Data protection

Data Protection Policy

Thank you for your interest in our company. The management of ACONEXT Holding GmbH attaches great importance to data protection. In general, it is possible to use the website of ACONEXT Holding GmbH without having to provide any personal data. However, if a data subject wishes to make use of special services of our company through our website, it might be necessary to process personal data. If the processing of personal data is necessary, and if there is no statutory basis for such processing, we generally obtain the consent of the data subject.

Personal data, such as a data subject’s name, address, email address, and phone number, are always processed in conformity with the EU General Data Protection Regulation and with the country-specific data protection provisions applicable to ACONEXT Holding GmbH. With this Data Protection Policy, our company wishes to inform the general public about the nature, scope and purpose of the personal data that we collect, use and process. In addition, this Data Protection Policy provides data subjects with an explanation of their rights.

As the controller, ACONEXT Holding GmbH has implemented numerous technical and organisational measures in order to ensure that the personal data processed on this website is protected to the greatest possible extent. Nevertheless, when transferred over the internet, data is inherently exposed to security gaps, meaning that absolute protection cannot be guaranteed. For this reason, every data subject may choose instead to transmit personal data to us through alternative channels, such as by phone.

  1. Definitions

The Data Protection Policy of ACONEXT Holding GmbH is based on the terms used in the EU General Data Protection Regulation (GDPR). Our Data Protection Policy is designed to be easily read and understood by the general public, our customers and our business partners. In order to ensure this, we would first like to explain the terms used.

In this Data Protection Policy, we use, inter alia, the following terms:

  • a) Personal data

Personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

  • b) Data subject

Data subject means any identified or identifiable natural person whose personal data is processed by the controller.

  • c) Processing

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

  • d) Restriction of processing

Restriction of processing means the marking of stored personal data with the aim of limiting its processing in the future.

  • e) Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

  • f) Pseudonymisation

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

  • g) Controller

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

  • h) Processor

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

  • i) Recipient

Recipient means a natural or legal person, public authority, agency or another body, to which the personal data is disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not to be regarded as recipients.

  • j) Third party

Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

  • k) Consent

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

 

  1. Name and address of the controller

 

The controller within the meaning of the GDPR, other data protection laws applicable in the Member States of the European Union, and other provisions in the nature of data protection law is:

ACONEXT Holding GmbH

Wilhelm-Pfitzer-Str. 26

70736 Fellbach

Germany

Tel.: +49 711 / 8 49 63 78 – 0

email: info@aconext.de

Website: www.Aconext.de

 

  1. Name and address of the data protection officer

The controller’s data protection officer can be reached at:

Tel.: +49 89 / 35 89 99 19 – 444

email: info@aconext.de

Every data subject may contact our data protection officer directly at any time with questions and suggestions concerning data protection.

 

  1. Cookies

The website of ACONEXT Holding GmbH uses cookies. Cookies are text files that are stored on a computer system through a web browser.

Numerous websites and servers use cookies. Many cookies contain what is known as a “cookie ID”. A cookie ID is the cookie’s unique identifier. It consists of a character string that enables websites and servers to be assigned to the specific web browser in which the cookie has been stored. This makes it possible for visited websites and servers to distinguish the specific browser of the data subject from other web browsers that contain other cookies. The unique cookie ID allows a specific web browser to be recognised and identified.

The use of cookies enables ACONEXT Holding GmbH to provide users of this website with services that are more user-friendly, which would otherwise not be possible without setting a cookie.

Cookies make it possible to optimise the information and offers on our website for the benefit of users. As described above, cookies enable us to recognise users who have previously visited our website in order to make it easier for them to use our website. For instance, if a website uses cookies, the user does not have to enter his or her access credentials each time he or she visits the website, because this is handled by the website and by the cookie stored on the user’s computer system. Another example is the cookie generated by the shopping cart in an online store. The store uses the cookie in order to remember the items that the customer has placed in the virtual shopping cart.

The data subject may at any time prevent our website from setting cookies by appropriately configuring the web browser being used and thereby permanently refuse the setting of cookies. In addition, cookies that have already been set may at any time be deleted through a web browser or other software programs. This is possible with all current web browsers. If the data subject deactivates the setting of cookies in the web browser being used, some features of our website may not be able to be used in full in certain cases.

 

  1. Collection of general data and information

Each time it is accessed by a data subject or an automated system, the website of ACONEXT Holding GmbH collects certain general data and information. This general data and information is stored in the server’s log files. We may collect (1) the browser types and versions being used, (2) the operating system being used by the accessing system, (3) the website from which an accessing system reaches our website (known as “referrers”), (4) the subpages on our website that are accessed by the accessing system, (5) the date and time of access of the website, (6) an Internet Protocol address (IP address), (7) the accessing system’s internet service provider, and (8) other similar data and information that help to ward off threats in the event of attacks on our IT systems.

When using these general data and information, ACONEXT Holding GmbH does not draw any inferences about the data subject. Rather, this information is needed in order to (1) deliver the content of our website properly, (2) optimise the content of our website and the advertising for it, (3) ensure the uninterrupted operability of our IT systems and the technology of our website, and (4) provide law enforcement authorities with the information needed for criminal prosecution in the event of a cyber attack. This data and information, which is collected in anonymous form, is therefore analysed by ACONEXT Holding GmbH for statistical purposes and, in addition, with the aim of increasing data protection and data security in our company in order ultimately to ensure an optimal level of protection for the personal data we process. The anonymous data in server log files is stored separately from all personal data provided by a data subject.

