Data protection

General information about the processing of your data

We are obliged by law to inform you about the processing of your personal data (hereinafter referred to as “data”) when you use our website. We take the protection of your personal information very seriously. This data protection notice informs you about the details of the processing of your data and about your legal rights in this regard. For terms such as “personal data” and “processing”, the legal definitions pursuant to Art. 4 GDPR apply. We reserve the right to adapt the privacy policy with future effect, in particular in the event of further development of the website, the use of new technologies or changes to the legal bases or the corresponding case law. We recommend that you read this privacy policy from time to time and take a printout or a copy for your records.

Scope

This privacy policy applies to all pages of www.promecon.com/de. It does not cover any linked websites of other providers.

Responsible provider

The following party is responsible for the processing of personal data within the scope of this privacy policy:

PROMECON
process measurement control GmbH
Steinfeldstraße 5
39179 Barleben
Tel.: +49 (0)39203 5120
Fax: +49 (0)39203 512202
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Any data subject may, at any time, contact our Data Protection Officer directly with all questions and suggestions concerning data protection.

Questions about data protection

If you have any questions about data protection with regard to our company or our website, you can contact our data protection officer:

Spirit Legal LLP Rechtsanwälte
Attorney-at-law and data protection officer
Peter Hense
Postal address:
Data protection officer
c/o PROMECON, Steinfeldstraße 5, 39179 Barleben

Contact via encrypted online form: Contact data protection officer

Security

We have taken comprehensive technical and organisational precautions to protect your personal data from unauthorised access, abuse, loss and other external disruption. To this end, we regularly review our security measures and adapt them to current standards.

Your rights

You have the following rights with regard to the personal data concerning you that you can assert against us:
  • Right of access: You can request access to the personal data concerning you which we process, as set forth in Art. 15 GDPR.

  • Right to rectification: If the information concerning you is not (or no longer) correct, you can request its rectification in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed.

  • Right to erasure: You may request the erasure of your personal data in accordance with Art. 17 GDPR.

  • Right to restriction of processing: Pursuant to Art. 18 GDPR, you have the right to demand that the processing of your personal data be restricted.

  • Right to object to processing: Pursuant to Art. 21(1) GDPR, you have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data which occurs based on Art. 6(1) Sentence 1(e) or (f) GDPR. If you object, we will not process your data further, unless we can prove compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms or, moreover, the processing serves to establish and exercise or defend against legal claims (Art. 21(1) GDPR). Furthermore, under Art. 21(2) GDPR you have the right to object at any time to the processing of your personal data for direct marketing purposes, which includes profiling to the extent that this is related to such direct marketing. In this privacy policy, we draw your attention to this right to object when describing each processing operation.

  • Right to withdraw your consent: If you have given your consent for processing, you have a right to withdraw that consent under Art. 7(3) GDPR.

  • Right to data portability: You have the right to receive the personal data you have given us in a structured, commonly used, machine-readable format (“data portability”) and the right to transfer this data to another controller, if the prerequisites of Art. 20(1)(a), (b) GDPR are fulfilled (Art. 20 GDPR).

You can assert your rights by informing us using the contact details specified above under “Responsible provider” or by contacting the data protection officer designated by us.

If you believe that the processing of your personal data violates data protection law, then under Art. 77 GDPR you also have the right to lodge a complaint with a data protection supervisory authority of your choice.

Using our website

In principle, you can use our website for purely informational purposes without disclosing your identity. When you access the individual pages of the website in this sense, this only results in access data being transferred to our web hosting service so that the website can be displayed to you. This involves the following data being processed:

• Browser type / browser version
• Operating system used
• Date and time of access
• IP address
• Access status / HTTP status code
• Websites accessed via the website
• Referrer URL (website visited before)
• Notification of whether the access was a success
• Time zone difference from GMT
• Volume of data transferred.

It is necessary for this data to be processed temporarily in order to make it technically possible for you to visit our website and to deliver the website to your device. The access data is not used to identify individual users and is not combined with other data sources. The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR. We have legitimate interests in ensuring the functionality, integrity and security of the website. The access data will be erased as soon as it is no longer required for achieving the purpose of its processing. In the case of recording the data to provide the website, this is the case when you end your visit to the website.

You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation. You may send us your objection using the contact details specified under “Responsible provider” above.

