Data privacy
Information on data protectionThe owners/operators of these website pages take the protection of your personal data very seriously. We treat your personal data confidentially and in compliance with the statutory data protection regulations and this data protection statement.
As a rule, use of this website is possible without providing personal data. Where personal data is collected on our web pages (for example, name, address or e-mail addresses), this will, to the extent possible, always be on a voluntary basis. Such data will not be passed on to third parties without your express consent.
We point out that the transmission of data over the internet (e.g. when communicating by e-mail) may involve security issues. Complete end-to-end protection of data from access by third parties is impossible.
– – – – – – – – – –
Data Protection Statement pursuant to Art. 13 GDPR:
1. Introduction
This website is provided to you by CLAGE GmbH. In the following, we inform you pursuant to the EU General Data Protection Regulation (GDPR) about how our website processes your personal data when the website is called up and used.
2. Responsibilities
Name and contact details of the person responsible can be found in our provider identification / imprint here: https://www.clage.com/en/contact/imprint.php.
3. Data Protection Officer
Our Data Protection Officer can be contacted by post, adding the address component “Data Protection Officer”, at:
CLAGE GmbH
“Data Protection Officer”
Pirolweg 4
21337 Lüneburg
Germany
or by e-mail at datenschutz@clage.de
4. Processing of personal data
4.1. General overview of the processing activities
Personal data is used on our website for the following purposes:
– Operation of the website
– Presentation of products and services
– Contacting our teams
– Reach analysis to optimise the website
– Display of maps to help you find us
– Presentation of company and product films
– Device registration
– Improving customer service
– Facebook fan page
– Voice control with the help of third parties
– Email newsletters
– Live seminars and training
– Raffles
– Online shop
– Information for customers and business partners
– Customer survey
– Request Customer Service
In the secure area of our websites we offer existing customers the following services:
– Service reports
– Spare parts shop
4.2. Operation of the website
4.2.1. Nature and scope of the processing of personal data
The following information transferred automatically to us by your browser is processed during every visit to our website:
– IP address (identifier of your terminal in the network).
– Host name (the IP address can be used to locate the location of your terminal device. The host name is determined via the IP address and may provide information about the origin of the user and the provider of Internet services.)
– Browser and operating system (e.g. Google Chrome, Windows 10)
– Cookie (this value documents the cookies that the accessed website or domain may have stored for you)
– Language (e.g. the language you have set in your browser)
– Previous website (the one you visited before this one)
If you have activated JavaScript in your browser, further information can also be read from your browser with each page call, e.g.
– JavaScript: yes / no
– Screen resolution (e.g. 1680 x 1050)
– Colour depth (e.g. 24 bit)
– Size of the browser window (e.g. 1680 x 917)
4.2.2. Purposes of and legal basis for the processing of personal data
The above data is processed by the person responsible to ensure proper operation of the website (compliance with legal duties, i.e. security of processing pursuant to Art. 6 Section 1 (f) GDPR, such as to combat or investigate cyber attacks)
4.2.3. Recipients or categories of recipients
Our websites are hosted by LüneCom Kommunikationslösungen GmbH, Marie-Curie-Str., 21337 Lüneburg and Datadock, 1 Rue du Havre, 67100 Strasbourg, France. A job processing agreement was concluded with the service providers pursuant to Art. 28 GDPR. The aforementioned data will be forwarded to other recipients only to the extent necessary for the prevention of criminal offences and/or if we are otherwise legal required to do so.
4.2.4. Period of retention
The personal data is deleted automatically 4 weeks after termination of the connection unless prevented by statutory retention periods.
4.2.5. Right to deletion, objection and correction
Collection of the data for the provision of the website and storage of the data in log files is absolutely necessary for the operation of the webpage. There is consequently no possibility to delete, object to or correct the data on the part of the user.
4.3. Contact form or making contact by e-mail
4.3.1. General information
Our contact form offers a simple way to send us online typical inquiries about products and services. This might include the following: request printed information material, search for a dealer or fitter, request to use a CLAGE online service, registration for an event, technical questions, distribution questions, general questions, etc.
If you send us inquiries by contact form, we process the following data for the purpose of handling the inquiry:
– Personal master data
– Address data
– Communication data
– Data on your inquiry
Alternatively, it is possible to make contact using the e-mail addresses provided. In the latter case, your personal data transmitted with the e-mail is stored.