 

  1. Registering on our website

The data subject has the ability to register on the controller’s website by providing personal data. The entry fields that are used for registration determine which personal data is transmitted to the controller for this purpose. The personal data entered by the data subject is collected and stored exclusively for internal use by the controller and for its own purposes. The controller may authorise disclosure to one or more processors, e.g. a parcel service provider, which likewise utilise the personal data exclusively for internal use, with such use being attributable to the controller.

When the data subject registers on the controller’s website, the IP address assigned by his or her internet service provider (ISP), as well as the date and time of registration, is also stored. This data is stored because this is the only way to prevent the misuse of our services. Where necessary, this data makes it possible to investigate crimes that have been committed. Accordingly, it is necessary to store this data in order to protect the controller. As a rule, this data is not disclosed to third parties, unless there is a statutory obligation to do so or disclosure aids in criminal prosecution.

Registration by the data subject, with the voluntary provision of personal data, also helps the controller to offer the data subject content or services that, because of the nature of the matter, can be offered only to registered users. Registered persons may at any time modify the personal data provided upon registration or have them completely erased from the controller’s database.

At any time upon request, the controller will notify the data subject about the personal data that has been stored about him or her. In addition, where so requested or instructed by the data subject, the controller will rectify or erase personal data, unless it is prevented from doing so by statutory retention duties. All of the controller’s employees are available to the data subject as contact persons in this regard.

 

  1. Subscribing to our newsletter

The website of ACONEXT Holding GmbH offers users the option to subscribe to our company’s newsletter. The entry fields that are used for this purpose determine which personal data is transmitted to the controller when ordering the newsletter.

ACONEXT Holding GmbH notifies its customers and business partners at regular intervals by means of a newsletter about the company’s offers. In general, the data subject can receive our company’s newsletter only if he or she (1) has a valid email address and (2) registers to have the newsletter sent to him or her. For legal reasons, a double opt-in procedure is used, meaning that a confirmation email is sent to the email address initially entered for receipt of the newsletter. This confirmation email serves to verify whether the owner of the email address as data subject has authorised receipt of the newsletter.

When subscribing to the newsletter, we also store the IP address of the computer system that the data subject used when subscribing, which was assigned by the internet service provider (ISP), as well as the date and time of subscription. The collection of this data is necessary so that we are better able to examine at a later date when, where, and how the (potential) misuse of a data subject’s email address took place. Collection therefore serves to legally protect the controller.

The personal data collected when subscribing to the newsletter is used exclusively for sending our newsletter. In addition, newsletter subscribers might be notified by email if this is necessary for the operation of the newsletter service or a registration in this respect, as might be the case in the event of changes to the newsletter offer or the modification of the technical circumstances. Personal data collected in connection with the newsletter services is not disclosed to third parties. The data subject may at any time cancel his or her subscription to our newsletter. The data subject may at any time withdraw the consent to the storage of personal data that he or she granted to us for the sending of the newsletter. A corresponding link for the purpose of withdrawing consent can be found in each newsletter. In addition, the data subject may also at any time unsubscribe to the newsletter directly on the controller’s website or notify the controller thereof in a different way.

 

  1. Newsletter tracking

The newsletters of ACONEXT Holding GmbH contain what are known as “tracking pixels”. A tracking pixel is a miniature image embedded in such emails, which is sent in HTML format in order to enable log file recording and log file analysis. This makes it possible to perform a statistical analysis of the success or failure of online marketing campaigns. By means of the embedded tracking pixel, ACONEXT Holding GmbH can identify whether and when an email was opened by a data subject and which links contained in the email were clicked on by the data subject.

Such personal data collected through tracking pixels contained in the newsletters is stored and analysed by the controller in order to optimise the sending of the newsletter and to adapt the content of future newsletters even better to meet the interests of the data subject. This personal data is not disclosed to third parties. Data subjects are at all times entitled to withdraw the special declaration of consent that was given in this regard through the double opt-in procedure. Following withdrawal of consent, this personal data is erased by the controller. If the data subject unsubscribes to the newsletter, ACONEXT Holding GmbH automatically interprets this as withdrawal of consent.

 

  1. Contact option using the website

Owing to statutory requirements, the website of ACONEXT Holding GmbH contains information that enables quick electronic contact to be made with our company, as well as direct communication with us, which also consists of a general email address. If a data subject contacts the controller by email or using the contact form, the personal data transmitted by the data subject is automatically stored. Such personal data, which is voluntarily transmitted by a data subject to the controller, is stored for the purposes of processing the enquiry or making contact with the data subject. This personal data is not disclosed to third parties.

  1. Routine erasure and blocking of personal data

The controller processes and stores personal data of the data subject only for the period necessary in order to achieve the purpose of storage or where this is specified by EU regulations or directives or by national laws or requirements to which the controller is subject.

If the purpose for storage no longer exists, or if a storage period prescribed by EU regulation or directive or other applicable national law expires, the personal data is routinely blocked or erased in accordance with statutory requirements.