Cookies

In addition to the aforementioned access data, so-called cookies are stored in the internet browser of the device you use to access the website. These are small text files with a sequence of numbers that are stored locally in the cache of the browser used. Cookies do not become part of the device system and cannot execute programs. They serve to make our website user-friendly. The use of cookies may be technically necessary or may occur for other purposes (e.g. analysis/evaluation of website use).

Technically necessary cookies

Some elements of our website require that the retrieving browser can be identified even after a page change. This involves processing the following data in the cookies:

• Language settings
• Items in shopping basket
• Log-in information.

The user data collected by technically necessary cookies is not processed to create user profiles. We also use session cookies, which store a session ID that can be used to assign various requests from your browser to the shared session. Session cookies are required for using the website. In particular, they enable us to recognise the device used when you return to the website. The legal basis of this processing is Art. 6(1) Sentence 1(f) GDPR. Our legitimate interests in the processing lie in providing the aforementioned special functionality and thereby making the use of our website more attractive and effective. The session cookies are erased as soon as you log out or, depending on which browser you are using and your browser settings, when you close the browser.

You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation. You can prevent data processing based on cookies as follows: by deactivating or restricting or deleting cookies in your browser settings, or by opening your browser in “private mode”.

Technically non-essential cookies

In addition, we also use cookies on the website to enable an analysis of users’ surfing behaviour and to make our website more attractive. For example, this involves processing the following data in the cookies:

• Entered search terms
• Frequency of page views
• Use of website functions.

The legal basis of this processing is your consent: Art. 6(1) Sentence 1(a) GDPR. Technically non-essential cookies are either automatically deleted after a specified period of time, which may vary depending on the type of cookies used, or are deleted after you withdraw your consent. Where we integrate cookies from third-party providers into our website, we point this out to you separately below.

You can withdraw your consent at any time by clicking on the button for the tool in the privacy settings. If you exercise your right of withdrawal, this does not affect the lawfulness of the processing carried out on the basis of the consent prior to the withdrawal. xxx

Usercentrics consent management platform

We have integrated Usercentrics, a consent management tool provided by Usercentrics GmbH (Sendlinger Straße 7, 80331 Munich, Germany; This email address is being protected from spambots. You need JavaScript enabled to view it.) on our website to request users’ consent for the use of cookies or comparable technologies. With the help of Usercentrics, you have the opportunity to grant or refuse your consent for certain functions of our website, e.g. for the purpose of integrating external elements, integrating streamed content, statistical analysis, reach measurement and personalised advertising. You can use Usercentrics to grant or refuse your consent for all functions or to grant your consent for individual purposes or functions. You can change your settings again later on. The purpose of integrating Usercentrics is to allow users of our website to decide whether to allow cookies and similar technologies, and to offer them the opportunity to change settings that they have already made when they continue to use our website. When Usercentrics is used, personal data as well as information from the devices used by website users, such as their IP address, will be processed.

The legal basis for this processing is Art. 6(1) Sentence 1(f) GDPR. Our legitimate interests in this processing lie in the storage of users’ settings and preferences with regard to the use of cookies and other features. Usercentrics stores your data for as long as your user settings are active, usually for 360 days. After this period, a new request for consent will be made. Your user settings will then be saved again for the same period.

You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation. You can prevent data processing based on cookies as follows: by deactivating or restricting or deleting cookies in your browser settings, or by opening your browser in “private mode”.

Contacting our company

When contacting our company, e.g. by email or using the contact form on the website, we will process the personal data provided by you so that we can respond to your request. In order for us to process enquiries submitted via the contact form on the website, it is essential that you provide a name or pseudonym, your company name and a valid email address and telephone number. At the time the message is sent to us, your IP address, browser information and the date and time of registration will be processed. The legal basis of this processing is Art. 6(1) Sentence 1(f) GDPR and Art. 6(1) Sentence 1(b) GDPR, if the contact is made with the intention of concluding a contract. If the request is aimed at concluding a contract, it is necessary for you to provide your data in order to conclude a contract. If you do not provide your data, it will not be possible to conclude or execute a contract (in the form of establishing contact or processing the request). Processing the personal data from the form serves the sole purpose of processing the contact you make with us. Where you contact us by email, this also constitutes the necessary legitimate interest in the processing of the data. The other data processed during the submission process serves to prevent any misuse of the contact form and to ensure the security of our information technology systems. The data will not be transmitted to third parties in this context. As soon as processing is no longer necessary, we erase the data generated in this context – usually two years after the end of the communication – or, if statutory retention obligations apply, restrict processing of the data.

