Datenschutz-Information / Datenschutzerklärung
Last Update: 1.08.2021
The following provisions serve to inform you about the processing of personal data in accordance with the requirements of the General Data Protection Regulation (GDPR). In particular, taking into account the duties to provide information in accordance with Art. 12 to 14 GDPR as well as to inform you about the rights of data subjects in accordance with Art. 15 to 22 and Art. 34 GDPR.
Information on the data controller
The party responsible (the “controller”) for purposes of data protection law is:
Phone: +49 6151 66628-0
Due to our size, we have not (yet) appointed a data protection officer, but you can direct any inquiries regarding data protection to firstname.lastname@example.org
Wir verarbeiten Ihre personenbezogenen Daten im Einklang mit den jeweils anwendbaren gesetzlichen Datenschutzanforderungen zu den je Gruppe von Betroffenen nachfolgend aufgeführten Zwecken:
Datenschutzerklärung für Webseiten-Nutzer
This data protection policy applies to all pages of our online network which are linked to this policy.
Purpose of the data collection
The purpose of the data collection is to optimise our website(s), analyse errors, customise our website(s) to your needs, provide you the opportunity to get in touch with us and, if applicable, to sell goods and services.
General Data Processing
In principle, we collect and use personal data of our users only to the extent necessary to provide a functional website and our contents and services. The collection and use of personal data of our users is only carried out after the consent of the user. An exception is made in those cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by legal regulations.
Legal basis for the processing of your data:
Legitimate interests can be in particular:
Categories of recipients:
User data / Server log files
Whenever you visit our website, our systems automatically collect data and information from the computer system of the calling computer. The following types of data are collected: Browser type, version used, operating system of the user, internet service provider, IP address of the user, date and time of retrieval, websites from which the user's system has come to our website or to which the user of our website accesses. The legal basis for the temporary storage of data and logfiles is Art. 6 para. 1) lit. f) GDPR with the above mentioned legitimate interests. The temporary storage of the IP address by the system is necessary to enable the website to the computer of the user. For this purpose, the user's IP address must remain stored for the duration of the session.
Storage in log files is done to ensure the functionality of the website. In addition, the data is used to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context. These purposes also include our legitimate interest in data processing in accordance with Art. 6 para. 1 lit. f) GDPR. The data will be deleted as soon as they are no longer required for the purpose of their collection. In the case of the collection of data for the purpose of providing the website, this is the case when the respective session has ended. The collection of the data for the provision of the website and the storage of the data in log files is essential for the operation of the website. Furthermore, we reserve the right to check the files if, based on concrete evidence, there is a legitimate suspicion of illegal use or a concrete attack on the pages. In this case, our legitimate interest is the processing for the purpose of clarification and criminal prosecution of such attacks and illegal use.
Technical cookies: Some elements of our website require that the calling browser can be identified even after a page change. The purpose of this use is to enable the function of the website in the first place. Examples of technically necessary cookies are the provision of a shopping cart or the login as a registered user. The processing is therefore based on Art. 6 para. 1 lit. b) or f) GDPR.
Functional cookies: There may be functions which are not technically necessary for the operation of our website, but which considerably simplify its use, such as the adoption of language settings or font sizes, the memorization of search terms, etc. Processing is also carried out on the basis of Art. 6 para. 1 lit. b) or f) GDPR.
General statements about web beacons / tracking pixel
Web beacons are invisible graphics with the size of a pixel. They are used by partner companies, for the purpose of tracking a user via various web pages to create a profile for use in advertising tailored to the user (targeting). A pixel integrated into the web page is loaded from the partner's server when the web page is accessed. In this way, the partner receives your IP address, as well as information about your browser and its version, browser plug-ins used (browser fingerprint), your operating system and your network operator. For the integration of external services through web beacons / tracking pixels or other scripts, the specifications for advertising cookies apply accordingly.
Some of our websites use Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. In the event that IP anonymization is activated on this website, however, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics may be merged with other data from Google. The legal basis for the processing of the users' personal data is Art. 6 para. 1 lit. a DSGVO. We use Google Analytics to analyze and regularly improve the use of our website. The statistics obtained allow us to improve our offer and make it more interesting for you as a user. This website also uses Google Analytics for a cross-device analysis of visitor flows, which is carried out via a user ID. You can deactivate the cross-device analysis of your usage in your customer account under "My data", "Personal data".