In neither case is the data passed on to third parties. The data are used exclusively for the internal processing of the inquiry and for the communications required for this.
4.3.2. Purposes of and legal basis for the processing of personal data
The processing of personal data from the dialogue box serves solely the purpose of processing the establishment of contact. If the making of contact is directed at the initiation, fulfilment or termination of an agreement, the legal basis for processing is Art. 6 para. 1 p. 1 letter b GDPR. In all other cases, your personal data will be processed in accordance with our legitimate interest in responding to your enquiry in a timely manner pursuant to Art. 6 para. 1 p. 1 letter f) GDPR.
4.3.3. Recipients or categories of recipients
Alternatively, it is possible to make contact using the e-mail addresses provided.
4.3.4. Transmission of personal data to third countries
No data is transmitted to countries outside of the EU or the EEA (known as “third countries”).
4.3.5. Period of retention
Your data is processed as part of your making contact and deleted when no longer necessary, i.e. when it can be assumed from the circumstances that the matter concerned has been conclusively clarified and processing is not prevented by statutory retention periods.
4.3.6. Right to information, deletion, objection and correction
You have the possibility at all times to revoke your consent to processing of personal data effective for the future. If you have contacted us, you can revoke your permission for storage of your personal data at any time. In such a case, it will be impossible to continue the conversation. For this purpose, write an e-mail to the following address: datenschutz@clage.de. All personal data stored over the course of establishing contact is deleted in such a case, unless there are legitimate interests on our part or on the part of third parties.
4.4. Range measurement
4.4.1. General information
On this website we use the "etracker" component. etracker is a web analysis service. Web analysis is the collection, compilation and evaluation of data on the behaviour of visitors to websites. A web analysis service records, among other things, data on the website from which a data subject arrives at a website (known as a referrer), which subpages of the website were accessed and how often and how long a subpage was looked at.
4.4.2 etracker
The provider of this website uses services of etracker GmbH from Hamburg, Germany (www.etracker.com) to analyse usage data. We do not use cookies for web analysis by default.
The data generated with etracker is processed and stored by etracker on behalf of the provider of this website exclusively in Germany and is therefore subject to the strict German and European data protection laws and standards. etracker has been independently audited, certified and awarded the ePrivacyseal data protection seal of approval in this regard.
The data processing is carried out on the basis of the legal provisions of Art. 6 para. 1 p. 1 letter f (legitimate interest) of the General Data Protection Regulation (GDPR). Our concern in terms of the GDPR (legitimate interest) is the optimisation of our online offer and our web presence. Since the privacy of our visitors is important to us, data that may allow a reference to an individual person, such as the IP address, login or device identifiers, are anonymised or pseudonymised as soon as possible. No other use is made of the data, nor is it merged with other data or passed on to third parties.
Visitors to this website also have the option to switch off the consent-free and cookie-free tracking. When switching off, a technically necessary cookie is set that is valid until the browser is closed.
You can find more information about data protection at etracker here.
4.5. Display of map material for better arrival
4.5.1 General
Our website uses the "OpenStreetMap" service to show you, for example, our specialist partners or others on a road map and to make it easier for you to find us.
4.5.2 Purpose and legal basis of the processing of personal data
When you access this website, personal data is automatically transferred to the service provider in accordance with point 4.2. The processing of your personal data takes place to enable the display of the position of our specialist partners, etc. (Legitimate interest pursuant to Art. 6 Para. 1 letter f GDPR).
4.5.3 Recipients or categories of recipients
The operating company of the OpenStreetMap components is the Open-Street-Map Foundation (OSMF), 132 Maney Hill Road, Sutton Coldfield, West Midlands, B72 1JU, United Kingdom.
4.5.4 Transfer of personal data to third countries
No personal data will be transferred to third countries.
4.5.5 Duration of storage
No personal data will be stored.
4.5.6 Right to erasure, objection and correction
As no personal data is stored, there is no right to deletion, objection or correction.
4.5.7. miscellaneous
If you click on a service of your choice in the "Route planner" area, you will be forwarded directly to the respective provider. In doing so, the data mentioned in point 4.2 will automatically be transmitted. The privacy policy of the respective provider apply.
4.6. Corporate and product films
4.6.1. General information
We embed videos from the “YouTube” platform. Our videos act as a source of information for end customers, specialist partners and other individuals who want to obtain more information on our company, our products and our services. The operator of the Google Analytics component is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland.