You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation. You may send us your objection using the contact details specified under “Responsible provider” above.

Processing for contractual purposes

We process your personal data if and to the extent necessary for the initiation, creation, execution and/or termination of a legal transaction with our company. The legal basis for this results from Art. 6(1) Sentence 1(b) GDPR. It is necessary for you to provide your data in order to conclude the contract and you are contractually obliged to provide your data. If you do not provide your data, it will not be possible to conclude and/or execute a contract. Once the purpose has been achieved (e.g. contract processing), the personal data will be blocked for further processing or erased, unless we are entitled to keep processing the data on the basis of a consent granted by you (e.g. consent to the processing of your email address for sending promotional emails), a contractual agreement, a statutory authorisation (e.g. authorisation to send direct marketing) or on the basis of justified interests (e.g. retention for asserting claims).

Your personal data will be passed on to third parties if
  • it is necessary for the creation, execution or termination of legal transactions with our company (e.g. when transmitting data to a payment service provider/a shipping company to process a contract with you) (Art. 6(1) Sentence 1(b) GDPR), or
  • a subcontractor or party we use to perform our obligations, which we use exclusively within the framework of providing the offers or services requested by you, needs this data (unless you are expressly informed otherwise, such auxiliary parties are only entitled to process the data insofar as this is necessary for the provision of the offer or service), or
  • there is an enforceable official order (Art. 6(1) Sentence 1(c) GDPR), or
  • there is an enforceable court order (Art. 6(1) Sentence 1(c) GDPR), or
  • we are legally obliged to do so (Art. 6(1) Sentence 1(c) GDPR), or
  • the processing is necessary in order to protect the vital interests of the data subject or another natural person (Art. 6(1) Sentence 1(d) GDPR), or
  • this is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (Art. 6(1) Sentence 1(e) GDPR), or
  • we can cite our overriding legitimate interests, or those of a third party, in the disclosure (Art. 6(1) Sentence 1(f) GDPR).
Your personal data will not be transmitted to other persons, companies or bodies unless you have effectively consented to such transmission. The legal basis of the processing is then Art. 6(1) Sentence 1(a) GDPR. In this privacy policy, we draw your attention to the respective recipients when describing each processing operation.

Online application process

On our website you have the possibility to access information about vacant positions in our company and apply for them. The processing of your personal data in connection with the online application process is carried out for the purpose of conducting the application process and for making hiring decisions.

When you apply, we process the following personal data, which is necessary and obligatory for the online application process:
  • Personal master data (e.g. salutation, title, first name and last name, name supplements, gender, nationality, marital status, salary group if applicable)
  • Contact details (e.g. private address, email address, (mobile) phone number)
  • Qualification data (e.g. career, professional activities, assessments, references, certificates, qualifications, further education and training)
  • Information about your education and training (e.g. your school or training institution, your main subject, your specialisation, your degree, your grades and the date of your degree)
  • If applicable, your application photo
  • If applicable, special categories of personal data pursuant to Art. 9(1) GDPR (e.g. trade union membership, biometric data, health data (e.g. the degree of disability))
  • Other data that you have transmitted to us in connection with your application.
When you submit the online application, your IP address and the date and time when you submitted your application will also be processed.

Individual purposes and legal bases

The legal basis for the processing of your personal data in connection with the online application process for the purpose of general communication, and in particular for answering any queries, for the purpose of carrying out reference checks, and for the purpose of assessing your suitability for the vacant position, is Art. 88(1) and Art. 6(1) Sentence 1(b) GDPR in conjunction with Sect. Art. 26(1) of the German Federal Data Protection Act (BDSG). The processing of your data is necessary and obligatory for the preparation and conduct of the application process. If you do not provide this data, we may not be able to process your application or may not be able to process it sufficiently. The following purposes and legal bases apply to the processing of special categories of personal data within the meaning of Art. 9(1) GDPR:
  • We process your personal data for the purpose of exercising rights or fulfilling legal obligations arising from employment law, unless there is reason to believe that this is outweighed by your legitimate interest in the data not being processed. The legal basis for this processing is Art. 9(2)(b) GDPR in conjunction with Sect. 26(3) Sentence 1 BDSG.
  • For the purpose of assessing your working capacity, we will process your health data, provided that you are offered employment as a result of the application process. The legal basis for the processing is Art. 9(2)(h) GDPR in conjunction with Sect. 22(1) No. 1(b) BDSG.
For the purpose of fulfilling a legal obligation or to comply with requests from governments and authorities, we process your personal data to the extent necessary for the stated purposes. The legal basis for the processing is Art. 6(1) Sentence 1(c) GDPR in conjunction with the relevant legal obligation under Union or national law. If, in individual cases, special categories of data are also affected, we will only process this data in accordance with one of the rules laid down in Art. 9(2) GDPR, if applicable in connection with an explicit regulation in Union or national law.