Information of the third-party provider: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001, or Google Analytics of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
You have the right to revoke your consent given in accordance with Art. 6 (1) a DSGVO at any time. To do this, you can prevent the storage of cookies by selecting the appropriate technical settings of your browser software; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. Furthermore, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
On this website we use the Google Tag Manager. Google Tag Manager is a solution that allows marketers to manage website tags through one interface. The tool that implements the tags is a cookie-less domain. This means that Google Tag Manager does not collect any personal data. The tool takes care of triggering other tags, which in turn may collect data. Google Tag Manager does not access this data. If a deactivation is made at the domain or cookie level, it remains in place for all tracking tags implemented with Google Tag Manager. The use of Google Tag Manager enables a simplified use of our website.
Further information on the use of Google Tag Manager in terms of data protection law can be found at https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/.
Content of external providers
Some of our web pages integrate third party content within the offer, such as videos from YouTube, map material from Google Maps, images, texts and multi-media files, RSS feeds or other services from other websites. This always requires the transmission of your IP address to the providers of these contents. We cannot make any statement about the use of your data by these providers and have no influence on further processing. We do not know whether the data will be used for other purposes, such as profile building. Please refer to the corresponding data protection information of the respective third-party providers.
You can protect yourself against further persecution by tracking pixels from these providers by deactivating the acceptance of third-party cookies in your browser settings.
The legal basis for the transmission of personal data when integrating third party providers is Art. 6 para. 1 lit. a) GDPR if the user has given his consent to this - e.g. by selection in a cookie opt-in banner - otherwise Art. 6 para. 1 lit. f) GDPR in conjunction with recital 47.
Contact form and e-mail contact
On our website is a contact form available, which can be used for electronic contact. If a user takes advantage of this possibility, the data entered in the input mask is transmitted to us and stored. These data are: Name, address, e-mail address, telephone number, etc.. Not all of these data must be mandatory. At the time the message is sent, the following data is also stored: The IP address, date and time. The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.
Alternatively, it is possible to contact us via the provided e-mail address. In this case, the user's personal data transmitted with the e-mail will be stored. In this context, the data will not be passed on to third parties. The data will be used exclusively for processing the conversation.
The legal basis for the processing is:
The data will be deleted as soon as they are no longer required for the purpose of their collection. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended and there is no reason for further storage. The conversation is finished when it can be concluded from the circumstances that the matter in question has been finally clarified. Retention periods under commercial and tax law may exist.
The user has the possibility to revoke his or her consent to the processing of personal data at any time. If the user contacts us by e-mail, he can object to the storage of his personal data at any time. In such a case the conversation cannot be continued.
On our website you have the possibility to subscribe to a free newsletter with promotional content. Our newsletters contain information about our service offers, promotions, events, competitions, job offers, contributions / articles. Newsletters, on the other hand, do not include news without advertising information that is sent within the framework of our contractual or other business relationship. This includes, for example, the sending of service e-mails with technical information and queries about orders, events, notifications of competitions or similar messages. When registering for the newsletter, the data from the input mask is transmitted to us. In addition, the IP address of the calling computer and the time of the call are collected. For the processing of the data, your consent is obtained during the registration process and reference is made to this data protection declaration. In case you purchase goods on our website via our online shop and enter your e-mail address, we reserve the right to send you newsletters with direct advertising for similar goods. In connection with the data processing for the dispatch of newsletters, the data will not be passed on to third parties. The data will be used exclusively for the dispatch of the newsletter. The legal basis for the processing of the data after registration for the newsletter by the user is, if the user has given his consent, Art. 6 para. 1 lit. a) GDPR and for the dispatch of the newsletter as a result of the sale of goods in accordance with § 7 para. 3 UCA or Art. 6 para. 1 lit. f) (dispatch based on our legitimate business interest).