4.6.2. Purposes of and legal basis for the processing of personal data
When calling up this website, personal data is automatically transferred to the service provider pursuant to Item 4.2. The data is processed in order to facilitate the display of videos (legitimate interest pursuant to Art. 6 para. 1 p. 1 letter f GDPR).
4.6.3. Recipients or categories of recipients
The operator of the Google Analytics component is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland.
4.6.4. Transmission of personal data to third countries
Your personal data may be transferred within Google to a third country (Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA). In its adequacy decision (EU) 2016/1250 of 12 July 2016 (EU-US Data Protection Shield), the European Commission decided that there is an adequate level of data protection in the USA if companies have the appropriate certification. You can view the corresponding certificate from Google here: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active
4.6.5. Period of retention
We are not aware of how long YouTube or Google stores the aforementioned data.
4.6.6. Right to deletion, objection and correction
Google’s data protection statement: https://www.google.com/policies/privacy/
Opt-out in Google accounts: https://adssettings.google.com/authenticated
4.7. Appliance registration
4.7.1. General information
Appliance registration allows customers to register the products they have bought along with communication details, customer master data and appliance-specific data (article number, serial number, etc.). For this purpose, the customer is able to log in with his/her password and can call up online his/her registered appliances and registered users. It is possible to register without a login.
4.7.2. Purposes of and legal basis for the processing of personal data
CLAGE offers the possibility of registering appliances as a voluntary service aimed at providing better customer service. In this case, the legal basis of Art. 6 para. 1 p. 1 letter b GDPR (consent) will apply.
4.7.3. Recipients or categories of recipients
A job processing agreement was concluded with the service provider pursuant to Art. 28 GDPR. The above data is forwarded exclusively to CLAGE.
4.7.4. Transmission of personal data to third countries
No data is transmitted to countries outside of the EU or the EEA (known as “third countries”).
4.7.5. Period of retention
The storage period for all archived documents complies at the least to the statutory periods pursuant to Sec. 257 HGB (German Commercial Code) and Sec. 147 AO (German Fiscal Code).
4.7.6. Right to deletion, objection and correction
You have the possibility at all times to delete your consent to processing of personal data effective for the future. If you have contacted us by e-mail, you can revoke your permission for storage of your personal data at any time. In such a case, the benefits of the guarantee cannot be continued. To do so, write an e-mail to the following address: datenschutz@clage.de. All personal data stored in the course of contacting you will be deleted in this case.
4.8. Customer survey (“Feedback”)
4.8.1. General information
Existing customers can use this page to let us known, on a scale of 1 to 6, how satisfied they are with our products and services.
4.8.2. Purposes of and legal basis for the processing of personal data
This service offers customers the opportunity to rate CLAGE. It serves to improve our products, our services and our advertising. This is a voluntary service provided to our customers. The processing of personal data from the dialogue box serves solely the purpose of processing the establishment of contact. If the making of contact is directed at the initiation, fulfilment or termination of an agreement, the legal basis for processing is Art. 6 para. 1 p. 1 letter b GDPR. In all other cases, the legal basis of Art. 6 para. 1 p. 1 f GDPR (legitimate interest) will apply.
4.8.3. Recipients or categories of recipients
The above data is forwarded exclusively to CLAGE.
4.8.4. Transmission of personal data to third countries
No data is transmitted to countries outside of the EU or the EEA (known as “third countries”).
4.8.5. Period of retention
The storage period for all archived documents complies at the least to the statutory periods pursuant to Sec. 257 HGB (German Commercial Code) and Sec. 147 AO (German Fiscal Code).
4.8.6. Right to deletion, objection and correction
You have the possibility at all times to revoke your consent to processing of personal data effective for the future. If you have contacted us by e-mail, you can revoke your permission for storage of your personal data at any time. In such a case, it will be impossible to continue the conversation. For this purpose, write an e-mail to the following address: datenschutz@clage.de. All personal data stored over the course of establishing contact is deleted in such a case.
– – – – – – – – – –
The following items (4.9. to 4.10.) relate to the protected partner area of our websites. This area is only accessible by registered existing customers. In order to obtain authorisation for this area, existing customers have to apply to us in writing for access quoting their customer number. They will be given a password which, used along with their customer number, will allow them to log in. After a successful log in, access authorisation is stored with a cookie for no longer than 30 days (see “Cookies” section).