For statistical purposes, we keep a record – without reference to specific applicants – of the number of applications received over time, the time of each application’s submission, and the processing time from receipt of the application to acceptance or rejection. The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR. We have a legitimate interest in optimising our application management.

You may object to the processing described if you have legitimate reasons arising from your particular situation. You can exercise your right of objection by sending us a message via the contact details provided under “Responsible provider” above.

Should we require the data after the application process has ended, for the pursuit of legal claims or for defence in legal disputes, processing may be carried out to safeguard legitimate interests pursuant to Art. 6(1) Sentence 1(f) GDPR. In such cases, we have a legitimate interest in asserting or defending claims. If health data is involved, the legal basis is Art. 9(2)(f) GDPR.

You may object to the processing described if you have legitimate reasons arising from your particular situation. You can exercise your right of objection by sending us a message via the contact details provided under “Responsible provider” above.

Storage period

In principle, we save your personal data for the duration of the application process, erasing it after no more than six months in the event of a rejection.

Recipients, persons with access

Upon receipt of your application, your application data will be reviewed by the HR department. Suitable applications are then forwarded internally to the department heads responsible for the respective vacancies within the company in order to coordinate the further procedure. In principle, only those persons in the company have access to your data who need this for the regular conduct of our application process.

Service provider HRworks GmbH

To conduct the online application process and handle our HR processes, we use the web-based software HRworks, which is provided by HRworks GmbH (Konrad-Goldmann-Straße 5 b, 79100 Freiburg, Germany; hereinafter referred to as: HRworks). HRworks offers you the possibility to apply directly online for vacant positions in our company and to submit your application documents online. For this purpose, HRworks creates a separate URL for each job vacancy advertised. When you apply online, HRworks processes the personal data you provide which is necessary and obligatory in order to conduct the online application process. Upon receipt of your application documents, HRworks will forward your data to our HR department.

HRworks acts as our processor and is contractually limited in its authority to use your personal data for purposes other than to provide services to us in accordance with the applicable data processing agreement.

The legal basis for the data processing is Art. 6(1) Sentence 1(f) GDPR. Our legitimate interests in using HRworks lie in optimising our application process, improving our range of services, and making our online application portal and the application process itself more attractive and applicant-friendly.

For further information about the protection of your data and how long HRworks stores your data, please refer to https://www.hrworks.de/unternehmen/datenschutz/ and https://www.hrworks.de/en/features/candidate-management-system/.

You may object to the processing described if you have legitimate reasons arising from your particular situation. You can exercise your right of objection by sending us a message via the contact details provided under “Responsible provider” above.

Talent pool

If you would like your application to be considered for other vacant positions in our company once the application process has finished, you have the opportunity to be added to our talent pool. If you are added to the talent pool, we will process the data you provide during the application process on the basis of your consent in accordance with Art. 6(1) Sentence 1(a) GDPR. Your data will be stored for processing for the talent pool for a maximum of two years.

You can withdraw your consent to the further processing of your applicant data at any time. You can submit your withdrawal to us using the contact details provided under “Responsible provider” above. This will not affect the lawfulness of the processing carried out on the basis of the consent prior to the withdrawal.

Compliance screening

As part of the initiation and execution of the employment relationship, we are obliged under the EC counter-terrorism Regulations (Regulation (EC) No 2580/2001; Regulation (EC) No 881/2002) to implement extended control mechanisms for the purpose of combating terrorism in order to check our business contacts with individual persons, entities and groups. In accordance with these Regulations, we are required to ensure that no funds are made available, directly or indirectly, to persons, entities or groups included in the sanctions lists. This means that all funds, financial assets, titles and economic resources of such persons, groups and entities concerned shall be frozen and that no funds, financial assets or economic resources shall be made available to or for the benefit of them, whether directly or indirectly, so as to enable them to obtain funds, goods or services. For this purpose, we compare the first and last names of our employees and applicants with those on the publicly accessible sanctions lists as part of a compliance screening process.