The collection of the user's e-mail address is used to send the newsletter. The collection of other personal data in the course of the registration process serves to prevent misuse of the services or the e-mail address used. The subscription to the newsletter can be revoked by the user at any time. For this purpose there is a corresponding link in every newsletter.
A statistical evaluation of the reading behavior only takes place to the extent that it can be determined whether the recipients have opened the newsletter and clicked on the links. This is a function that we use, however, only to check the user activities and to be able to make corresponding optimizations. For this purpose, the newsletter contains a so-called "web beacon", a pixel-sized file that is retrieved from our server when the newsletter is opened. This web-beacon can be personalized, so that personal data is collected. Clicks are tracked via personalized links to the respective website. If personalized data are collected, the legal basis is Art. 6 para. 1 lit. a) GDPR.
Data collection during registration and registered use
Some of our websites require or offer registration. The data collected in the process is used for the purpose of using the respective websites and services, unless otherwise described and explicitly agreed upon during registration. The data collected is derived from the input mask in the context of registration, processing is based on Art. 6 para. 1 lit. b) GDPR. All other data that you can enter at a later date to complete your profile are optional and voluntary and are based on the legal basis of Art. 6 para. 1 lit. a) GDPR. After registration, we may inform you about relevant circumstances related to our offer for which you have registered by means of the deposited e-mail address.
Furthermore, we reserve the right, in the case of orders or commissions, to pass on personal data to third parties for credit information purposes, insofar as this is necessary to protect our legitimate interests. In doing so, only the data required to calculate the creditworthiness using a mathematical-statistical procedure by the credit agency will be transmitted. We require creditworthiness information in order to be able to decide on the establishment and execution of a contractual relationship while safeguarding our legitimate interests.
Data transmission via the internet
Data transmission via the internet is generally associated with certain risks. A special encryption of the data is not carried out, especially messages from the contact form of our website and messages in the service chat are transmitted unencrypted.
Please bear this in mind when transmitting data. If you wish to communicate with us by means of encrypted e-mail, this is possible by using SMIME encryption. Please inform us of your wish to use encryption, as we regularly send unencrypted e-mails due to the current low market penetration of e-mail encryption methods.
Data transfer to third parties
If you provide us with personal data, this data will only be passed on to third parties if this is necessary for the processing of the contractual agreement or if another legal reason legitimises this passing on. However, we provide certain services with the cooperation of service providers. We have carefully selected these service providers and have taken appropriate measures to protect your personal data.
The personal data of the person concerned will be deleted or blocked as soon as the purpose of the storage no longer applies. Furthermore, data may be stored if this has been provided for by the European or national legislator in EU regulations, laws or other regulations to which the person responsible is subject. Data will also be blocked or deleted when a storage period prescribed by the above-mentioned standards expires, unless there is a need to continue storing the data for the purpose of concluding or fulfilling a contract.
Datenschutzerklärungen für Social-Media-Präsenzen
We operate a company website on the professional social media network Twitter, especially for self-expression, but also for recruiting.
According to the judgment of the European Court of Justice (ECJ) of 05.06.2018, Az. C-210/16, is the operator of social media sites - at least on Facebook fan pages - partly responsible within the meaning of Art. 26 GDPR. We suspect an analogous applicability of this decision to other social networks, including Twitter. So far, we are not aware that Twitter offers an agreement that meets the requirements of Art. 26.
We would like to point out that you use the offered Twitter short message service and its functions on your own responsibility. This applies also to the use of interactive functions (e.g. sharing, rating).
We only process your data if you contact us via the Twitter platform. In this case, Twitter collects your data and makes it available to us.
Under certain circumstances, your data may also be stored and further processed by us. The processing of your personal data in the case of an application is based on our applicant data protection declaration.
Your data will be processed by us to the extent that we may re-tweet your tweets or reply to them or write tweets that refer to your account. Data freely published and disseminated by you on Twitter are thus included by us and made accessible to third parties.
The legal basis for the processing of personal data is, depending on the case constellation, the processing to initiate and execute a contract with you in accordance with Art. 6 (1) b GDPR (insofar as it concerns concrete requests for quotations or an existing customer relationship with you) or on the basis of our legitimate interest in communication with users and our external presentation for the purpose of advertising pursuant to Art. 6 (1) f GDPR.