 

  1. Rights of the data subject
  • a) Right to confirmation

Every data subject has the right under the GDPR to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. If a data subject wishes to make use of this confirmation right, he or she may contact an employee of the controller for this purpose at any time.

  • b) Right of access to information

Every data subject has the right under the GDPR to obtain from the controller at any time information free of charge about the personal data that has been stored about him or her and to receive a copy of such information. In addition, the data subject is entitled under the GDPR to the following information:

  • the purposes of the processing
  • the categories of personal data concerned
  • the recipients or categories of recipient to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
  • the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing
  • the right to lodge a complaint with a supervisory authority
  • where the personal data is not collected from the data subject, any available information as to their source
  • the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

 

In addition, the data subject is entitled to information as to whether or not personal data was transferred to a third country or to an international organisation. If this is the case, the data subject also has the right to be informed of the appropriate safeguards relating to the transfer.

If a data subject wishes to make use of this right of access to information, he or she may contact an employee of the controller for this purpose at any time.

  • c) Right to rectification

Every data subject has the right under the GDPR to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. In addition, taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

If a data subject wishes to make use of this right to rectification, he or she may contact an employee of the controller for this purpose at any time.

  • d) Right to erasure (right to be forgotten)

Every data subject has the right under the GDPR to demand from the controller the erasure of personal data concerning him or her without undue delay where one of the following grounds applies and to the extent that processing is not necessary:

  • The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
  • The data subject withdraws consent on which the processing is based according to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, and where there is no other legal ground for the processing.
  • The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
  • The personal data has been unlawfully processed.
  • The personal data has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
  • The personal data has been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

If one of the foregoing grounds applies and a data subject wishes to bring about the erasure of personal data that has been stored by ACONEXT Holding GmbH, he or she may contact an employee of the controller for this purpose at any time. The employee of ACONEXT Holding GmbH will arrange for the erasure without undue delay.

Where ACONEXT Holding GmbH as the controller has made the personal data public and is obliged pursuant to Article 17(1) GDPR to erase the personal data, ACONEXT Holding GmbH, taking account of available technology and the cost of implementation, will take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, the personal data, to the extent that processing is not necessary. The employee of ACONEXT Holding GmbH will arrange for the necessary steps to be taken on a case-by-case basis.

  • e) Right to restriction of processing

Every data subject has the right under the GDPR to demand from the controller the restriction of processing where one of the following applies:

  • The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
  • The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their instead use.
  • The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
  • The data subject has objected to processing pursuant to Article 21(1) GDPR pending verification of whether the legitimate grounds of the controller override those of the data subject.

If one of the foregoing applies and a data subject wishes to bring about the restriction of processing of personal data that has been stored by ACONEXT Holding GmbH, he or she may contact an employee of the controller for this purpose at any time. The employee of ACONEXT Holding GmbH will arrange for the restriction of processing.

  • f) Right to data portability

Every data subject has the right under the GDPR to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format. He are she also has the right to transmit the data to another controller without hindrance from the controller to which the personal data has been provided, where the processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract pursuant to Article 6(1)(b) GDPR and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

In addition, in exercising his or her right to data portability pursuant to Article 20(1) GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

The data subject may contact an employee of ACONEXT Holding GmbH at any time for the purpose of asserting the right to data portability.

  • g) Right to object

Every data subject has the right under the GDPR to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions.

In the event of an objection, ACONEXT Holding GmbH will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

If ACONEXT Holding GmbH processes personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to ACONEXT Holding GmbH to processing for direct marketing purposes, ACONEXT Holding GmbH will no longer process the personal data for such purposes.

Moreover, where personal data is processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, the data subject, on grounds relating to his or her particular situation, has the right to object to the processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

The data subject may directly contact any employee of ACONEXT Holding GmbH for the purpose of exercising the right to object. In addition, in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.

  • h) Automated individual decision-making, including profiling

Every data subject has the right under the GDPR not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless the decision (1) is necessary for entering into, or performance of, a contract between the data subject and the controller, (2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or (3) is based on the data subject’s explicit consent.

If the decision (1) is necessary for entering into, or performance of, a contract between the data subject and the controller or (2) is based on the data subject’s explicit consent, ACONEXT Holding GmbH will implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

If a data subject wishes to assert rights with respect to automated decision-making, he or she may contact an employee of the controller for this purpose at any time.

  • i) Right to withdraw consent to data processing

Every data subject has the right under the GDPR to withdraw his or her consent at any time to the processing of personal data.

If a data subject wishes to assert his or her right to withdraw consent, he or she may contact an employee of the controller for this purpose at any time.

 

  1. Data protection in the case of applications and during the application process

The controller collects and processes personal data for the purpose of carrying out the application process. Processing may also take place electronically. This is the case, in particular, where an applicant transmits corresponding application documents to the controller electronically, for example, by email or using a form found on the website. If the controller concludes an employment contract with an applicant, the transmitted data is stored for the purpose of implementing the employment relationship, paying regard to statutory requirements. If the controller does not conclude an employment contract with the applicant, the application documents are automatically deleted two months after notification of the rejection decisions, unless other legitimate interests of the controller preclude deletion. Other legitimate interests in this sense include, e.g., a burden of proof in proceedings under the German General Act on Equal Treatment (Allgemeines Gleichbehandlungsgesetz).

