Privacy Policy in accordance with the GDPR

Data Protection

This privacy policy explains what personal data we process in connection with our online services, the purposes for which this is done, and the rights you are entitled to under data protection law. We also explain the legal basis on which the respective processing takes place, how long personal data is stored and – where relevant – to which recipients data is transferred.

Privacy settings

You may amend or withdraw your consent at any time. To do so, you can use our consent management tool, Cookiebot, which you can access via the corresponding icon at the bottom left of every page.

1. General information

1.1. Name and contact details of the data controller

CEMO GmbH, In den Backenländern 5, 71384 Weinstadt, is the data controller within the meaning of the GDPR as the operator of the website https://www.cemo.de.
You may contact our Data Protection Officer at any time with any data protection-related enquiries at datenschutz@cemo-group.com.

1.2. General information on data processing

1.2.1. What is personal data?

Personal data is any information relating to an identified or identifiable natural person. This includes, for example, name, contact details, location data, IP addresses or online identifiers. Information that can be indirectly attributed to a person may also constitute personal data.

1.2.2. Purposes of data processing

We process personal data for various purposes arising from the specific context of processing. These include, in particular, the provision and secure operation of our website, the handling of enquiries and – where relevant – the implementation of pre-contractual and contractual measures and the fulfilment of legal obligations. Processing may also take place on the basis of your consent or to safeguard our legitimate interests, provided that the relevant legal requirements are met. We explain the specific purposes and legal bases for each instance of processing in the following sections.

1.2.3. Legal basis for data processing

Depending on the specific purpose of the processing and the particular circumstances, various legal bases under the GDPR may apply to the processing of personal data. We process your personal data on the following legal bases:

on the basis of your consent according to Article 6(1)(a) of the GDPR
to take steps prior to entering into a contract or to fulfil contractual obligations according to Article 6(1)(b) of the GDPR
to comply with legal obligations according to Article 6(1)(c) of the GDPR
to safeguard our legitimate interests or the legitimate interests of a third party according to Article 6(1)(f) of the GDPR

We will inform you of the specific legal bases for data processing in the description of the respective processing operations.

1.3. Disclosure of personal data

In the course of our processing of personal data, it may be necessary to transfer such data to other bodies, organisations or individuals, or to disclose it to them.

Recipients may include, in particular, service providers commissioned by us, for example in the fields of hosting, IT, logistics or payment processing. Data may also be disclosed to other recipients if this is necessary for the performance of a contract, if we are legally obliged to do so, or if another legal basis permits such disclosure. Where we engage service providers in the context of data processing on our behalf, their involvement is based on a contract according to Article 28 of the GDPR. We explain the specific recipients and purposes of the data transfer, where necessary, in the description of the respective processing operation.

1.4. Data transfers to third countries

The transfer of personal data to third countries, i.e. to countries outside the European Union (EU) or the European Economic Area (EEA), takes place only insofar as this is necessary for the performance of a contract or a business relationship, including the initiation thereof; is permitted on the basis of our legitimate interests or your consent; or where there is another legal basis for doing so. In doing so, we comply with the applicable data protection requirements according to Articles 44 et seq. of the GDPR.

In particular, a transfer may take place if an adequacy decision by the European Commission exists for the third country in question or if specifically designed safeguards according to Article 46 of the GDPR are in place. In certain exceptional cases provided for by law, a transfer may also take place on the basis of Article 49 of the GDPR.

Where personal data is transferred to the USA, the transfer may, in particular, be based on the EU-US Data Privacy Framework (‘DPF’), provided that the relevant recipient is certified under the DPF. Otherwise, specifically designed safeguards pursuant to Article 46 of the GDPR may be considered. You can find the list of certified organisations on the US Department of Commerce’s website at https://www.dataprivacyframework.gov (in English).

For each individual service, we will inform you whether personal data is transferred to third countries and on what basis the respective transfer takes place.

Further information on international data transfers and existing adequacy decisions can be found on the European Commission’s website at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

1.5. Retention period and deletion of your data

Unless otherwise specified in this privacy policy, we store personal data only for as long as is necessary for the respective purpose of processing. Once the purpose of processing no longer applies, personal data will generally be deleted, provided there is no statutory retention obligation or any other reason for further storage.

