Information on data protection
With the following information, we would like to give you as a visitor to our website an overview on the processing of your personal data by us and your rights under data protection law. Which data is processed in detail depends to a large extent on your specific usage behaviour. Therefore, not every element of this information may be applicable to you.
1. Controller and contact details of the Data Protection Office
The controller in terms of data processing on this online offering is
61325 Bad Homburg
(hereinafter also referred to as the „Company“)
You can reach our external Data Protection Officer under
2. Processing of personal data in connection with your use of our websites, applications and online platforms
a. Data categories, purpose of processing and legal basis
In the context of the use of our websites, applications or online tools (in the following summarised as „online offering“) , we process the following personal data:
- Personal data that you yourself enter voluntarily in the context of an online offering (such as during registration, requests to contact you or in the context of participation in surveys, etc.), such as first and last name, E-mail address, telephone number, information provided in the context of a support request, comments or forum posts and
- Information that is automatically sent to us by your web browser or terminal device, such as your IP address, device type, browser type, previously visited web pages, sub-pages visited or the date and time of each visitor request.
We will process your personal data for the following purposes:
- Technical administration of the website (Prevention and detection of fraudulent or similar acts including attacks on our IT infrastructure, enabling user authentication)
The legal basis for the processing of personal data for these purposes is Article 6 paragraph 1 lit. f) GDPR, regardless of whether a contractual relationship exists with you.
- Online and other services (Enabling the use of the services and functions of our online offerings, processing of enquiries, sending marketing information upon request)
The legal basis for processing personal data for the purpose specified above is Article 6 paragraph 1 lit. b) and lit. f) GDPR. The visit to our online offering establishes a legal relationship similar to a contract in the sense of Article 6 paragraph 1 lit. b) GDPR. Without the processing of personal data, we cannot offer our online services as intended. In particular, the transmission of personal data such as the IP address is necessary for establishing the connection.
In some cases we will ask you expressly for your consent to the processing of your personal data. In such a case, the legal basis for processing your personal data is the consent you have given in accordance with Article 6 paragraph 1 lit. a) GDPR in conjunction with Article 7 GDPR.
Within the framework of our online offering we also use so-called cookies. Cookies are small text files that are stored by your browser on your end device when you visit our website. Cookies contain information that is related to the context of use and your terminal device.
We provide information about cookies in our cookie banner and you can access the cookie settings at any time via the fingerprint at the bottom left of the screen.
Consent management with Usercentrics
The tool allows us to inform you of the consent you have provided and to obtain, manage and document your consent.
The purpose of processing this data is to obtain consent, provide the option of withdrawing or changing consent and keep a record of consent obtained (legal obligation). The legal basis for this is Article 6(1)(f) GDPR (legitimate interests in the stated purposes).
c. Contacting us
Contact forms which can be used for electronic contact are available on our website. If a user takes advantage of these options, the data entered in the input mask is transmitted to us and part of the data is stored.
In this context, no data will be passed on to third parties outside the Company. The data will be used exclusively for processing the correspondence.
The legal basis for processing data transmitted in connection with sending an E-mail is Article 6 paragraph 1 sentence 1 lit. f) GDPR. If the aim of the E-mail contact is conclusion of a contract, Article 6 paragraph 1 sentence 1 lit. f) GDPR is a further legal basis for processing. Processing the personal data from the input mask serves us to make contact and to prevent improper use of the contact form.
The data will be erased as soon as it is no longer necessary for achieving the purpose of collection. For the personal data from the input mask of the contact form and that sent by E-mail, this will be the case when the respective correspondence ends.
Users have the possibility to object to the processing of their personal data at any time. In such a case, the correspondence cannot be continued. Please send us your deletion request via E-mail to firstname.lastname@example.org. In this case, all personal data stored in the course of the contact will be deleted.
