Data Protection Information for Visitors to the Website

II. Rights of Data Subjects

In accordance with Art. 15 of the General Data Protection Regulation (GDPR), you have the right to obtain information about the personal data stored about you, including any recipients and the planned storage period. If incorrect personal data is processed, you have the right to rectification in accordance with Art. 16 GDPR. If the legal requirements are met, you can request the erasure or restriction of processing and object to processing (Art. 17, 18 and 21 GDPR).

If you wish your data to be erased but we are still legally obliged to retain it, access to your data will be restricted (blocked). The same applies in the event of an objection. You can exercise your right to data portability insofar as the technical possibilities are available to the recipient and to us.

You can contact us at the above address regarding your rights as a data subject.

If you are of the opinion that the processing of your personal data violates the General Data Protection Regulation, you have the right to lodge a complaint with the data protection supervisory authority responsible for us, the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information, www.ldi.nrw.de, as well as with any other data protection supervisory authority.

III. Legal Basis

Pursuant to Art. 13 GDPR, we process personal data in accordance with the following legal bases:

• Art. 6 (1)(a) GDPR for the processing of personal data with the consent of the data subject.
• Art. 6 (1)(b) GDPR for the processing of personal data necessary for the performance of a contract with the data subject, as well as for taking appropriate steps prior to entering into a contract.
• Art. 6 (1)(c) GDPR for the processing necessary for compliance with a legal obligation to which we are subject in accordance with applicable EU law or in accordance with the applicable law of a country in which the GDPR is applicable in whole or in part.
• Art. 6 (1)(f) GDPR for the processing of personal data necessary to protect the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
  Legitimate interests are, in particular, our commercial interest to be able to provide our website, the security of information, the enforcement of our own legal claims and the compliance with further legislation.

To this end, in the context of service provision, we use service providers that have been separately bound to maintain confidentiality and to protect data. Data shall only be disclosed to a third party in the existence of overriding statutory provisions.

IV. Information on data transfer to the USA

Among other things, tools from companies based in the USA are integrated into our website. If these tools are active, your personal data may be transferred to the US servers of the respective companies. We would like to point out that the USA is not a safe third country within the meaning of EU data protection law. US companies are obliged to disclose personal data to security authorities without you as the data subject being able to take legal action against this. It can therefore not be ruled out that US authorities (e.g. secret services) may process, analyse and permanently store your data on US servers for surveillance purposes. We have no influence on these processing activities.

Data will only be passed on with your consent or through the deliberate use/activation of the respective service.

V. Right to Withdraw Consent

You can revoke any consent you have given with effect for the future in accordance with Art. 7 GDPR.

VI. Data Security/Encryption

This website uses “Hypertext Transfer Protocol Secure” (https). The connection between your browser and our server is encrypted.

Encrypted payment transactions on this website

If there is an obligation to provide us with your payment details (e.g. account number for direct debit authorisation) after the conclusion of a chargeable contract, this data is required for payment processing.

Payment transactions via the usual means of payment (Visa/MasterCard, direct debit) are made exclusively via an encrypted SSL or TLS connection. You can recognise an encrypted connection in your browser’s address line when it changes from “http://” to “https://” and the lock icon is displayed in your browser’s address bar.

When communication is encrypted, the payment data you send to us cannot be read by third parties.

VII. Purposes of Processing

General: Presentation of the company, provision of services and/or sale of products and communication via the Internet. The purpose of data processing on this website is to provide information about our company’s products and services and, if necessary, to process applications with the possibility for users to contact the contact persons in the company in a targeted manner.

1. General

If you have provided us with personal data, we will use it to respond to your enquiries, to advise you and to process contracts concluded with you, and for purposes of technical administration. Your personal data will only be passed on to third parties or otherwise shared if this is necessary for the purpose of contract processing or for billing purposes or if you have given your prior consent. You have the right to withdraw your consent at any time with effect for the future (see Right to Withdraw Consent).

In the scope of contract processing, the legal basis for the collection, processing and transfer of the data is Art. 6 (1)(b) GDPR.

This data will be deleted after expiry of the applicable statutory retention obligations. If we are not subject to any statutory retention obligations, the data will be deleted when the purpose no longer applies.

You have the right to access and object to your data stored by us at any time. Further information can be found under “Rights of Data Subjects” and “Right to Withdraw Consent”.

2. Server Data Collection

Purpose of Processing

When you visit our website, various server statistics are automatically stored, which your browser transmits to our provider’s server: Among other things, the IP address of your device, date and time of access to the website, the name and URL of retrieved files, the website from which access to the website is made or from which you were directed to our website (referrer URL), the browser used and, if applicable, the operating system of your device and the name of your provider are logged.

The above data is processed by us for the purposes of smooth connection establishment and system security. The IP addresses are stored in anonymised form. The last three digits are removed for this purpose. IPv6 addresses are also anonymised. The anonymised IP addresses are stored for 60 days. Details of the directory protection user used are anonymised after one day.