The legal basis of the processing is Art. 6(1) Sentence (1)(e) and (3) Sentence (1)(a) GDPR in conjunction with Regulation (EC) No. 2580/2001 and Regulation (EC) No. 881/2002, insofar as the processing is necessary for the performance of a task carried out in the public interest, or Art. 6(1) Sentence 1(f) GDPR. We have legitimate interests in fulfilling legal requirements and obligations to combat terrorism and avoiding liability and sanction risks for our company. We store the results of the compliance screening for a maximum period of twelve months in the case of employee screening, and for a maximum period of six months in the case of applicants.

To carry out the comparison we use the software “ID.prove”, which is provided by Rausoft GmbH (Böblinger Straße 25, 71229 Leonberg, Germany). For this purpose, ID.prove processes your first and last name on our behalf in order to automatically compare this information with the current version of the sanctions lists. Once this process is complete, ID.prove informs us of the result of the compliance screening, so that we can document this in our HR administration system. The legal basis for the processing of data by ID.prove is Art. 6(1) Sentence 1(f) GDPR. We have legitimate interests in improving our range of services and avoiding liability and sanction risks for our company. For further information about data protection, please refer to https://www.idprove.de/index.php?option=com_content&view=article&id=18&Itemid=30 and https://www.idprove.de/index.php?option=com_content&view=article&id=28&Itemid=0.

You may object to the processing described if you have legitimate reasons arising from your particular situation. You can exercise your right of objection by sending us a message via the contact details provided under “Responsible provider” above.

Email marketing

Advertising to existing customers

We reserve the right to use the email address you provide when ordering in accordance with the statutory provisions in order to send you the following content by email at the time of or after your order, unless you have already objected to this processing of your email address:
  • Interesting offers from our portfolio, especially about industry-specific products
  • New offers involving our products and services
  • Information about company events
  • Information about our catalogues
  • Technical information
  • Customer feedback queries.
If it is essential to send information electronically for contract processing purposes (e.g. an informative email), the legal basis of the processing is Art. 6(1) Sentence 1(b) GDPR. You are contractually obliged to provide your data. If you do not provide your data, it will not be possible to send information electronically by email in order to execute the contract. If it is not essential to send information electronically for contract processing purposes (e.g. an informative email), the legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR. Our legitimate interests in the processing described lie in enhancing and optimising our services, conducting direct marketing and ensuring customer satisfaction. We will erase your data when you stop using the service, but no later than three years after termination of the contract.

We would like to point out that you can object to receiving direct marketing and to the processing of the data for direct marketing purposes at any time without incurring any costs other than the transmission costs according to the basic rates. Here you have a general right of objection without giving reasons (Art. 21(2) GDPR). To do this, click on the unsubscribe link in the relevant email or send us your objection to the contact details provided under “Responsible provider”.

Newsletter

You have the possibility to subscribe to our email newsletter on the website, which we use to inform you regularly about the following content:
  • Offers from our portfolio
  • Information about company events
  • New offers involving our products and services
  • Special/time-limited offers
  • Offers and events of third parties, especially our partners.
In order to receive the newsletter, you will need to provide your name or a pseudonym as well as a valid email address. We process this data for the purpose of sending our email newsletter and for as long as you have subscribed to the newsletter.

The legal basis for the processing is Art. 6(1) Sentence 1(a) GDPR.

You can withdraw your consent to the processing of your email address for the purpose of sending you the newsletter at any time, either by sending us a message using the contact details provided under “Responsible provider” above or by clicking directly on the unsubscribe link in the newsletter. This will not affect the lawfulness of the processing carried out on the basis of the consent prior to the withdrawal.

Double opt-in procedure

In order to document your newsletter registration and to prevent abuse of your personal data, we use what is known as a double opt-in procedure for email newsletter registrations. Once you have entered the data marked as mandatory, we will send you an email to the email address you have provided, in which we ask you to expressly confirm your subscription to the newsletter by clicking on a confirmation link. We process your IP address, the date and time of your registration for the newsletter and the time of your confirmation.

This is how we ensure that you really want to receive our email newsletter.

We are legally obliged to be able to demonstrate that you have consented to the processing of your personal data in connection with registering for the newsletter (Art. 7(1) GDPR). Due to this legal obligation, this data processing is carried out on the basis of Art. 6(1) Sentence 1(c) GDPR. You are not obliged to provide your personal data during the registration process. However, if you do not provide the required personal data, we may not be able to process your subscription or process it in full. If you do not confirm your newsletter subscription within 24 hours, we will block the information transmitted to us and erase it automatically after one month at the latest.