3. Processing of personal data for customer satisfaction surveys and direct marketing
If you have given us your consent or if we are entitled to do so within the framework of existing customer relations, your contact data will also be used for the purposes of direct marketing (e.g. trade fair invitations, newsletters) or for conducting customer satisfaction surveys. You have the right to object to the use of your contact details for these purposes at any time. If you wish to exercise your right of objection in this respect, please write us an E-mail to email@example.com or follow the relevant instructions which you have received from us in any advertising mail. The legal basis for processing your data for advertising purposes is Article 6 paragraph 1 lit. f) GDPR in the case of existing customer relationships or Article 6 paragraph 1 lit. a) GDPR if you have given us your consent.
4. Processing of personal data of Business Partners
a. Data categories, purpose of processing and legal basis
Within the scope of cooperation with Business Partners, the Company processes personal data of contact persons at customers, suppliers, interested parties, sales partners and cooperation partners (hereinafter referred to as “Business Partners”):
- contact details such as first and last name, business address, business telephone number, business mobile number, business fax number and business E-mail address,
- payment information such as details required for processing payment transactions or preventing fraud, including credit card details and card verification numbers,
- other information, the processing of which is necessary within the framework of a contractual relationship and which is voluntarily provided by Business Partners, such as orders, inquiries or details of projects,
- we will also store your IP address and the date of your registration when you register for a customer account,
- personal data collected from publicly available sources, information databases or credit agencies, and
- as far as legally required in the context of compliance screenings: date of birth, identity card and ID numbers, information on relevant legal proceedings or other legal disputes involving Business Partners.
Personal data is also processed for the following purposes:
- Communication with Business Partners on products, services and projects, for example to process inquiries from the Business Partner or to provide technical information on products,
- Performance of contracts,
- Planning, execution and management of the contractual business relationship, for example to process orders for products and services, collect payments, for accounting and billing purposes and to carry out deliveries, maintenance activities or repairs,
- Processing of registration for a customer account,
- Management of a customer account for pre-contractual services, for the fulfilment of the contract or for the purpose of customer cultivation (e.g. in order to provide you with an overview of your previous orders with us or in order to be able to offer you the so-called memo function),
- Conducting customer surveys, marketing campaigns, market analyses, competitions, etc.,
- Maintenance and protection of the safety of our products and our websites, prevention and discovery of safety risks, fraudulent activities or other criminal offences or acts carried out with the intent to cause damages;
- Comparison of personal data with US sanctions lists based on the European regulations 2580/2001 and 881/2002,
- Compliance with (i) legal requirements (e.g. tax and commercial retention requirements), (ii) existing obligations to conduct compliance screenings (to prevent white-collar crime or money laundering), and (iii) policies and industry standards; and
- Settling legal disputes, enforcing existing agreements as well as asserting, exercising and defence against legal claims.
Processing personal data is necessary to achieve the aforementioned purposes. Unless expressly stated otherwise at the time of collection of personal data, the legal basis for data processing is
- the execution and performance of a contract with you or for carrying out pre-contractual measures under Article 6 paragraph 1 lit. b) GDPR,
- the fulfilment of legal obligations to which the undertaking is subject under Article 6 paragraph 1 lit. c) of the GDPR, or
- safeguarding legitimate interests under Article 6 paragraph 1 lit. f) GDPR. The legitimate interest lies in the initiation, implementation and handling of the business relationship in commercial transactions.
If you have expressly given your consent to processing your personal data in individual cases, this consent is the legal basis for processing in accordance with Article 6 paragraph 1 lit. a) GDPR.
5. Processing of personal data of applicants
a. Categories of data and purpose of data processing
Within the framework of the application procedure, we process the following categories of personal data:
- personal data (first and last name, date of birth, address, school-leaving certificate)
- communication data (telephone number, mobile number, fax number, E-mail address)
- data on assessment and evaluation in the application procedure
- data on education (school, vocational training, civilian / military service, university education, doctorate)
- data on the previous professional career, training and work certificates
- information on other qualifications (e.g. language skills, PC skills, voluntary work)
- application photo
- details of the desired salary
- application history
- Social media links (link to Xing or LinkedIn profile, if data transfer from these profiles was selected)
Personal data that you provide us with in the context of your application will be stored and used exclusively for the purpose of processing your application and, if applicable, for the purpose of the subsequent employment.
b. Legal basis of data processing
The processing of your personal data in the context of the application procedure is based on Article 6 paragraph 1 lit. b) GDPR (establishment and execution of a contract) as well as Sec. 26 (1) sentence 1 German Data Protection Act (BDSG).