– – – – – – – – – –
4.9. Spare parts shop
4.9.1. General information
Existing customers can purchase spare parts on this page. Customer-, order- and item-specific data is stored.
4.9.2. Purposes of and legal basis for the processing of personal data
CLAGE uses this service to provide better customer service. This is a voluntary service provided to our customers.
The processing of personal data from the dialogue box serves solely the purpose of processing the establishment of contact. If the making of contact is directed at the initiation, fulfilment or termination of an agreement, the legal basis for processing is Art. 6 para. 1 p. 1 letter b GDPR.
4.9.3. Recipients or categories of recipients
The above data is forwarded exclusively to CLAGE.
4.9.4. Transmission of personal data to third countries
No data is transmitted to countries outside of the EU or the EEA (known as “third countries”).
4.9.5. Period of retention
The storage period for all archived documents complies at the least to the statutory periods pursuant to Sec. 257 HGB (German Commercial Code) and Sec. 147 AO (German Fiscal Code).
4.10. Online service report
4.10.1. General information
Service partners commissioned by CLAGE can document their assignments performed on behalf of CLAGE on this page. Order, location, appliance, material and billing data are stored.
4.10.2. Purposes of and legal basis for the processing of personal data
We offer this service to our service partners voluntarily. The processing of the personal data from the input mask serves to document your assignments in accordance with Art. 6 para. 1 p. 1 letter b GDPR.
4.10.3. Recipients or categories of recipients
The above data is forwarded exclusively to CLAGE.
4.10.4. Transmission of personal data to third countries
No data is transmitted to countries outside of the EU or the EEA (known as “third countries”).
4.10.5. Period of retention
The storage period for all archived documents complies at the least to the statutory periods pursuant to Sec. 257 HGB (German Commercial Code) and Sec. 147 AO (German Fiscal Code) or if you have your account deleted.
4.10.6. Right to deletion, objection and correction
You have the possibility at all times to delete your consent to processing of personal data effective for the future. For this purpose, write an e-mail to the following address: datenschutz@clage.de. All entries will be deleted in this case.
4.11. Facebook fan page
On our Facebook fan page https://de-de.facebook.com/clage.de/ we offer you further information about our services.
4.11.1 Type and scope of processing of personal data
We use the personal data that you transmit to the provider when using the fan page in order to analyse the use of our fan page and to tailor our offer to the target group. We use statistical reports such as the total number of page views, "Like" information, devices used, page activity, post interactions and reach, user activity (comments, shared content, responses), origin (country and city), language, shop views and clicks, age group, gender, educational level, occupation, relationship status, clicks on phone numbers or groups associated with our site. We use, for example, the age and gender distribution for a customized approach, attractive design and the preferred visiting times of the users for a time and content optimized planning of our contributions.
4.11.2 Purposes and legal basis for the processing of personal data
For the offered information service we operate together with Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland a joint responsibility according to art. 26 GDPR https://www.facebook.com/legal/terms/page. The legal basis for the processing is our legitimate interest pursuant to Art. 6 para. 1 p. 1 letter f GDPR to draw attention to our services and to be able to contact you.
4.11.3 Recipients or categories of recipients
Our fan page is a service of Meta Platforms, Inc. (1601 S. California Ave, Palo Alto, CA 94304, USA). The provider carries out the surveys and evaluations of personal data required for our statistics and thus has the possibility to establish a personal reference on the basis of this data. The provider is solely responsible for this further data processing.
4.11.4 Duration of Storage
We do not know how long the provider stores the above data.
4.11.5 Right to information, correction, objection and deletion
However, in accordance with the Terms of Use https://www.facebook.com/legal/terms/, which you agreed to when creating your user profile, we may identify the subscribers or users of our fan page and view your profile and other shared information from them and contact you. Because only the provider has full access to user information, we encourage you to contact the provider directly if you wish to exercise the rights set forth in point 5. You will find further information on this in the links to data processing at Seiten-Insights https://www.facebook.com/legal/terms/information and data protection at https://www.facebook.com/about/privacy.. The complete data guidelines of Facebook https://de-de.facebook.com/full give you an overview of the data processing carried out there.
Alternatively, we offer you support at the address mentioned in point 3 to assert your rights against the provider.
4.12. Voice Command with Third-Party Help
4.12.1. General information
We offer you the possibility to control our products with the voice control Alexa from Amazon or Google Assistant. This requires that you register with us in the CLAGE cloud to establish a connection between your Alexa or Google device and the CLAGE product.