Once you confirm your registration, we will process your data for as long as you have subscribed to the newsletter.

Establishment, exercise or defence of legal claims

We also process the aforementioned data for the establishment, exercise or defence of legal claims. The legal basis for this processing is Art. 6(1) Sentence 1(c) GDPR and Art. 6(1) Sentence 1(f) GDPR. In these cases, we have a legitimate interest in the assertion or defence of claims.

You may object to the processing described if you have legitimate reasons arising from your particular situation. You can exercise your right of objection by either sending us a message using the contact details provided under “Responsible provider” above or by clicking directly on the unsubscribe link in the newsletter.

Opt-out list

If you cancel your registration by withdrawing your consent, we will continue to process your data, in particular your email address, to ensure that you do not receive any further newsletters from us. For this purpose, we will add your email address to an opt-out list, which makes it possible to prevent you from receiving any further newsletters from us.

The legal basis for the data processing is Art. 6(1) Sentence 1(c) GDPR, in order to comply with our obligations to provide evidence, and failing this, Art. 6(1) Sentence 1(f) GDPR. In this case, we have a legitimate interest in complying with our legal obligations to make sure that we stop sending you newsletters.

You may object to the processing described if you have legitimate reasons arising from your particular situation. You can exercise your right of objection by sending us a message via the contact details provided under “Responsible provider” above.

Statistical analyses and reach measurement

We also evaluate the opening/click rates of our newsletters. For this analysis, the emails sent out contain so-called web beacons or tracking pixels, which display single-pixel image files that are also embedded on our website. Device information (e.g. the email client used and software settings) is processed for this purpose. The processing is carried out for the purpose of evaluating how our newsletters are read. Here we record whether and when you read our newsletters, which links you click on, and thus draw conclusions about what our recipients are interested in. This information can theoretically be assigned to individual newsletter recipients. However, neither we nor our external email marketing service have any intention of monitoring individual recipients; the analysis of the information mentioned serves rather to recognise the overall reading habits, opening and click rates of all recipients. The information is processed for as long as you have subscribed to the newsletter. Once you unsubscribe, we process the data for purely statistical purposes and anonymously.

The legal basis of this processing is your consent (Art. 6(1) Sentence 1(a) GDPR).

You can withdraw your consent to the processing of your email address for the purpose of sending you the newsletter at any time, either by sending us a message using the contact details provided under “Responsible provider” above or by clicking directly on the unsubscribe link in the newsletter. This will not affect the lawfulness of the processing carried out on the basis of the consent prior to the withdrawal.

Newsletter2Go email marketing service

We use the email marketing service “Newsletter2Go”, which is provided by Newsletter2Go GmbH (Köpenicker Straße 126, 10179 Berlin; hereinafter referred to as: Newsletter2Go). If you have subscribed to our newsletter, the data you provided when registering as well as the data processed when you use our newsletters are processed on Newsletter2Go’s servers in Germany. The data you provide when registering will be encrypted using SSL technology and then transmitted to Newsletter2Go.

Newsletter2Go acts as our external processor and is contractually restricted in its authority to use your personal data for purposes other than to provide services to us in accordance with the applicable data processing agreement.

The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR. Our legitimate interest in using an external email marketing service lies in the optimisation and more targeted control and monitoring of our newsletter content.

For more information, including on the storage period, please refer to the Newsletter2Go privacy policy at https://www.newsletter2go.de/datenschutz/ as well as https://hilfe.newsletter2go.de/?_ga=2.268559921.1383479931.1583849133-1018654755.1583849133.

You may object to the processing described above if you have legitimate reasons arising from your particular situation. You can exercise your right of objection by either sending us a message using the contact details provided under “Responsible provider” above or by clicking directly on the unsubscribe link in the newsletter.

A/B Testing

Within our newsletters, we also conduct analyses of user behaviour by means of so-called multivariate A/B testing, which is a service provided by Newsletter2Go GmbH (Köpenicker Straße 126, 10179 Berlin; hereinafter referred to as: Newsletter2Go). Here, two versions of our newsletters (variants A and B) are compared with each other on the basis of a measurable target (e.g. email contacts per target group, sales realised, etc.) in order to determine through statistical analysis which newsletter, or which variant of the content, subject line and sender, achieves the better performance or is more efficient. Within a pre-defined time window of a maximum of two days, recipients of our newsletters are shown several variants of a newsletter with varying contents, depending on the relevant target. In order to evaluate this A/B-testing, Newsletter2Go places cookies or tracking pixels within the newsletters, which in particular process the information generated by your device about interactions with our newsletters (whether you use a certain link, or opening, click and bounce rates, etc.). Newsletter2Go also processes some of the data mentioned under “Using our website” above, such as browser information.