  1. Data protection provisions concerning the application and use of Adobe Analytics (Omniture) / Adobe Marketing Cloud

The controller has integrated Adobe components on this website. Adobe Analytics (Omniture) and Adobe Marketing Cloud (hereinafter, “Omniture”) are tools that enable more efficient online marketing, as well as web analysis. Omniture is a part of Adobe Marketing Cloud. Adobe Marketing Cloud facilitates real-time analyses of website traffic in the form of project reports, which permit an ad hoc analysis of website visitors. Customer interactions are displayed in simple, interactive dashboards, and the data can be converted into reports, which provides the controller with a better overview of online activities by users of this website. This makes it possible for the controller to obtain information in real time and thereby to identify emerging problems more quickly.

These services are operated by Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Republic of Ireland.

Omniture sets a cookie on the data subject’s IT system (for an explanation of cookies, please refer to the description above). Through a server configuration, the controller guarantees that the tracking datasets transmitted to Adobe’s data centre are anonymised prior to geolocalisation. Anonymisation is accomplished by replacing the last portion of the IP address. The controller has configured its server settings so that prior to processing, the data subject’s IP address is anonymised separately for geolocalisation and for reach measurement. On behalf of the controller, Adobe uses the data and information acquired through our website in order to analyse the data subject’s user behaviour. In addition, Adobe uses the data in order to create reports on our behalf about user activities and to provide other services for our company related to the use of our website. The data subject’s IP address is not combined by Adobe with other personal data.

As described above, the data subject may at any time prevent our website from setting cookies by appropriately configuring the web browser being used and thereby permanently refuse the setting of cookies. Such a configuration of the web browser being used would also prevent Omniture from setting a cookie on the data subject’s IT system. Moreover, cookies that have already been set by Omniture may at any time be deleted through a web browser or other software programs.

In addition, the data subject may object to and thus prevent the collection of data generated by the Adobe cookie relating to the use of this website and the processing of this data by Adobe. To do so, the data subject must click on the “Abmelden” (opt-out) button at http://www.adobe.com/de/privacy/opt-out.html, which sets an opt-out cookie. The opt-out cookie that is set with the objection is stored on the IT system being used by the data subject. If cookies are deleted on the data subject’s system after an objection, the data subject must click on the link again and set a new opt-out cookie.

However, by setting the opt-out cookie, the data subject may no longer be able to use the controller’s website to the full extent.

Adobe’s applicable data protection provisions may be viewed at http://www.adobe.com/de/privacy.html.

 

  1. Data protection provisions concerning the application and use of Facebook

The controller has integrated Facebook components on this website. Facebook is a social network.

A social network is a social meeting place operated on the internet, an online community that normally enables users to communicate with one another and to interact in a virtual space. A social network may be used as a platform for exchanging opinions and experiences, and it enables the internet community to provide personal or company-related information. Among other things, Facebook enables users of the social network to create private profiles, to upload photos, and to connect through friend requests.

Facebook is operated by Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. If a data subject lives outside of the U.S. or Canada, the controller is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Each time one of the pages of this website that is operated by the controller is accessed and on which a Facebook component (Facebook plug-in) has been integrated, the respective Facebook component automatically prompts the web browser on the data subject’s IT system to download a display of the corresponding Facebook component from Facebook. An overall view of all Facebook plug-ins can be viewed at https://developers.facebook.com/docs/plugins/?locale=de_DE. In connection with this technical process, Facebook gains knowledge about which specific subpage of our website is viewed by the data subject.

If the data subject is simultaneously logged in to Facebook, then each time our website is accessed by the data subject and for the entire duration of each visit to it, Facebook detects which specific subpage of our website is viewed by the data subject. This information is aggregated by the Facebook component and is allocated by Facebook to the data subject’s respective Facebook account. If the data subject clicks on one of the Facebook buttons integrated on our website, for example, the “Like” button, or if the data subject posts a comment, Facebook allocates this information to the data subject’s personal Facebook user account and stores these personal data.

By means of the Facebook component, Facebook is always notified when the data subject visits our website, provided that at the time our website is accessed, the data subject is simultaneously logged in to Facebook. This takes place irrespective of whether the data subject clicks on the Facebook component. If the data subject does not want such information to be transmitted to Facebook in this way, he or she may prevent transmission by logging out of his or her Facebook account prior to accessing our website.

Facebook’s published privacy policy, which can be viewed at https://de-de.facebook.com/about/privacy/, provides information about the collection, processing and use of personal data by Facebook. In addition, an explanation is provided there about the setting options offered by Facebook to protect the data subject’s privacy. Moreover, various applications are available that make it possible to suppress the transmission of data to Facebook. The data subject can use such applications to suppress the transmission of data to Facebook.

 

  1. Data protection provisions concerning the application and use of Google AdSense

The controller has integrated Google AdSense on this website. Google AdSense is an online service that enables advertising to be served to third-party websites. Google AdSense is based on an algorithm that selects advertising to be displayed on third-party websites that is consistent with the content of those sites. Google AdSense allows interest-based targeting of the internet user, which is accomplished by generating customised user profiles.