When you register, your email address, username and password will be processed. You must verify your registration by confirming your e-mail address. The registration process will result in the processing of the IP address of your terminal and the corresponding time data.
4.12.2 Purposes and legal basis for processing personal data
The processing of personal data is carried out to initiate, execute or terminate a contract pursuant to Art. 6 para. 1 p. 1 letter b GDPR. Our service providers are included on the basis of our legitimate interest in the secure and efficient provision of our services pursuant to Art. 6 para. 1 p. 1 letter f GDPR in conjunction with Art. 28 GDPR (order processing).
4.12.3 Recipients or categories of recipients
The above-mentioned data will only be passed on to authorised employees and other service providers such as Amazon EU SARL, 5 Rue Plaetis, 2338 Luxembourg (hereinafter referred to as Amazon) or Google Ireland Limited, Gordon House, Barrow Street, Dublin 4 (hereinafter referred to as Google) in order to establish the connection between the devices and contract processors as part of support and maintenance activities.
4.12.4 Transfer of Personal Data to Third Countries and Appropriate Guarantees
Your registration data will be processed in a computer center in Germany at Amazon. Since it cannot be ruled out that the US parent organisation may also access this data, an agreement has been concluded in accordance with Art. 46 Para. 2 letter d GDPR in order to ensure adequate protection of your data.
4.12.5 Duration of storage
Personal data will be stored in the CLAGE Cloud for as long as you use the Service. The data will not be deleted automatically. For information on how to delete your data, see section 4.13.6.
4.12.6 Right to deletion and correction
You have the possibility to have your personal data corrected or deleted at any time. All you need to do is send an e-mail to the contact details mentioned in point 3 using the e-mail address used during registration.
4.12.7 Other information
For the connection with our devices the creation of a user account in the CLAGE Cloud is necessary. During use, the user ID and the device ID are transferred to Amazon in encrypted form for verification.
The customer's usage data is stored at Amazon. CLAGE does not have access to it itself. The terms of use that you have agreed to with Amazon within the scope of the services apply. Further information on Amazon can be found in the Privacy Policy and in the help section "Alexa, Echo devices and your privacy".
4.13. E-mail newsletter
If you would like to receive the newsletter offered on the website, we require an e-mail address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter.
4.13.1 Type and scope of the processing of personal data
We use the so-called double opt-in procedure to ensure that the newsletter is sent with your consent. In the course of this, the potential recipient allows himself to be included in a distribution list. Subsequently, the user is given the opportunity to confirm the registration in a legally secure manner by means of a confirmation e-mail. Only if the confirmation is received is the address actively included in the distribution list. We log whether and, if so, which topics are of particular interest to you. This enables us to delete newsletter recipients who are no longer interested and to make our contributions more attractive.
4.13.2 Purposes and legal basis of the processing of personal data
We use this data exclusively for sending the requested information and offers.
The consent granted pursuant to Art. 6 para. 1 p. 1 letter a GDPR in conjunction with. Art. 7 GDPR for the storage of the data, the e-mail address and their use for sending the newsletter can be revoked at any time, for example via the "unsubscribe" link in the e-mail newsletter.
The data protection measures are always subject to technical updates, for this reason we ask you to inform yourself about our data protection measures at regular intervals by consulting our information on data protection.
4.13.3 Recipients or categories of recipients
The processing of your data is carried out by internal authorised employees and appointed processors in accordance with Art. 28 GDPR. The company Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin is used as a processor. Sendinblue is prohibited from selling your data and processing it for purposes other than sending newsletters. Sendinblue is a German, certified provider, which has been selected in accordance with the requirements of the General Data Protection Regulation and the Federal Data Protection Act.
4.13.4 Transfer of personal data to third countries
Personal data is not transferred to third countries.
4.13.5 Duration of storage
Your data will be stored as long as the e-mail newsletter is offered, your e-mail address exists or you have not revoked your consent. If you do not confirm the registration link during registration, your data will be deleted after 7 days.
4.13.5 Right to deletion and revocation
You can revoke your consent at any time and free of charge. To do so, use the "unsubscribe" link in the e-mail newsletter.
4.13.6 Further information
You can find more information here: https://de.sendinblue.com/informationen-newsletter-empfaenger/?rtype=n2go
4.14. Live seminars and trainings
Not yet available for English-speaking customers.