The legal basis of the processing of your data for A/B testing is Art. 6(1) Sentence 1(f) GDPR. By conducting A/B testing, we pursue our legitimate interests of analysing the reach and efficiency of our services and ads, continuously improving them and making them more attractive for you as a user. The information is processed for as long as you have subscribed to the newsletter. Once you unsubscribe, we process the data for purely statistical purposes and anonymously.

For more information, including on the storage period, please refer to the Newsletter2Go privacy policy at https://www.newsletter2go.de/datenschutz/ as well as https://hilfe.newsletter2go.de/?_ga=2.268559921.1383479931.1583849133-1018654755.1583849133.

You may object to the processing described if you have legitimate reasons arising from your particular situation. You can exercise your right of objection by sending us a message via the contact details provided under “Responsible provider” above.

Requests for information material

On the website, you can request information material from us in which we tell you about products from our portfolio. In order to receive the information material, you need to give us your contact details. The data processed includes:
  • Recipient’s name
  • Address
  • Recipient’s function
  • Contact details (e.g. email address, telephone number).
We process the data you provide for the purpose of initiating and preparing and, if necessary, performing the contract, and for sending you the information material. At the time of the request, your IP address and the date and time of the request are also processed. The legal basis for the data processing is Art. 6(1) Sentence 1(b) GDPR. The provision of your data is necessary and obligatory in order to conclude the contract. If you do not provide your data, you will be unable to request the information material, which means that it will not be possible to conclude and/or execute a contract. The data you provide when requesting information material may, if necessary, be transferred to our sales partners within the European Union as well as in third countries for the purpose of processing your request, preparing offers, clarifying technical questions and processing orders, if you submit your request from one of these countries within our sales partner network. In order to ensure an adequate level of protection, any data transfer to a third country will be carried out exclusively on the basis of adequacy decisions adopted by the European Commission (e.g. Japan, Canada) in accordance with Art. 45 GDPR or subject to appropriate safeguards for the data transfer pursuant to Art. 46 f. GDPR, or on the basis of the exception under Art. 49(1) Sentence 1(b) GDPR. A copy of these appropriate and adequate safeguards is available upon request by contacting us using the contact details provided under “Responsible provider” above.

If it is necessary to send you the information material by post, we will also forward your data to the relevant shipping company. The processing is carried out in order to fulfil the aforementioned purposes both within and outside the European Union. We erase the data as soon as storage is no longer necessary or, if statutory retention obligations apply, restrict processing of the data. Due to mandatory commercial and tax regulations, we are obliged to keep your address, payment and order data for a period of ten years. Two years after termination of the contract, we will restrict the processing and reduce the processing to compliance with our existing legal obligations. As far as the information material contains advertising content that goes beyond pure information provided for the potential conclusion of a contract, the legal basis of this is Art. 6(1) Sentence 1(f) GDPR. We have a legitimate interest in processing for the purpose of direct marketing. In order to fulfil the aforementioned purposes, your data may be passed on to the respective sales partners in the countries of our sales partner network responsible for you. The processing takes place both inside and outside the European Union. Unless you object to processing for advertising purposes, we will erase your data no later than two years after you request the information material.

We would like to point out that you can object to receiving direct marketing and to the processing of the data for direct marketing purposes at any time without incurring any costs other than the transmission costs according to the basic rates. Here you have a general right of objection without giving reasons (Art. 21(2) GDPR). Please send us your objection to the contact details specified under “Responsible provider” above.

Downloading white papers

You can download white papers from our website. When you download the white paper, your IP address and the date and time of your query are processed. We process this data for the purpose of fulfilling your request or executing the contract. The legal basis for this data processing is Art. 6(1) Sentence 1(b) GDPR. The provision of your data is necessary and obligatory in order to conclude the contract. If you do not provide your data, you will not be able to download the white paper, i.e. it will not be possible to conclude and/or execute a contract. As soon as storage is no longer necessary, we erase the data generated in this context, or in any case restrict its processing if statutory retention obligations apply. Due to mandatory commercial and tax regulations, we may be obliged to keep your address, payment and order data for a period of ten years. Two years after termination of the contract, we will restrict the processing and reduce the processing to compliance with our existing legal obligations.