If you have given the provider of the social network your consent to the aforementioned data processing with effect for us, the legal basis is Art. 6 (1) a GDPR.
Under certain circumstances, we may also store and further process the data. The processing of your personal data will then be governed by one of our other data protection declarations, depending on which group of affected parties you belong to.
Furthermore, we may collect data from the "Likes" and commentators of our channel if the mere display can be defined as processing. However, we do not store this data on our own systems, nor is it systematically further processed through occasional disclosure.
For these processing steps, our information regarding the data controller, the data protection officer and the declaration of your rights as a data subject applies.
We have no control over the nature and extent of the data processed by Twitter, the way the data is processed and used, or the disclosure of such data to third parties. We do not have effective control over this.
Standard contractual clauses serve as a guarantee for the transfer of personal data to third countries. Further information on the processing of personal data can be found here:
We draw your attention to the fact that the assertion of data subject rights and requests for information are best directed against Twitter Inc. itself.
Our company operates a social media channel on the platform LinkedIn. According to the judgment of the European Court of Justice (ECJ) of 05.06.2018, Az. C-210/16, is the operator of social media sites - at least on Facebook fan pages - partly responsible within the meaning of Art. 26 GDPR. So far, we do not know that LinkedIn offers an agreement that meets the requirements of Art. 26.
We only process your data when you contact our Human Resources department via the LinkedIn platform or when you contact us on LinkedIn for an advertised job. In that case, LinkedIn collects your information and makes it available to us.
Information on data processing
As a customer and as an interested party or other affected party, we process your personal data primarily for the purpose of establishing and fulfilling a contractual relationship with you or on the basis of a legitimate interest. Your data will be collected, stored and, if necessary, passed on by us to the extent necessary to provide the contractually agreed service, to provide information, to carry out direct marketing activities or other activities of our business operations. Failure to provide such information may result in the contract not being concluded. In addition, we will only process your data if you have consented to the processing or another legal permission has been granted.
Purposes of data processing
We process your personal data to achieve the following purposes in relation to the initiation and implementation of a contractual relationship or other activities in the interest of the company:
Furthermore, we process your data only with your express declaration of consent.
Types of data processed by us
The following personal data are processed:
Categories of recipients
The personal data will be transferred to group companies, supervisory authorities, legal service providers/auditors within the scope of the given necessities. If we are subject to a legal obligation to do so, we will release your data to the competent authority upon request.
In some cases, we use external service providers based in the European Economic Area to process your data. The personal data is transferred to [THIRD COUNTRY]. The processor CleverReach GmbH & Co. KG has provided an appropriate guarantee, which can be viewed online at https://www.cleverreach.com/en/privacy-policy.
These service providers have been carefully selected by us, commissioned in writing and are bound by our instructions. Our service providers are regularly monitored by us. The service providers will not disclose this data to third parties, but will delete it after contract fulfillment and the completion of legal storage periods, unless you have consented to further storage.
This concerns e.g:
For orders on account, we reserve the right to carry out an assessment of the credit risk on the basis of mathematical-statistical procedures (scoring). For this purpose, your data, which are necessary for credit assessment, will be transferred to a credit agency (e.g. Schufa, Creditreform, Bürgel, Atradius, Coface). If the credit assessment is positive, an order on account is possible. If the credit assessment is negative, we cannot offer you payment on account. You can object to the transmission of this data to the credit agency at any time, but then it is no longer possible to order on account.
Legal basis for processing
Legal bases for the processing of your data are in particular
Our legitimate interests lie in the achievement of the above-mentioned purposes and, in addition, in, for example
In the case of customer analysis, the processing of your data takes place either in anonymous form or, insofar as anonymous processing is not possible or not expedient for factual reasons, in pseudonymized form.
Some of the aforementioned processes or services are carried out by carefully selected and commissioned service providers. We transmit or receive personal data from these service providers solely on the basis of a processing contract. If the registered office of a service provider is outside the European Union or the European Economic Areas, a third country transfer takes place. Data protection agreements in accordance with the legal requirements are contractually stipulated with these service providers to establish an appropriate level of data protection and corresponding guarantees are agreed.