The Google AdSense component is operated by Alphabet Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

We use the Google AdSense component in order to embed advertising on our website. Google AdSense sets a cookie on the data subject’s IT system. An explanation of cookies was provided above. The setting of the cookie enables Alphabet Inc. to analyse the use of our website. Each time one of the pages of this website that is operated by the controller is accessed, and on which a Google AdSense component has been integrated, the respective Google AdSense component automatically prompts the web browser on the data subject’s IT system to transmit data to Alphabet Inc. for the purpose of online advertising and the billing of commissions.  In connection with this technical process, Alphabet Inc. gains knowledge about personal data, such as the data subject’s IP address, which Alphabet Inc. uses, inter alia, in order to gain insight into the origin of visitors and clicks and, as a consequence, to facilitate commission billings.

As described above, the data subject may at any time prevent our website from setting cookies by appropriately configuring the web browser being used and thereby permanently refuse the setting of cookies. Such a configuration of the web browser being used would also prevent Alphabet Inc. from setting a cookie on the data subject’s IT system. Moreover, a cookie that has already been set by Alphabet Inc. may at any time be deleted through the web browser or other software programs.

Moreover, Google AdSense uses what are known as “tracking pixels”. A tracking pixel is a miniature image embedded in websites in order to enable log file recording and a log file analysis, which make it possible to perform a statistical analysis. By means of the embedded tracking pixel, Alphabet Inc. can identify whether and when a website was opened by a data subject and which links were clicked on by the data subject. Among other things, tracking pixels are used to analyse website traffic.

Personal data and information, which also include the IP address and which are necessary in order to log the displayed advertising and bill for it, are transmitted by Google AdSense to Alphabet Inc. in the United States. This personal data is stored and processed in the United States. In some cases, this personal data, which is collected through a technical process, is disclosed by Alphabet Inc. to third parties.

A more detailed explanation of Google AdSense can be found at https://www.google.de/intl/de/adsense/start/.

 

  1. Data protection provisions concerning the application and use of Google Analytics (with anonymisation feature)

The controller has integrated the Google Analytics component (with anonymisation feature) on this website. Google Analytics is a web analysis service. Web analysis involves the collection, aggregation and analysis of data about the behaviour of visitors on websites. A web analysis service collects, inter alia, data about the website from which a data subject reached a website (known as “referrers”), which subpages of the website were accessed, and how often and for how long a subpage was viewed. Web analysis is primarily used to optimise a website and to perform a cost-benefit analysis of internet advertising.

The Google Analytics component is operated by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

The controller uses the appendage “_gat._anonymizeIp” for web analysis by Google Analytics. By means of this appendage, the IP address of data subject’s internet connection is shortened and anonymised by Google if our website is accessed from a Member State of the European Union or from another Contracting State of the Agreement on the European Economic Area.

We use the Google Analytics component in order to analyse our website traffic. Google uses the acquired data and information, inter alia, to analyse the use of our website in order to compile online reports for us that show the activities on our website and in order to provide other services related to the use of our website.

Google Analytics sets a cookie on the data subject’s IT system. An explanation of cookies was provided above. The setting of the cookie enables Google to analyse the use of our website. Each time one of the pages of this website that is operated by the controller is accessed, and on which a Google Analytics component has been integrated, the respective Google Analytics component automatically prompts the web browser on the data subject’s IT system to transmit data to Google for the purpose of online analysis. In connection with this technical process, Google gains knowledge about personal data, such as the data subject’s IP address, which Google uses, inter alia, in order to gain insight into the origin of visitors and clicks and, as a consequence, to facilitate commission billings.

The cookie is used to store personal information, such as the time of access, the location from which access originated, and the frequency of visits to our website by the data subject. Each time our website is visited, this personal data, including the IP address of the internet connection used by the data subject, is transferred to Google in the United States and stored and processed by it there. In some cases, this personal data, which is collected through a technical process, is disclosed by Google to third parties.

As described above, the data subject may at any time prevent our website from setting cookies by appropriately configuring the web browser being used and thereby permanently refuse the setting of cookies. Such a configuration of the web browser being used would also prevent Google from setting a cookie on the data subject’s IT system. Moreover, a cookie that has already been set by Google Analytics may at any time be deleted through the web browser or other software programs.

In addition, the data subject may object to and thus prevent the collection of data generated by Google Analytics relating to the use of this website and the processing of such data by Google. To do so, the data subject must download and install a browser add-on, which is available at https://tools.google.com/dlpage/gaoptout. This browser add-on notifies Google Analytics through JavaScript that no data or information about visits to websites may be transmitted to Google Analytics. Google considers the installation of the browser add-on to be an objection. If the data subject’s IT system is deleted, formatted, or reinstalled at a later date, the data subject must reinstall the browser add-on in order to deactivate Google Analytics. If the browser add-on is uninstalled or deactivated by the data subject or another person in his or her sphere of control, the browser add-on can be reinstalled or reactivated.

Further information and Google’s applicable data protection provisions can be viewed at https://www.google.de/intl/de/policies/privacy/ and http://www.google.com/analytics/terms/de.html. A more detailed explanation of Google Analytics can be found at https://www.google.com/intl/de_de/analytics/.