Any further processing of applicant data will take place only on the basis of an explicit declaration of consent. This is particularly the case if we are unable to offer you a current vacancy in the Company, but consider your application suitable for future positions. The storage and processing of your data in this respect will then be based on your consent in accordance with Article 6 paragraph 1 lit. a) GDPR).
The storage and processing of your data for forwarding to other companies of the group is also based on your consent in accordance Article 6 paragraph 1 lit. a) GDPR.
c. Transfer of data
Your data will be made available to the relevant members of the Human Resources Department and to the employees or managers of the department(s) responsible for the position for which you have applied.
In the case of an unsolicited application, your documents will be made available to the relevant members of the Human Resources Department and to the responsible employees or superiors of the relevant departments for whom your application might be of interest.
We will not forward your application data to affiliated subsidiaries or parent companies unless your application also relates to these companies or is kept open for this purpose. We also use contract processors (e.g. IT service providers). Your data will be passed on to them in strict compliance with the obligation of secrecy and the requirements of the GDPR. The processors commissioned by us may process the data only for us and not for their own purposes. Responsibility for data processing in these cases remains with us.
Data will also be passed on if we are obliged to do so by law and/or official or court orders.
d. Transfer of personal data to third countries
Our Company is part of a group of companies in which personnel responsibilities may extend beyond national borders. For this reason, responsible superiors in other countries may also have access to your application data. These data processing operations are necessary for the decision on the establishment of an employment relationship. In addition, data transfer to third countries also takes place when your data is included in the Talent Pool. This means that our affiliated foreign units also have access to your application data.
When data are transferred to a body in a third country, relevant guarantees for the protection of your personal data ensure that the data protection level of the European Union is observed.
e. Erasure periods for application data
If no employment is established, the application documents will be erased six months after a candidate has been turned down. The legal basis for storage in this respect is Article 6 paragraph 1 lit. f) GDPR. Our legal interest in this respect is the defence against any claims arising from the German General Equal Treatment Act (“AGG”). In all other respects, the general erasure periods and notes under Clause 8 apply.
6. Other tools
a. Google Fonts
Our online offer uses so-called fonts from Google Fonts of (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, (“Google”) (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)). These fonts are integrated locally on our site so that no connection to Google servers is established. The processing of your personal data (e.g. IP address) takes place solely on our servers.
7. Recipients and categories of recipients
Within our Company, access to your data is granted to those bodies that need it to fulfil their contractual and legal obligations. Service providers and agents appointed by us may also receive the data for these purposes if they commit to protecting confidentiality and integrity. These are companies in the IT services, telecommunications and sales and marketing categories.
As far as passing on data to recipients outside our company is concerned, it must first be kept in mind that we will pass on only necessary personal data, observing all regulations on data protection. As a matter of principle, we may pass on information about you only if this is required by law, you have given your consent or we have otherwise been granted authority. Under these circumstances, recipients of personal data may, for example, be:
- public authorities and institutions (such as authorities prosecuting criminal acts) if based on a statutory or regulatory obligation,
- other group-affiliated companies for risk management purposes due to legal or regulatory obligations,
- service providers whom we involve in connection with contract data processing relationships.
Within the scope of contract processing, we pass on your data to the transport company commissioned with the delivery of the goods or to the financial service provider on the basis of Art. 6 paragraph 1 lit. b) GDPR insofar as the transfer is necessary for the delivery of the goods or for payment purposes.
8. Transfer to third countries
Data transfer to bodies in states outside the European Union (so-called third countries) will take place to the extent
- this is required for performance of the contractual relationship (such as shipment orders),
- it is required by law (such as obligatory reporting under tax law), or
- you have given us your consent.