4.15. Raffles
Not yet available for English-speaking customers.
4.16. Online shop
4.16.1 General
In order to be able to buy products in our online shop, you can order as a guest or create a user account for regular orders. During the ordering process, you will be provided with the required mandatory data. The following personal data will be processed by you:
– Personal master data, such as title, first name and surname.
– When creating a user account: Login data, such as e-mail address as user name and password.
– Communication data, such as telephone number or e-mail address
– Company data, such as company, department and VAT ID
– Address data, such as street, house number, additions, postcode, city and country
– Order data, such as time stamp, products, prices, payment method, delivery method and discount code
– Transaction data, such as time stamp, order transaction, correspondence or notes
– Log data, such as IP address, device information, timestamp of system usage and type of usage, email address confirmation
4.16.2 Purposes and legal basis for processing personal data
We process your data insofar as this is necessary for the execution and processing of the order. The legal basis for this is Art. 6 para. 1 p. 1 letter b GDPR. This includes in particular
– the ordering process as a guest or registered user
– the receipt, administration and answering of customer service enquiries
– the delivery of goods via transport service providers
– the processing of complaints
– the execution of the payment or refund of the goods
– the writing and sending of invoices
For the storage of the products or the execution of the payment, information is stored in a cookie on your end device. The legal basis for the storage of the data is §25 Para. 2 S. 2 of the law for the regulation of data protection and privacy in telecommunications and telemedia (TTDSG).
In addition, your order data is used to fulfil legal obligations pursuant to Art. 6 para. 1 p. 1 letter c GDPR in conjunction with. §257 German Commercial Code or §147 German Fiscal Code.
Your data will also be processed if this is necessary for the
– proper execution of the order,
– for the defence, execution or assertion of legal claims or
– for the security of data processing, e.g. to protect against misuse and other unauthorised use.
is necessary. Your personal data will then be processed in accordance with the legitimate interest of us or third parties pursuant to Art. 6 para. 1 p. 1 letter f GDPR.
Data processing for other purposes can only be considered if the legal requirements pursuant to Art. 6 (4) GDPR are met. In this case, we will observe any information obligations pursuant to Art. 13 (3) GDPR.
4.16.3 Recipients or categories of recipients
Your data will be processed by our internal employees for the purpose of processing the purchase contract. Other recipients are IT service providers used for operational purposes and logistics companies responsible for the delivery of goods. We use the services of banks and payment service providers to process payment transactions. Your data will be passed on to legal consultancies on an ad hoc basis if this is necessary for the defence, implementation and assertion of legal claims by us or third parties.
4.16.4 Transfer of personal data to third countries
As a matter of principle, we do not transfer any personal data to third countries. In the context of payment, depending on the selected payment method, your personal data may be transmitted to third countries. Please note the data protection information of the respective payment provider.
4.16.5 Duration of storage
If you have created an account (MyCLAGE) in our online shop, we process your data so that you can place future orders more quickly, adjust master data and view orders and invoices at any time.
You can have your account deleted at any time. Please contact us in this case. For security reasons, your user account will be automatically deactivated after five years and deleted after a total of six years if you have not placed an order during this period.
If you order from us as a guest, your data will not be stored in the online shop.
The order and invoice data are processed in our commercial IT systems for 10 years for tax reasons. Your data will be deleted if there are no legitimate interests, such as defence, implementation or assertion of legal claims by us or third parties.
4.16.6 Information on external payment service providers
As part of the ordering process, we offer you efficient and secure payment options and, in addition to our own banks and credit institutions, use other external service providers, such as PayPal ("payment service providers").
The data processed by the payment service providers usually includes personal data, such as the name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums as well as the contract, total and recipient-related details. The information is required to carry out the transactions.
However, the data entered is only processed by the payment service providers and stored with them.
We do not receive any account or credit card-related information, but only information for the execution of the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit agencies for the purpose of checking identity and creditworthiness.
In this regard, we refer to the General Terms and Conditions and the data protection information of the payment service providers. You can assert your rights pursuant to Art. 15ff GDPR against the following payment service providers.
PayPal:
Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
Products: Services of the provider (PayPal)
Website: https://www.paypal.com/de
Data protection: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
4.17. Information for customers and business partners
4.17.1 General
We process personal data that we have received from you or your employer in the course of our business relationship. In addition, where necessary for the provision of our services, we process personal data that we have received from other companies or from other third parties in a permissible manner (e.g. for the execution of orders, for the performance of contracts or on the basis of consent given by you). Within the framework of the legal requirements, we may process data that you have made public.