 

  1. Data protection provisions concerning the application and use of Google+

The controller has integrated Google+ as a component on this website. Google+ is what is known as a “social network”. A social network is a social meeting place operated on the internet, an online community that normally enables users to communicate with one another and to interact in a virtual space. A social network may be used as a platform for exchanging opinions and experiences, and it enables the internet community to provide personal or company-related information. Among other things, Google+ enables users of the social network to create private profiles, to upload photos, and to connect through friend requests.

Google+ is operated by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

Each time one of the pages of this website that is operated by the controller is accessed, and on which a Google+ button has been integrated, the respective Google+ button automatically prompts the web browser on the data subject’s IT system to download a display of the corresponding Google+ button from Google. In connection with this technical process, Google gains knowledge about which specific subpage of our website is viewed by the data subject. More detailed information about Google+ can be viewed at https://developers.google.com/+/.

If the data subject is simultaneously logged in to Google+, then each time our website is accessed by the data subject and for the entire duration of each visit, Google detects which specific subpage of our website is viewed by the data subject. This information is aggregated by the Google+ button and is allocated by Google to the data subject’s respective Google+ account.

If the data subject clicks on one of the Google+ buttons integrated on our website and gives a Google+ recommendation, Google allocates this information to the data subject’s personal Google+ user account and stores this personal data. Google stores the data subject’s Google+ recommendation and makes it publicly available in conformity with the conditions accepted by the data subject in this respect. A Google+ recommendation made by the data subject on this website is thereafter stored and processed together with other personal data, such as the name of the Google+1 account used by the data subject and the photo posted in that account in other Google services, such as the results returned by Google’s search engine, the data subject’s Google account, or at other locations, such as on websites and in connection with advertising. In addition, Google is able to link the visit to this website with other personal data stored by Google. Google also records this personal information for the purpose of improving and optimising various Google services.

By means of the Google+ button, Google is always notified when the data subject visits our website, provided that at the time our website is accessed, the data subject is simultaneously logged in to Google+. This takes place irrespective of whether the data subject clicks on the Google+ button.

If the data subject does not want personal data to be transmitted to Google, he or she may prevent such transmission by logging out of his or her Google+ account prior to accessing our website.

Further information and Google’s applicable data protection provisions can be viewed at https://www.google.de/intl/de/policies/privacy/. Further information from Google concerning the Google+ button can be viewed at https://developers.google.com/+/web/buttons-policy.

 

  1. Data protection provisions concerning the application and use of Google AdWords

The controller has integrated Google AdWords on this website. Google AdWords is a service for internet advertising that permits advertisers to place advertisements both in the results returned by Google’s search engine and in the Google advertising network. Google AdWords enables an advertiser to specify keywords in advance, by means of which an advertisement is displayed in the results returned by Google’s search engine only if the user’s query is relevant to the keyword. In the Google advertising network, advertisements are distributed to topic-relevant websites by means of an automatic algorithm, taking into account the previously specified keywords.

The services of Google AdWords are operated by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

We use Google AdWords in order to promote our website by displaying interest-based advertising on the websites of other companies and in the results returned by Google’s search engine and by displaying third-party advertising on our website.

If a data subject reaches our website through a Google advertisement, Google sets what is known as a “conversion cookie” on the data subject’s IT system An explanation of cookies was provided above. A conversion cookie loses its validity after 30 days, and it is not used to identify the data subject. If the conversion cookie has not yet expired, it tracks whether certain subpages, such as the shopping cart of an online shop system, were accessed via our website.  The conversion cookie enables both us and Google to track whether a sale was generated by a data subject who reached our website through a Google AdWords advertisement, i.e. whether or not he or she made a purchase.

Google uses the data and information collected through the use of the conversion cookie in order to compile visitor statistics for our website. We then use these visitor statistics in order to determine the total number of users who reached us through AdWords advertisements, i.e. in order to determine the success or failure of the relevant AdWord advertisement, and in order to optimise AdWord advertisements for the future. Google does not provide our company or other advertising customers of Google AdWords with information that could be used to identity the data subject.

The conversion cookie is used to store personal information, such as the websites visited by the data subject. Accordingly, each time our website is visited, personal data, including the IP address of the internet connection used by the data subject, is transferred to Google in the United States and stored and processed by it there. In some cases, this personal data, which is collected through a technical process, is disclosed by Google to third parties.

As described above, the data subject may at any time prevent our website from setting cookies by appropriately configuring the web browser being used and thereby permanently refuse the setting of cookies. Such a configuration of the web browser being used would also prevent Google from setting a conversion cookie on the data subject’s IT system. Moreover, a cookie that has already been set by Google AdWords may at any time be deleted through the web browser or other software programs.

In addition, the data subject may object to interest-based advertising from Google. To do so, the data subject must visit www.google.de/settings/ads with each web browser he or she uses and make the desired settings there.

Further information and Google’s applicable data protection provisions can be viewed at https://www.google.de/intl/de/policies/privacy/.

 

  1. Data protection provisions concerning the application and use of LinkedIn

The controller has integrated LinkedIn components on this website. LinkedIn is an internet-based social network that enables users to connect with existing business contacts and to establish links with new business contacts. LinkedIn has over 400 million registered users in more than 200 countries, making it currently the largest platform for business contacts and one of the world’s most visited websites.