Furthermore, the transmission of data to third countries for the purpose of maintaining and ensuring the IT operation and IT security of the Company cannot be ruled out.
The use of our range of social media and map services may result in data transmissions and subsequent processing of usage data by the respective services in the U.S. The basis for any processing activities is your explicit declaration of consent which you have given via the cookie banner. Your declaration of consent justifies such data processing by way of exception and on a case-by-case basis pursuant to Article 49 paragraph 1 lit. a) GDPR. Please note that data protection which would be comparable to the level in the EU and EEA does not exist in the United States. In particular, it is possible that state authorities may access your personal data on the basis of legal authorisations without us or you being informed. There are no comparable opportunities for enforcing the law of another country in the U.S. so that this does not appear promising.
Possible data transmissions exclusively take place in automated form in connection with the use of our social media offerings and Google’s map services and with the help of cookies.
Furthermore, as explained in other sections, personal data may be transmitted to third countries by the companies to which we pass on personal data.
9. Retention period
We process and store your personal data as long as is necessary for the fulfilment of our contractual obligations and the exercise of our rights.
The revocation of any consent given previously will be stored for three years (accountability). The administrative cookie will be deleted 6 months after the last visit. Server log data is deleted or anonymised after seven days at the latest, unless further storage is required for evidentiary purposes. Data on newsletters and invitations will be deleted as soon as you unsubscribe.
In individual cases, longer storage of data for the purpose of providing evidence may be justified in legitimate individual cases. According to Secs. 195 et seqq. German Civil Code (BGB), this statute of limitations may be up to 30 years, the regular statute of limitations being 3 years.
10. Data security
For reasons of security and to protect the transmission of confidential contents such as orders or inquiries that you send to us as the site operator, this website with our online offering has implemented SSL or TLS encryption. You will recognise an encoded connection by the change in the address line of the browser from “http://” to “https://” and the lock symbol in your browser line.
Our staff and the providers we have hired are committed to confidentiality and compliance with the provisions of the applicable data protection laws. The Company takes adequate technical and organisational security measures to protect your personal data against loss, modification, destruction, access by unauthorised persons or unlawful transfer. Our security measures are being improved on an ongoing basis in accordance with technological development.
11. Rights of data subjects
Every data subject has the right to information pursuant to Article 15 GDPR, the right to rectification pursuant to Article 16 GDPR, the right to erasure pursuant to Article 17 GDPR, the right to limitation of processing pursuant to Article 18 GDPR, and the right to data portability pursuant to Article 20 GDPR.
As far as the right to obtain information and the right to erasure are concerned, the restrictions pursuant to Secs. 34 and 35 BDSG are applicable. Moreover, there is a right to appeal to a competent data protection supervisory authority (Article 77 GDPR in conjunction with Sec. 19 BDSG).
You can withdraw your consent for us to process your personal data at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
You also have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you, in particular on the basis of Article 6 paragraph 1 lit. f) of the GDPR. If you do object, we will no longer process your personal data unless we have compelling justified reasons for such processing which override your interests, rights and freedoms. This will especially be the case where processing is required for asserting, exercising or defending legal rights.
In accordance with Article 22 GDPR, you also have the right not to be subject to fully automated decision-making. As a matter of principle, we do not use fully automated decision-making processes to establish, perform or terminate a business relationship. In the event that we should use such processes in individual cases (for example to improve our products and services), we will inform you of this and of your rights in this respect separately if prescribed by law.
For more information and explanations regarding the above rights, please visit the website “Rights for citizens“ of the European Commission.
12. Obligation to provide data
Within the scope of our online service, we rely on the processing of such usage data that is necessary for the implementation and termination of the service and for the fulfilment of the associated obligations. Without the collection of usage data, we and our service providers are not able to provide you with our online offering. The provision of personal data is neither legally nor contractually required.
We do not automatically process your personal data in such a way that it has a legal effect on you or significantly affects you in a similar manner.