Data collected by third parties
If necessary, data may be made available to us by third parties, e.g. in the context of recommendations. In this case it is usually contact data in connection with data on specific product or service needs. If necessary, we collect data from credit agencies regarding creditworthiness and/or negative characteristics.
Once the respective purpose has been achieved, your data will be deleted in compliance with the legal retention periods.
Purpose of data collection
Before joining our company or during the application process, we process your personal data exclusively for the purpose of establishing a contractual relationship to the required extent.
Types of data that are processed by us
The following types of personal data are regularly processed:
We do not require any information from you that is not usable according to the General Equal Treatment Act (AGG) (race, ethnic origin, gender, pregnancy, information on physical or mental illness, membership of a trade union, religion or belief, disability, age, sexual identity or sex life).
We kindly request that such data not be transmitted to us. The same applies to content that is likely to infringe the rights of third parties (e.g. copyrights, ancillary copyrights or other intellectual property rights, personal rights, press law or general rights of third parties).
Legal basis of the processing
Categories of recipients
After the respective purpose has been achieved, your data will be deleted. However, data will be kept for as long as necessary to defend legal claims. The storage period is usually 6 months. If your profile was sent to us by a personnel service provider and if commission claims of this service provider exist, the storage period can be until they are fulfilled or the limitation period expires. If processing relevant for accounting purposes has been carried out, such as the reimbursement of travel expenses, the data required for this purpose will be deleted in compliance with the statutory retention periods, usually 6 or 10 years. If the application was successful and we conclude a contract with you, we transfer the data collected during the application process to our personnel file.
Information on data processing
Hereby we would like to inform our employees about our processing of their personal data within the scope of their employment contract.
Purpose of data collection
During the period of your employment, your personal data will be processed mainly for the purpose of implementing and/or terminating the contractual relationship, including the tasks related to the respective activity. Other purposes may include processing for the purpose of complying with legal regulations (including third party claims for information) or for measures for corporate development or communication.
Types of data that are processed by us
Within the scope of your employment contract, we process the following personal data:
Categories of recipients
We send your personal data to the following recipients, e.g. to comply with legal obligations or obligations arising from the employment relationship:
Legal basis of the processing
When processing your personal data, we naturally comply with applicable law. Processing is therefore only carried out on a legal basis. The following legal bases come into consideration in particular in the employment relationship:
If we process your data within the scope of our legitimate interest, this is e.g. in:
You have the right to object to the processing of personal data within the scope of a legitimate interest for reasons arising from your particular situation. We will then no longer process your data unless we can prove that there are compelling reasons for us to protect your rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.
We do not use the personal data provided by you to make automated decisions concerning you.
Data collected by third parties
Using the ELSTAM procedure, we collect data for payroll accounting, which the tax authorities provide us with for correct accounting.
From 2021, the introduction of the electronic certificate of incapacity for work will oblige us to retrieve the AU data (i.e. start and duration of incapacity for work, as well as the time of termination of continued payment in the event of illness) from your health insurance company on the basis of a sickness notification from you.
After the respective purpose has been achieved, your data will be deleted in compliance with the legal retention periods, usually 6 or 10 years, for various data categories such as occupational pension schemes 30 years and longer.
Use of service providers
Some of the aforementioned processes or services are carried out by carefully selected and commissioned service providers. We transmit or receive personal data from these service providers solely on the basis of a processing contract. If the registered office of a service provider is outside the European Union or the European Economic Area, a transfer to a third country takes place. We will contractually establish data protection agreements with these service providers in accordance with the legal requirements in order to establish an appropriate level of data protection and agree on appropriate guarantees.
Information on your rights
You have the right
Deletion of your data
Unless otherwise regulated in the more detailed data protection declarations, we will delete your personal data when the contractual relationship with you has ended, you have exercised your right to deletion, all mutual claims have been satisfied, and there are no other legal retention obligations or legal justification bases for storage. Retention periods under commercial law for financially relevant data are generally up to 10 years. Farther, we may retain data for as long as necessary to protect us from claims that may be asserted against us. These periods can be up to 30 years.
For the purposes of this general information for employees, the term: