agreement (Art. 28 GDPR) with our hosting provider.

Our website currently uses only storage and access technologies that are strictly necessary for the operation of the site. We do not use cookies or comparable technologies that require your consent, and we do not carry out cross-site tracking. For this reason, no cookie consent banner is currently displayed (§ 25 (2) TDDDG).

Should we introduce services in the future that require consent, we will obtain your consent in advance via a consent management tool and update this privacy statement accordingly.

When you contact us – by e-mail, by telephone or via one of the contact forms on our website – the information you provide (for example your name, e-mail address, telephone number and the content of your message) is processed by us to handle your enquiry. Submissions made through our contact forms are forwarded to the responsible department internally by e-mail; the forms do not create publicly accessible databases.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to the performance of a contract or pre-contractual measures, and otherwise our legitimate interest in responding to enquiries (Art. 6 (1) (f) GDPR) or, where applicable, your consent (Art. 6 (1) (a) GDPR). We delete this data once your enquiry has been dealt with conclusively and no statutory retention obligations require further storage.

When you apply for a position at CorTec – whether via our careers page, by e-mail or by post – we process the personal data you provide (such as your contact details, CV, cover letter, certificates and references and other application documents) for the purpose of the application procedure and to decide whether to establish an employment relationship. The legal basis is § 26 (1) BDSG (data processing for employment purposes) in conjunction with Art. 6 (1) (b) GDPR; where you have given your consent, Art. 6 (1) (a) GDPR applies.

For the management of applications we use HRworks, a service of HRworks GmbH, Waldkircher Str. 28, 79106 Freiburg, Germany (www.hrworks.de), which processes the data on our behalf as a processor under a data processing agreement (Art. 28 GDPR).

If your application does not lead to employment, we delete your application data no later than six months after the application procedure has been concluded, unless you have consented to longer storage (for example in a talent pool) or we are legally entitled or required to retain it.

With your consent, you can subscribe to our newsletter, through which we inform you about CorTec and our offering. The only mandatory information for sending the newsletter is your e-mail address; any further, separately marked details are provided voluntarily and are used to address you personally.

We use the double opt-in procedure: after you register, we send a confirmation e-mail to the address you provided and only add you to the distribution list once you have confirmed. This allows us to demonstrate that the subscription was genuinely requested by you. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR, which you can withdraw at any time – for example via the unsubscribe link in every newsletter or by message to the contact details in section 1.

Our newsletter is sent using rapidmail, a service of rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg i. Br., Germany. rapidmail processes the data on our behalf as a processor under a data processing agreement (Art. 28 GDPR), and the data is stored on servers in Germany. The newsletter contains a tracking pixel that allows us to see, on a pseudonymised basis, whether and when e-mails were opened and which links were clicked, so that we can tailor our content. Further information is available in rapidmail’s privacy policy at www.rapidmail.de/datenschutz.

To understand how our website is used and to improve it continuously, we use Plausible Analytics, a privacy-friendly web analytics service. Plausible is operated within the European Union and the analytics data is hosted on servers in the EU.

Plausible works without cookies and does not store any information on your device that would require consent. It does not collect or store personal data and does not track visitors across websites or over time. All measurements are aggregated, which means that individual visitors cannot be identified. Because the data is anonymous and no information is stored on or read from your device beyond what is strictly necessary, no consent is required. The legal basis for this statistical analysis is our legitimate interest in a needs-based and functional design of our website pursuant to Art. 6 (1) (f) GDPR.

Further information is available at plausible.io/data-policy.

We use Microsoft Teams, part of the Microsoft 365 suite provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, to hold online meetings and webinars – including with external participants.

When you take part in a meeting or webinar, we process the data required to run it. Depending on the session, this may include your name, e-mail address, the organisation you represent, meeting metadata (such as dial-in times and duration), text-chat content, and – if you choose to share them – audio, video and shared screen content. Meetings are only recorded where this is announced in advance; in that case the recording is based on your consent (Art. 6 (1) (a) GDPR).

The legal basis for processing in connection with meetings and webinars is Art. 6 (1) (b) GDPR where the meeting takes place in a contractual context, and otherwise our legitimate interest in effective online communication (Art. 6 (1) (f) GDPR). Microsoft acts as our processor under a data processing agreement (Art. 28 GDPR). Where data is transferred to Microsoft Corporation in the USA, this is safeguarded by Microsoft’s certification under the EU–US Data Privacy Framework and by the EU Standard Contractual Clauses. Further information can be found in the Microsoft privacy statement at privacy.microsoft.com/privacystatement.

To deliver ordered goods, we pass on the personal data required for delivery – in particular the recipient’s name and delivery address and, where necessary, an e-mail address or telephone number for delivery notifications – to the logistics service providers we commission. These providers process the data on our behalf as processors under data processing agreements (Art. 28 GDPR). The legal basis is the performance of the contract pursuant to Art. 6 (1) (b) GDPR and our legitimate interest in reliable delivery pursuant to Art. 6 (1) (f) GDPR. We currently work with the following providers:

• GO! Express & Logistics (Germany) GmbH, Brühler Straße 9, 53119 Bonn, Germany (general-overnight.com)
• MBE Deutschland GmbH, Bundesallee 39–40a, 10717 Berlin, Germany (mbe.de)

We maintain profiles on the social networks listed below and link to them from our website. These are simple links only – we do not embed any social media plug-ins, and no data is transmitted to the providers when you merely view our website. Data is only transferred once you click a link and visit the respective platform, where the provider’s own privacy policy applies. We have no influence over the data processing carried out by these providers.

• LinkedIn – LinkedIn Ireland Unlimited Company, Dublin, Ireland (privacy policy)
• YouTube – Google Ireland Limited, Dublin, Ireland (privacy policy)
• Vimeo – Vimeo, Inc., New York, USA (privacy policy)
• X (formerly Twitter) – Twitter International Unlimited Company, Dublin, Ireland (privacy policy)
• Facebook – Meta Platforms Ireland Limited, Dublin, Ireland (privacy policy)

When you visit our profiles or interact with our content on these platforms, the respective provider processes your personal data as (joint) controller. The legal basis for maintaining our presence and linking to it is our legitimate interest in public relations and communication pursuant to Art. 6 (1) (f) GDPR.

Some of the providers named above are based in a third country (in particular the USA) or process data there. Where personal data is transferred to a third country, we ensure an adequate level of protection, in particular through the recipient’s certification under the EU–US Data Privacy Framework, through the EU Standard Contractual Clauses (Art. 46 GDPR), or through your explicit consent. You can request further details and a copy of the relevant safeguards from us using the contact details in section 1.

We process and store your personal data only for as long as is necessary to achieve the purpose for which it was collected, or for as long as statutory retention periods (for example under commercial or tax law) require. Once the purpose ceases to apply and no retention obligation remains, the data is deleted or its processing is restricted.

We review this privacy statement regularly and update it where necessary to reflect changes to our website, our services or the applicable legal requirements. The version published here always applies.

Last updated: July 2026.