We mainly process the following personal data in the course of initiating, executing and terminating contractual relationships with customers and business partners:
– Personal master data, such as title, first name, surname, title, function.
– Company data, e.g. company, dealer number, business address
– Communication data, e.g. e-mail address, fax and telephone number
– Order data, e.g. offers, contracts or payment and booking data and the corresponding correspondence
– Log and metadata from other postal, electronic or telephone communications.
4.17.2 Purposes and legal basis for processing personal data
We process your personal data in accordance with the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other sector-specific laws. The data processing is carried out for the purpose of initiating, implementing or terminating the contractual relationship pursuant to Art. 6 para. 1 p. 1 letter b) GDPR.
In addition, we process your data to protect our legitimate interests or those of a third party in accordance with Art. 6 para. 1 p. 1 letter f GDPR, e.g.
– Ensuring effective work force allocation, testing and optimisation of demand analysis procedures for the purpose of direct customer contact
– Assertion of legal claims and defence in legal disputes
– Ensuring IT security and operations
– Prevention and investigation of criminal offences
– Measures for building and facility security (e.g. access controls or video surveillance)
– Direct marketing measures, e.g. information to existing customers and business partners within the framework of §7 UWG (Unfair Competition Act)
– Business management and development measures
– Risk management within the company
Insofar as you have given us your consent pursuant to Art. 6 para. 1 p. 1 letter a in connection with Art. 7 GDPR for the processing of your personal data, we will not be held liable. Art. 7 GDPR for the processing of personal data for specific purposes, the lawfulness of this processing is given on the basis of your consent. Consent given can be revoked at any time. Please note that the revocation only takes effect for the future. Processing that took place before the revocation is not affected by this.
In addition, as a company we are subject to legal obligations pursuant to Art. 6 para. 1 p. 1 letter c GDPR, such as the German Commercial Code or the German Fiscal Code. The purposes of the processing include, among others, measures for the fulfilment of control and reporting obligations under tax law as well as the assessment and management of risks.
Insofar as legal bases are mentioned in this information, these are authoritative for the processing of personal data in their respective version. Automatic profiling or automated decision-making is not planned and does not take place.
4.17.3 Recipients or categories of recipients
Your personal data will only be processed by us within the company so that the initiation, implementation and termination of the contractual relationship can take place. For this purpose, the necessary departments, such as purchasing, sales, export, shipping, financial accounting, customer service, workshop, supplier management, facility management or management are involved as required. In addition, the data may be passed on within the company if there is a legitimate interest on our part, such as marketing for direct marketing purposes or the IT department within the scope of maintenance and support activities.
Furthermore, order processors pursuant to Art. 28 GDPR are used who are responsible for the operation and maintenance of our network, the devices and applications used. Within the scope of the above-mentioned services for our customers and business partners, data is transmitted exclusively in accordance with the instructions of the respective person responsible.
In addition, personal data may be forwarded to third parties on an ad hoc basis, such as translation agencies, banks, customs, auditors, credit agencies, tax offices and insurance companies. If goods or documents have to be transported, your data will be passed on to transport service providers.
Information may only be passed on if
– legal regulations require this,
– you have given your consent,
– this is necessary for the fulfilment of the contract,
– order processors commissioned by us guarantee compliance with the requirements of the GDPR in the same way, or
– our legitimate interest, e.g. for the defence or implementation of legal claims by us or third parties, outweighs your interests, rights and freedoms. In this case, the transfer to legal advisors, debt collection or law enforcement agencies would regularly be lawful.
4.17.4 Transfer of personal data to third countries
Data is generally processed in data centres in the EU. If data is processed outside the EU, this will only be done if the third country has been confirmed by the EU Commission to have an adequate level of data protection or if other adequate data protection guarantees (in particular EU standard contractual clauses or binding internal company data protection regulations) are in place.
4.17.5 Duration of storage
To the extent necessary, we process your personal data for the duration of the business relationship. In addition, we are subject to various storage and documentation obligations resulting from the German Commercial Code (HGB) and the German Fiscal Code (AO), among others. The retention and documentation periods specified there are two to ten years. The storage period also depends on the statutory limitation periods, which can be up to thirty years, for example, according to §§ 195 ff. of the German Civil Code (BGB), whereby the regular limitation period is three years.