Error logs, which record incorrect page views, are deleted after seven days. In addition to the error messages, these contain the accessing IP address and, depending on the error, the website accessed.

This data is not merged with other data sources.

Cookies required for operation

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest arises from the fact that we want to ensure the secure operation of the website and recognise any attacks.

4. Google Analytics (GA4)

This website uses functions of the web analytics service Google Analytics. The provider of this service is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. The website operator receives various usage data, such as page views, length of visit, operating systems used and origin of the user. This data is summarised in a user ID and assigned to the respective end device of the website visitor.

We can also use Google Analytics to record your mouse and scroll movements and clicks, among other things. Google Analytics also uses various modelling approaches to supplement the data records collected and uses machine learning technologies for data analysis.

Google Analytics uses technologies that enable the recognition of the user for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is generally transmitted to a Google server in the USA and stored there.

The use of this service is based on your consent in accordance with Art. 6 (1)(a) GDPR and § 25 para. 1 TTDSG. Consent can be withdrawn at any time.

5. Google conversion tracking

This website uses Google conversion tracking. The provider of this service is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google conversion tracking, Google and we can recognise whether the user has performed certain actions. For example, we can analyse which Google advertisements resulted in a successful sale and the value of the goods sold. This information is used to create conversion statistics. We can find out the total number of users who have clicked on our advertisements and what actions they have taken. We do not receive any information with which we can personally identify the user. Google itself uses cookies or comparable recognition technologies for identification purposes.

The use of this service is based on your consent in accordance with Art. 6 (1)(a) GDPR and § 25 para. 1 TTDSG. Consent can be withdrawn at any time.

6. Newsletter

If you would like to receive the newsletter offered on the website, we require an email address from you as well as information that allows us to verify that you are the owner of the email address provided and that you agree to receive the newsletter. No further data is collected, or only on a voluntary basis. We use this data exclusively for sending the requested information and do not pass it on to third parties.

The data entered in the newsletter registration form is processed exclusively on the basis of your consent (Art. 6 (1)(a) GDPR). You can withdraw your consent to the storage of the data, the email address and its use for sending the newsletter at any time, for example via the “Unsubscribe” link in the newsletter. The lawfulness of the data processing operations that have already taken place remains unaffected by the withdrawal of your consent.

The data you provide us with for the purpose of subscribing to the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and deleted from the newsletter distribution list after you unsubscribe from the newsletter or after the purpose has ceased to apply. We reserve the right to delete or block email addresses from our newsletter distribution list at our own discretion within the scope of our legitimate interest in accordance with Art. 6 (1)(f) GDPR.

After you unsubscribe from the newsletter distribution list, your email address may be stored by us or the newsletter service provider in a blacklist to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6 (1)(f) GDPR). Storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest.

7. Registration on this Website

You can register on this website in order to use additional functions on the site. We will only use the data you enter for the purpose of using the respective offer or service for which you have registered. The mandatory information requested during registration must be provided in full. Otherwise, we will reject the registration.

In the event of important changes, such as changes to the scope of offers/services or technically necessary modifications, we will use the email address provided during registration to send you information.

The data entered during registration is processed for the purpose of implementing the user relationship established by the registration and, if necessary, for the initiation of further contracts (Art. 6 (1)(b) GDPR).

The data collected during registration will be stored by us for as long as you are registered on this website and will then be deleted. Statutory retention periods remain unaffected.

8. Contact Form and Enquiry by Email

Purpose of Processing

When you use our contact form, we collect and store your name and email address for the purpose of responding to your enquiry. The telephone number for a return call is optional. If you send us a contact request by email, we collect and store the email address and the data contained in the email.

The legal basis for this is Art. 6 (1)(a) GDPR, as you consent to the above-mentioned processing of your data when using the form and sending an email. The legal basis is also derived from Art. 6 (1)(b) GDPR, as the storage of the data is necessary for the fulfilment of a pre-contractual or possible later contractual relationship.

The data will be deleted when the purpose of the storage no longer applies, i.e. after we have responded to your email / contact form, or when the matter relating to the enquiry has been finally clarified.

You have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

You can find information on the right to withdrawal of consent and information under “Rights of Data Subjects”.

9. Data protection information about our presence on social networks and platforms

We maintain a company presence on YouTube and LinkedIn. As the status of social media with regard to data protection is a broadly discussed issue – and very justifiably so – we would like to take this opportunity to inform you accordingly.

We maintain a presence on these social media platforms on the basis of our legitimate interest in communicating with the users active there and offering information on the networks/platforms.

Legitimate interests (Art. 6 (1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are outweighed by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

As this always involves data processing by the providers of the networks (usually for market research and advertising purposes) and some of this processing takes place outside the European Union, our presence on such platforms is only aimed at the respective users active there who have consciously agreed to the terms of use of the respective providers.

Providers based in the US are obligated to offer guarantees of a secure level of data protection comparable to EU data protection standards.

When considering and implementing our online presence on social networks and platforms, we take particular account of the following:

• No exclusive information on social networks and platforms, but only information about posts and events on our own website.
• No advertising and publicising of our presence outside the respective networks/platforms – i.e. no explicit recruitment of users who have not agreed to the terms of use.
• No plug-ins or integration of scripts from providers.
• Regular evaluation of presence in the social networks/platforms and risk assessments.

The relevant information on data protection and the privacy policies can be found below:

YouTube:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Privacy policy: https://policies.google.com/privacy?hl=de

LinkedIn:
LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
Privacy policy: https://www.linkedin.com/legal/privacy-policy

10. Audio and video conferences

Data processing

We use online conferencing tools, among others, to communicate with our customers. The individual tools we use are listed below. If you communicate with us online by video or audio conference, your personal data will be collected and processed by us and by the provider of the conferencing tool used.

The conferencing tools collect all data that you provide/enter to use the tools (email and/or your telephone number). The conferencing tools also process the duration of the conference, the start and end (time) of participation in the conference, the number of participants and other “contextual information” in connection with the communication process (metadata).

Furthermore, the provider of the tool processes all technical data required for the processing of online communication. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or loudspeaker and the type of connection.

If content is exchanged, uploaded or provided in any other way within the tool, this is also stored on the servers of the tool provider. Such content includes, in particular, cloud recordings, chat/instant messages, voice mail, uploaded photos and videos, files, whiteboards and other information shared while using the service.

Please note that we do not have full control over the data processing operations of the tools used. Our options are largely determined by the company policy of the respective provider. Further information on data processing by the conferencing tools can be found in the privacy policies of the tools used, which we have listed below this text.

Purpose and legal basis

The conferencing tools are used to communicate with prospective or existing contractual partners or to offer certain services to our customers (Art. 6 (1)(b) GDPR). Furthermore, the use of the tools serves the general simplification and acceleration of communication with us or our company (legitimate interest within the meaning of Art. 6 (1)(f) GDPR). If consent has been requested, the tools in question are used on the basis of this consent; consent can be withdrawn at any time with effect for the future.

Storage duration

The data collected directly by us via the video and conferencing tools will be deleted from our systems as soon as you request their deletion, revoke your consent to storage, or the purpose for data storage no longer applies. Stored cookies remain on your end device until you delete them. Mandatory statutory retention periods remain unaffected.

We have no influence on the storage period of your data that is stored by the operators of the conferencing tools for their own purposes. For details, please contact the operators of the conferencing tools directly.

Please also note our Information on Data Transfer to the USA.

Conferencing tools used

We use the following conferencing tools:

1. Zoom
   We use Zoom. The provider of this service is Zoom Communications Inc., San Jose, 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA. Details on data processing can be found in Zoom’s privacy policy: zoom.us/de-de/privacy.html.
   Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: zoom.us/de-de/privacy.html.
   Conclusion of a contract for order processing
   We have concluded a contract for order processing with the provider of Zoom and fully implement the strict requirements of the German data protection authorities when using Zoom.
2. Microsoft Teams
   We use Microsoft Teams. The provider of this service is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Details on data processing can be found in Microsoft’s privacy policy: privacy.microsoft.com/de-de/privacystatement.
   Conclusion of a contract for order processing
   We have concluded a contract for order processing with the provider of Microsoft Teams and fully implement the strict requirements of the German data protection authorities when using Microsoft Teams.

11. eCommerce and payment providers

Processing of data (customer and contract data)

We collect, process and use personal data only insofar as it is necessary for the establishment, content or amendment of the legal relationship (inventory data). This is done on the basis of Art. 6 (1)(b) GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures. We collect, process and use personal data about the use of this website (usage data) only insofar as this is necessary to enable the user to utilise the service or to bill the user.

The customer data collected will be deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

Data transmission when concluding contracts for online shops, retailers and goods dispatch

We only transfer personal data to third parties if this is necessary in the context of contract processing, for example to the companies entrusted with the delivery of the goods or the credit institution commissioned with payment processing. Any further transmission of data will not take place or will only take place if you have expressly consented to the transmission. Your data will not be passed on to third parties without your express consent, for example for advertising purposes.

The basis for data processing is Art. 6 (1)(b) GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures.

Payment services

We integrate payment services from third-party companies on our website. When you make a purchase from us, your payment details (e.g. name, payment amount, account details, credit card number) are processed by the payment service provider for the purpose of payment processing. The respective contractual and data protection provisions of the respective providers apply to these transactions. The payment service providers are used on the basis of Art. 6 (1)(b) GDPR (contract processing) and in the interest of a smooth, convenient and secure payment process (Art. 6 (1)(f) GDPR). Insofar as your consent is requested for certain actions, Art. 6 (1)(a) GDPR is the legal basis for data processing

VIII. Currency and amendment of this Privacy Policy

We reserve the right to amend the content of this Privacy Policy at any time. This is usually done in the event of further development or adaptation of the services used. You can view the current Privacy Policy on our website. Status of this declaration: 18/05/2022