LinkedIn is operated by LinkedIn Corporation, 2029 Stierlin Court Mountain View, CA 94043, USA. LinkedIn Ireland, Privacy Policy Issues, Wilton Plaza, Wilton Place, Dublin 2, Ireland, is responsible for data protection matters outside of the U.S.

Each time our website is accessed, which is furnished with a LinkedIn component (LinkedIn plug-in), this component prompts the browser being used by the data subject to download a corresponding display of the LinkedIn component. Further information about LinkedIn plug-ins can be viewed at https://developer.linkedin.com/plugins. In connection with this technical process, LinkedIn gains knowledge about which specific subpage of our website is viewed by the data subject.

If the data subject is simultaneously logged in to LinkedIn, then each time our website is accessed by the data subject and for the entire duration of each visit, LinkedIn detects which specific subpage of our website is viewed by the data subject. This information is aggregated by the LinkedIn component and is allocated by LinkedIn to the data subject’s respective LinkedIn account. If the data subject clicks on a LinkedIn button integrated on our website, LinkedIn allocates this information to the data subject’s personal LinkedIn user account and stores this personal data.

By means of the LinkedIn component, LinkedIn is always notified when the data subject visits our website, provided that at the time our website is accessed, the data subject is simultaneously logged in to LinkedIn. This takes place irrespective of whether the data subject clicks on the LinkedIn component. If the data subject does not want such information to be transmitted to LinkedIn in this way, he or she may prevent transmission by logging out of his or her LinkedIn account prior to accessing our website.

LinkedIn provides options at https://www.linkedin.com/psettings/guest-controls for unsubscribing from email messages, SMS messages and targeted advertisements, as well as for managing advertisement settings. In addition, LinkedIn uses such partners as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua, and Lotame, which may set cookies. Such cookies may be refused by visiting https://www.linkedin.com/legal/cookie-policy. LinkedIn’s applicable data protection provisions can be viewed at https://www.linkedin.com/legal/privacy-policy. LinkedIn’s cookie policy can be viewed at https://www.linkedin.com/legal/cookie-policy.

 

  1. Data protection provisions concerning the application and use of Twitter

The controller has integrated Twitter components on this website. Twitter is a multilingual, publicly accessible micro-blogging service on which users can publish and disseminate what are known as “tweets”, i.e. short messages that are limited to 280 characters. Such tweets can be viewed be anyone, i.e. including persons who are not registered with Twitter. Tweets are also displayed to other Twitter users who follow the respective user’s tweets, known as “followers”.  In addition, through hash tags, links and retweets, Twitter makes it possible to reach a wide audience.

Twitter is operated by Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.

Each time one of the pages of this website that is operated by the controller is accessed, and on which a Twitter component (Twitter button) has been integrated, the respective Twitter component automatically prompts the web browser on the data subject’s IT system to download a display of the corresponding Twitter component from Twitter. Further information about Twitter buttons can be viewed at https://about.twitter.com/de/resources/buttons. In connection with this technical process, Twitter gains knowledge about which specific subpage of our website is viewed by the data subject. We integrate the Twitter component in order to enable our users to disseminate the content of this website, make the digital world aware of this website, and increase our visitor traffic.

If the data subject is simultaneously logged in to Twitter, then each time our website is accessed by the data subject and for the entire duration of each visit, Twitter detects which specific subpage of our website is viewed by the data subject. This information is aggregated by the Twitter component and is allocated by Twitter to the data subject’s respective Twitter account. If the data subject clicks on one of the Twitter buttons that are integrated on our website, the data and information that are transferred in the process are allocated to the data subject’s personal Twitter user account and stored and processed by Twitter.

By means of the Twitter component, Twitter is always notified when the data subject visits our website, provided that at the time our website is accessed, the data subject is simultaneously logged in to Twitter. This takes place irrespective of whether the data subject clicks on the Twitter component. If the data subject does not want such information to be transmitted to Twitter in this way, he or she may prevent transmission by logging out of his or her Twitter account prior to accessing our website.

Twitter’s applicable data protection provisions can be viewed at https://twitter.com/privacy?lang=de.

 

  1. Data protection provisions concerning the application and use of Xing

The controller has integrated Xing components on this website. Xing is an internet-based social network that enables users to connect with existing business contacts and to establish links with new business contacts. Individuals can set up a personal profile on Xing. Companies can, for instance, create a company profile or publish job openings on Xing.

Xing is operated XING SE, Dammtorstraße 30, 20354 Hamburg, Germany.

Each time one of the pages of this website that is operated by the controller is accessed, and on which a Xing component (Xing plug-in) has been integrated, the respective Xing component automatically prompts the web browser on the data subject’s IT system to download a display of the corresponding Xing component from Xing. Further information about Xing plug-ins can be viewed at https://dev.xing.com/plugins. In connection with this technical process, Xing gains knowledge about which specific subpage of our website is viewed by the data subject.

If the data subject is simultaneously logged in to Xing, then each time our website is accessed by the data subject and for the entire duration of each visit, Xing detects which specific subpage of our website is viewed by the data subject. This information is aggregated by the Xing component and is allocated by Xing to the data subject’s respective Xing account. If the data subject clicks on a Xing button integrated on our website, for example, the “Share” button, Xing allocates this information to the data subject’s personal Xing user account and stores this personal data.