As soon as the storage of the data is no longer necessary for the performance of the contractual relationship and there are no statutory retention periods or a justified interest on our part or on the part of third parties, your data will be deleted immediately. A legitimate interest may exist if the personal data is required for the assertion, exercise or defence of legal claims. Storage may also take place if this is provided for or prescribed by the European or national legislator in Union regulations, laws or other provisions to which we are subject.
5. Data subject rights
Insofar as your personal data is processed on the occasion of your visit to the website and when using the services, you are entitled to the following rights, which you can assert at the above-mentioned offices, if the legal requirements within the meaning of the GDPR are met:
– Art. 15 GDPR: Right to information of the person concerned
You have the right to obtain information about which personal data the responsible person processes to your person.
– Art. 16 GDPR: Right of rectification
If your personal data is not correct or incomplete, you may request the correction of incorrect information or the completion of incomplete information.
– Art. 17 GDPR: Right to deletion
Under the conditions of Art. 17 GDPR, you may request the deletion of your personal data. Your right to deletion depends, among other things, on whether your personal data is still required by the person responsible for fulfilling his statutory duties or whether the person responsible or third parties can prove a predominant legitimate interest, such as the defence or assertion of legal claims.
– Art. 18 GDPR: Right to limitation of processing
You can request the restriction of the processing of your personal data. The right to limit the processing exists in the following cases:
– If you dispute the accuracy of your personal data stored with the responsible person, the responsible person usually needs time to check this. For the duration of the verification, you have the right to request that the processing of your personal data be restricted.
– If the processing of your personal data has taken place unlawfully, you may request that the data processing be restricted instead of deleted.
– If the controller no longer needs your personal data, but you need it for the exercise, defence or assertion of legal claims, you have the right to demand the restriction of the processing of your personal data instead of deletion.
– If you have lodged an objection pursuant to Art. 21 para. 1 GDPR, a balance must be struck between your interests and those of the person responsible or third parties. As long as it is not yet clear whose interests predominate, you have the right to demand that the processing of your personal data be restricted.
– If you have restricted the processing of your personal data, such data - apart from its storage - may only be processed with your consent or for the purpose of asserting, exercising or defending legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a Member State.
– Art. 20 GDPR: Right to data transferability
You have the right to have data processed automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another responsible person, this will only be done as far as it is technically feasible.
– Art. 21 GDPR: Right of objection
If data processing is carried out on the basis of Art. 6 para. 1 p. 1 letter e (necessary processing carried out in the public interest or in the exercise of official authority) or letter f (legitimate interest) GDPR, you have the right at any time to object to the processing of your personal data for reasons arising from your particular situation; this also applies to profiling based on these provisions. The respective legal basis on which a processing is based can be found in this data protection declaration. If you file an objection, the data controller will no longer process your personal data unless he can prove compelling reasons worthy of protection for the processing which outweigh your interests, rights and freedoms or the processing serves the assertion, exercise or defence of legal claims. If your personal data are processed for the purpose of direct advertising, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling, insofar as it is connected with such direct advertising. If you object, your personal data will no longer be used for direct marketing purposes.
– Art. 7 para. 3 GDPR: Right to revoke consent
You have the right to revoke your consent to the processing of your personal data at any time with effect for the future. The revocation of your consent does not affect the legality of the processing, which took place on the basis of your consent up to the time of revocation.
6. Right to complain to the supervisory authority
You have the right to file a complaint to the following supervisory authority if you are of the opinion that our processing of your personal data is in breach of current data protection legislation: Data Protection Officer for the State of Lower Saxony, Prinzenstraße 5, 30159 Hanover.
7. Links to other internet sites
Our website contains links to other internet sites. We have no influence on whether the operators of such sites comply with the provisions of data protection. Despite careful checks of the content carried out beforehand, we cannot assume any liability for external links to third-party content.
8. Security of processing
For reasons of security and to protect the transfer of confidential content, such as the inquiries you send us as website operator, this site uses SSL encryption. You can recognise an encrypted connection by the change in the address line of the browser from http:// to https:// and the lock symbol on your browser line.
9. Validity and updating of the data protection statement
The ongoing development of our website or the implementation of new technologies may make it necessary to amend this information effective for the future. We recommend that you always refer to the current version.
– – –
15.06.2023
