This supplementary privacy policy applies exclusively to the data processing carried out in connection with our use of the LinkedIn marketing and community management APIs (in particular the LinkedIn Community Management API). For all other processing activities on vellinger-systems.com, our general privacy policy at https://vellinger-systems.com/en/privacy applies. Below, we inform you in accordance with Art. 13 and 14 GDPR about the data processed in connection with the LinkedIn API, the purpose, legal basis, recipients, storage period, and your rights.
The data controller within the meaning of the GDPR and other data protection regulations is: Colin Velten Vahrenhorst Sole proprietor Akazienweg 27 33790 Halle (Westfalen) Germany Phone: +49 15679 659891 Email: c.vahr.b@gmail.com We have not appointed an external data protection officer in the absence of a legal obligation to do so.
This policy describes exclusively the processing activities that take place in the course of using the LinkedIn APIs to manage our own LinkedIn presence. This includes the LinkedIn Company Page of Vellinger Systems and the personal LinkedIn profile of the data controller. We do not operate any client business, processor services, or agency offering through the LinkedIn API integration. For all other data processing activities on the website (server logs, Plausible Analytics, hosting by Vercel, contact form, Cal.com, Resend, etc.), our general privacy policy at https://vellinger-systems.com/en/privacy applies exclusively.
We use the LinkedIn APIs exclusively for the following clearly defined functions: • Publishing and scheduling posts on our own LinkedIn Company Page and on the personal profile of the data controller • Reading and replying to comments on our own posts (community management) • Retrieving aggregated reach, follower, and engagement statistics for our own page and our own posts Expressly not used: LinkedIn direct messages (messaging API), the sending of advertising or outbound prospecting messages, the retrieval of contact lists or networks of third parties, the export or sale of LinkedIn data to third parties, and the building of independent profiles about LinkedIn members.
In the context of the LinkedIn API integration, we process the following categories of data: Stored on our side: • OAuth 2.0 access and refresh tokens for authentication against the LinkedIn API • Our own post drafts, scheduled publication times, and internal publication metadata • Our own replies to comments Obtained from the LinkedIn API: • Aggregated reach, follower, and engagement statistics for our page and our posts (anonymous or pseudonymous, without plain-text profile reference) • Comments publicly submitted on our own posts, including the full name, profile URL, headline (job title), public profile picture, and timestamp of the commenting person We do not collect or combine these data beyond the fields provided by the LinkedIn API and do not enrich them from external sources.
Processing is based on the following legal bases: • Management of our own LinkedIn presence (posting, scheduling, statistics on our own page): Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the efficient management and analysis of our own online presence. • Processing of third-party comments on our own posts: Art. 6 (1) lit. f GDPR. Our legitimate interest lies in community management on our own page. Persons who submit a comment under a publicly visible post on the Vellinger company page can reasonably expect this comment to be read, answered, and analyzed in the context of page administration. • Storage of OAuth tokens: Art. 6 (1) lit. f GDPR as a technical prerequisite for the purposes mentioned above.
Recipient of the data is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, as well as its parent company LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA. In the course of API usage, data is transferred to the USA. The USA is considered a safe third country within the meaning of the GDPR pursuant to the European Commission's adequacy decision of 10 July 2023, provided the respective recipients are certified under the EU-US Data Privacy Framework (DPF). LinkedIn is DPF-certified. EU standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR apply additionally as a further safeguard. Further information on data processing by LinkedIn can be found in the LinkedIn Privacy Policy at https://www.linkedin.com/legal/privacy-policy and in the LinkedIn API Terms of Use at https://legal.linkedin.com/api-terms-of-use. We do not transfer API data to any other third parties (e.g. for analytics, advertising, or profiling purposes outside of LinkedIn).
We store the data processed via the LinkedIn API only for as long as is necessary for the respective purpose: • OAuth tokens: until the app authorization is revoked by the data controller via the LinkedIn account, at the latest until the token validity granted by LinkedIn expires. • Own post drafts and publication metadata: as long as we actively maintain the post or analyze its performance, at the latest 24 months after publication. • Aggregated reach and engagement statistics: a maximum of 24 months, after which automatic aggregation or deletion takes place. • Comment content of third parties: exclusively for as long as these comments are publicly available on LinkedIn. If a comment is deleted on LinkedIn, we also remove it locally on the next synchronization run, at the latest after 30 days. Statutory retention periods remain unaffected.
Communication with the LinkedIn API takes place exclusively via encrypted HTTPS/TLS connections. Authentication is carried out according to the OAuth 2.0 standard with short-lived access tokens and separately stored refresh tokens. Tokens are stored in encrypted form and are accessible exclusively for the purposes described in this policy. We process the data obtained via the LinkedIn API exclusively in accordance with the LinkedIn API Terms of Use. No transfer, sale, or commercial exploitation of the data to third parties takes place.
You have the following rights against us with regard to your personal data: • Right of access (Art. 15 GDPR) • Right to rectification of inaccurate data (Art. 16 GDPR) • Right to erasure (Art. 17 GDPR) • Right to restriction of processing (Art. 18 GDPR) • Right to data portability (Art. 20 GDPR) • Right to object pursuant to Art. 21 GDPR against processing based on Art. 6 (1) lit. f GDPR • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) The supervisory authority responsible for our company is: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Postfach 20 04 44, 40102 Düsseldorf, Germany, https://www.ldi.nrw.de/. Since we only process third-party content to the extent that it is publicly visible on LinkedIn, the fastest and most effective way to terminate processing is to delete or edit the relevant comment directly on LinkedIn. Of course, you can also contact us informally at any time (contact details see above under Data controller).
You have the right, on grounds relating to your particular situation, to object at any time to the processing described here of personal data concerning you. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims. The objection can be made informally and sent to the contact details listed above.
This supplementary privacy policy is currently valid and has the editing status indicated under "As of". We reserve the right to amend it in the event of changes to our LinkedIn API usage or new legal or regulatory requirements. The current version can be accessed at any time at https://vellinger-systems.com/en/linkedin-datenschutz.
For questions about our LinkedIn API usage or to exercise your rights, contact us directly. We typically respond within one business day.