Longer retention may be necessary, in particular, where statutory retention obligations apply or where the data is required to establish, exercise or defend legal claims. In such cases, the data will be deleted as soon as the relevant reason for retention no longer applies.

Where personal data must be stored for a longer period due to statutory retention obligations or to safeguard legal claims, it will, as a general rule, only be processed for the purposes relevant to this.

1.6 Right to object

If we process your personal data on the basis of Article 6(1)(f) of the GDPR to safeguard legitimate interests, you have the right to object to this processing at any time on grounds relating to your particular situation.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

2. When you visit our website

2.1. Provision and use of our website

When you access our website, our web server automatically processes certain information that your browser transmits to our server. This includes, in particular:

the IP address of the requesting device,
Date and time of access,
the internet address (URL) accessed, together with the HTTP method and protocol version
the HTTP status code of the request
the amount of data transferred,
previously visited website, if transmitted (referrer),
User-Agent (information about the browser used for the site),
other technically necessary information processed for the purpose of providing the website and ensuring IT security.

This data is stored in server log files.

This data is processed in order to technically enable you to access our website, to ensure the stability and security of our systems, to detect and rectify errors, and to detect and ward off attacks on our IT systems.

The legal basis for the processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure, sturdy and functional provision of our online services.

The server log files are stored only for as long as is necessary for the purposes stated, provided that no statutory retention obligations preclude this.

2.2. Hosting and technical infrastructure

Hosting

Our website is hosted by Travix Media GmbH, Alte Poststr. 4, 70173 Stuttgart, as part of a data processing arrangement in accordance with Article 28 of the GDPR. The use of the hosting provider serves the technical provision of our website as well as the infrastructure and system environment required for this purpose. Our hosting provider processes personal data exclusively for the purpose of providing hosting services and in accordance with our instructions. This processing includes, in particular, the technical data generated during the use of our website (see also section 2.1).

The legal basis for the use of the hosting provider is the protection of our legitimate interests, according to Article 6(1)(f) of the GDPR, in the secure and reliable operation of our website and in the efficient management of the technical infrastructure required for this purpose.

Use of Cloudflare as a security service and content delivery network

To improve the security, stability and performance of our website, we use the Content Delivery Network (CDN) provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare is used as a data processor according to Article 28 of the GDPR.

Cloudflare supports the secure, sturdy and high-performance delivery of our website. Its use serves, in particular, to protect against unauthorised access and attacks, to ensure availability and to optimise website performance. To this end, requests are processed technically and content is delivered via the CDN. In particular, IP addresses and technical information relating to the browser, device and connection used may be processed.
In the course of using Cloudflare, personal data may be processed in the USA or other third countries. Cloudflare is certified under the EU-US Data Privacy Framework (DPF). The transfer of personal data to the USA may therefore be based on the European Commission’s adequacy decision according to Article 45 of the GDPR. Cloudflare also uses standard contractual clauses for international transfers, including supplementary measures where necessary.
The legal basis for the processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure, reliable and high-performance provision of our website, as well as in the protection of our technical infrastructure against unauthorised access and attacks.

Further information on data processing by Cloudflare can be found at: https://www.cloudflare.com/privacypolicy/.

2.3. Security of processing

We take appropriate technical and organisational measures to protect your personal data against loss, destruction, unauthorised alteration and unauthorised access. Our website uses an encrypted HTTPS connection to protect the transmission of personal data. This also applies to personal data that you submit via our forms. Our security measures are regularly reviewed and adapted to take account of technical developments and existing risks.

3. When you contact us

3.1. Contact form

You can contact us via a contact form on our website. We generally process the personal data you submit via the contact form in order to handle and respond to your enquiry. In addition, when you use the contact form, the technical access data described in section 2.1 is processed.

The legal basis for the processing is Article 6(1)(b) of the GDPR, provided that your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is carried out on the basis of our legitimate interest in the effective processing and response to incoming enquiries according to Article 6(1)(f) of the GDPR.

Personal data will be erased as soon as it is no longer required for the processing of your enquiry, provided there are no statutory retention obligations or other reasons for longer-term storage.