By means of the Xing component, Xing is always notified when the data subject visits our website, provided that at the time our website is accessed, the data subject is simultaneously logged in to Xing. This takes place irrespective of whether the data subject clicks on the Xing component. If the data subject does not want such information to be transmitted to Xing in this way, he or she may prevent transmission by logging out of his or her Xing account prior to accessing our website.

Xing’s published privacy policy, which can be viewed at https://www.xing.com/privacy, provides information about the collection, processing and use of personal data by Xing. In addition, Xing has published a privacy policy for the Xing share button, which can be viewed at https://www.xing.com/app/share?op=data_protection.

 

  1. Data protection provisions concerning the application and use of YouTube

The controller has integrated YouTube components on this website. YouTube is a website that allows video publishers to post video clips free of charge and enables other users to view, rate, and comment on them, also free of charge. YouTube permits the publication of all types of videos, meaning that entire movies and television broadcasts, as well as music videos, trailers and videos created by users themselves, can be viewed on the website.

YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

Each time one of the pages of this website that is operated by the controller is accessed, and on which a YouTube component (YouTube video) has been integrated, the respective YouTube component automatically prompts the web browser on the data subject’s IT system to download a display of the corresponding YouTube component from YouTube. Further information about YouTube can be viewed at https://www.youtube.com/yt/about/de/. In connection with this technical process, YouTube and Google gain knowledge about which specific subpage of our website is viewed by the data subject.

If the data subject is simultaneously logged in to YouTube, then when a subpage is accessed that contains a YouTube video, YouTube detects which specific subpage of our website is viewed by the data subject. This information is aggregated by YouTube and Google and allocated to the data subject’s respective YouTube account.

By means of the YouTube component, YouTube and Google are always notified when the data subject visits our website, provided that at the time our website is accessed, the data subject is simultaneously logged in to YouTube. This takes place irrespective of whether the data subject clicks on a YouTube video. If the data subject does not want such information to be transmitted to YouTube and Google in this way, he or she may prevent transmission by logging out of his or her YouTube account prior to accessing our website.

YouTube’s published privacy policy, which can be viewed at https://www.google.de/intl/de/policies/privacy/, provides information about the collection, processing and use of personal data by YouTube and Google.

 

  1. Legal basis of processing

Article 6(1)(a) GDPR serves as the legal basis for our company for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, such as is the case with processing operations that are required for a delivery of goods or the provision of some other service or service in return, then processing is based on Article 6(1)(b) GDPR. The same applies to those processing operations that are necessary in order to take steps prior to entering into a contract, such as in cases of enquiries concerning our products or services. If processing is necessary for compliance with a legal obligation to which our company is subject, for instance, in order to satisfy tax duties, then processing is based on Article 6(1)(c) GDPR. In rare cases, processing of personal data might be necessary in order to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a person were to suffer an injury when visiting our plant, with the result that his or her name, age, health insurance data, and other vital information would have to be disclosed to a physician, a hospital, or other third parties. Processing would then be based on Article 6(1)(d) GDPR. Finally, processing operations might be based on Article 6(1)(f) GDPR. This is the legal basis for processing operations that are not covered by any of the foregoing legal bases, where processing is necessary for the purposes of a legitimate interest pursued by our company or by a third party, except where such interest is overridden by the interests or fundamental rights and freedoms of the data subject. We are therefore permitted to perform such processing operations, in particular, because they are specifically mentioned in the GDPR. In this regard, the second sentence of Recital 47 of the GDPR specifies that a legitimate interest may be presumed where the data subject is a client of the controller.

  1. Legitimate interests in processing pursued by the controller or by a third party

If the processing of personal data is based on Article 6(1)(f) GDPR, our legitimate interest is the carrying out of our business activities for the benefit of all of our employees and our owners.

  1. Period for which the personal data will be stored

The period for which personal data is stored depends on the relevant statutory retention period. After the latter period expires, the corresponding data is routinely erased, provided that it is no longer necessary for contract performance or contract initiation.

  1. Statutory or contractual requirements concerning the provision of personal data; necessity for entering into a contract; obligation of the data subject to provide personal data; possible consequences of failure to provide such data

We inform you that the provision of personal data is in some cases required by statute (e.g. tax provisions) or may also result from contractual arrangements (e.g. information concerning the contract partner). Thus, in order to enter into a contract, it may be necessary for the data subject to make personal data available to us, which then need to be processed by us. For example, the data subject is obligated to provide personal data to us where our company concludes a contract with him or her. Failure to provide personal data would mean it may not be possible to conclude the contract with the data subject. Before providing personal data, the data subject must contact one of our employees. Our employee will explain to the data subject whether in the given case the provision of personal data is required by statute or contract or is necessary for entering into the contract, whether there is an obligation to provide personal data, and what consequence there would be in the event of failure to provide personal data.

  1. Existence of automated decision-making

As a responsible company, we do not engage in automated decision-making or profiling.

This Data Protection Policy was created by the GDPR privacy policy generator of the German Association for Data Protection, in association with WILDE BEUGER SOLMECKE | Rechtsanwälte, a law firm for media law based in Cologne, Germany.