Hosting

We use external hosting services provided by STRATO AG (Pascalstraße 10, 10587 Berlin, Germany), which serve to provide the following services: infrastructure and platform services, computing capacity, storage resources and database services, security and technical maintenance services. For these purposes, all of the data required for the operation and use of our website – including the access data mentioned under “Using our website” – is processed. The legal basis for this processing is Art. 6(1) Sentence 1(f) GDPR. By using external hosting services, our aim is to make the provision of our website efficient and secure.

You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation. You may send us your objection using the contact details specified under “Responsible provider” above.

Integration of third-party content

The website integrates third-party content such as videos, maps and graphics from other websites. This integration always requires that the providers of this content (“third-party providers”) perceive the IP addresses of users. This is because without the IP address they would not be able to send the content to the browser of the respective user. As such, the IP address is required to display this content. In the following, we inform you about the services from third-party providers currently in use on our website, about the respective processing in each case, and about how you can object.

Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter referred to as “reCAPTCHA”) on our website. This service is provided by Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001). reCAPTCHA is used to check whether data entered on the website (e.g. in a contact form) is provided by a person or by an automated program. To do this, reCAPTCHA analyses various aspects of the way in which the visitor to the website behaves. This analysis starts automatically as soon as the user accesses the website. For the purpose of this analysis, reCAPTCHA evaluates various information (e.g. IP address, time spent by the visitor on the website or mouse movements made by the user). The data collected during the analysis is forwarded to Google. Google also processes your personal data in the US and has subjected itself to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. You can view Google’s certification at https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active. The processing occurs on the basis of Art. 6(1) Sentence 1(f) GDPR. We have a legitimate interest in protecting our website from abusive automated spying and unsolicited email advertising (spam). For more information about reCAPTCHA and how long the data is stored, please refer to Google’s privacy statement: https://policies.google.com/privacy.

You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation. You may send us your objection using the contact details specified under “Responsible provider” above.

Google Tag Manager

Our website uses Google Tag Manager, which is provided by Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001). Google Tag Manager is a solution that allows website tags to be managed through a single interface. The Google Tag Manager tool itself (which implements the tags) is a cookieless domain and does not record any personal data. The tool triggers other tags, which in turn may record data; our privacy policy explains this separately in each case. Google Tag Manager does not access this data. If deactivation has occurred at the domain or cookie level, it will remain effective for all tracking tags implemented with Google Tag Manager.

Services for statistical, analysis and marketing purposes

We use services from third parties for statistical, analysis and marketing purposes. This enables us to offer you a user-friendly, optimised experience when visiting the website. The third-party providers use cookies to control their services (see “Cookies” above). In the following, we inform you about the services from third-party providers currently in use on our website, about the respective processing in each case, and about how you can object.

Google Analytics

In order to tailor our website perfectly to user interests, we use Google Analytics, a web analytics service from Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001). Google Analytics uses cookies (see “Cookies” above), which are stored on your device. Google uses the cookies to process the information generated about the use of our website by your device – e.g. the fact that you have visited a certain page – and processes, among other things, the data mentioned under “Using our website”, in particular your IP address, browser information, the website visited before and the date and time of the server request, for the purpose of statistical analysis of how people use our website. This website uses Google Analytics with the “anonymizeIp()” extension. This shortens IP addresses before they are processed, in order to make it much more difficult to identify individuals. According to Google, your IP address is shortened beforehand within member states of the European Union. Only in exceptional cases will the full IP address be transferred to a Google server in the US and shortened there. On our behalf, Google will process this information for the purpose of evaluating your use of this website, compiling reports for us on website activity, and – where we point this out separately – providing us with other services relating to website usage. Google will not associate the IP address transmitted by your browser for these purposes with any other data held by Google. The legal basis for the processing is Art. 6(1) Sentence 1(a) GDPR. Your data processed in connection with Google Analytics will be erased after fourteen months at the latest. For the exceptional cases in which your data is transferred to the US, Google has subjected itself to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. You can view Google’s certification at https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active. For further information about privacy at Google, please refer to http://www.google.de/intl/en/policies/privacy.

You can withdraw your consent at any time by clicking on the button for the tool in the privacy settings. If you exercise your right of withdrawal, this does not affect the lawfulness of the processing carried out on the basis of the consent prior to the withdrawal.

Copyright © by Spirit Legal