3.2. Contact by email

You can contact us via the email address provided on our website. Please note that emails on the internet are generally not consistently end-to-end encrypted. Although emails are generally transmitted in encrypted form whilst in transit, end-to-end encryption is not usually in place. It cannot therefore be ruled out that unauthorised third parties may gain knowledge of the content of an email or alter the transmitted data without authorisation.

We process the personal data you provide via email solely for the purpose of handling and responding to your enquiry.

The personal data will be deleted as soon as it is no longer required for the processing of your enquiry, provided there are no statutory retention obligations or other reasons for longer-term storage.

3.3. Kesselbot.de chatbot

On our website, we use Kesselbot.de, an AI-powered chatbot service provided by Travix Media GmbH, Alte Poststr. 4, 70173 Stuttgart (“Travix”). We have entered into a data processing agreement with Travix in accordance with Article 28 of the GDPR. We use
Kesselbot.de to offer you a quick way to get in touch and to automatically answer frequently asked questions. Data processing is carried out to respond to your enquiries, to improve our customer service and to optimise the chatbot system technically. Your chat inputs are not used to train AI models.
The following personal data is processed:

Your IP address (not stored)
Your chat messages (text inputs)
Date and time of use
Technical metadata (browser type, device type)
A randomly generated session ID to identify the conversation

In addition, cookies are also stored in your browser, for example to retain the chat history during your visit or to store your consent.

The data is transmitted to the Travix server and processed there to generate a response. To process the chat inputs, Travix in turn uses Microsoft Azure OpenAI, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, as a sub-processor. It cannot be ruled out that your personal data may also be transferred to Microsoft Corporation, which is based in the USA. Microsoft is certified under the EU-US Data Privacy Framework (DPF). The transfer of personal data to the USA may therefore be based on the European Commission’s adequacy decision according to Article 45 of the GDPR.

The legal basis for the processing is your consent according to Article 6(1)(a) of the GDPR. You may withdraw the consent you have given us to process your personal data at any time. The lawfulness of any data processing that has already taken place remains unaffected by the withdrawal. Please note that from the time of withdrawal, the chatbot functions can no longer be used.

Further information on data processing can be found at:

Travix: https://www.travix-media.de/datenschutz

Microsoft: https://azure.microsoft.com/de-de/products/ai-foundry/models/openai/ and https://www.microsoft.com/de-de/privacy/privacystatement

Your personal data will be deleted as soon as it is no longer required for the respective processing purposes, provided that there are no statutory retention obligations or other legal grounds preventing further storage. In this case, the legal basis is Article 6(1)(c) of the GDPR.

4. External services and cookies

4.1. General

We use services from external providers, as well as cookies and similar technologies, on our website. These technologies serve various purposes – such as the technical provision of the website, improving user-friendliness, analysing visitor behaviour or integrating external content (e.g. maps, videos or fonts).

Cookies are small text files that are stored on your computer or device when you visit our website. Similar technologies include, in particular, so-called web storage techniques, whereby information is stored locally in the browser. For the sake of clarity, we will hereinafter refer to cookies and similar technologies collectively as ‘cookies’.

We use services provided by external providers as well as cookies in accordance with legal requirements. Where consent is required for this, we will obtain it before commencing the relevant processing.

Where you give your consent, the legal basis for the processing of your personal data is your consent according to Article 6(1)(a) of the GDPR.

In particular, consent is not required if the storage of information on your device or access to information already stored is strictly necessary to provide you with a digital service that you have expressly requested. Where personal data is processed in this context, the processing is carried out on the relevant legal basis in each case. This may, in particular, be the fulfilment of our contractual obligations under Article 6(1)(b) of the GDPR, the fulfilment of legal obligations under Article 6(1)(c) of the GDPR, or our legitimate interest under Article 6(1)(f) of the GDPR, such as ensuring the secure and functional operation of our online service and improving its usability.

You can adjust your cookie settings at any time via our cookie tool and withdraw any consent you have given with effect for the future. You can access the cookie tool again via the icon at the bottom left of each page. There you will also find further information on the external services used and the cookies employed in each case, including their purposes.

Furthermore, you can perform a manual deletion of already stored cookies at any time via your browser’s settings, or configure your browser to restrict or completely prevent the storage of cookies. You can find information on this in your browser’s help function. Please note that disabling or deleting cookies may result in certain functions of our website being unavailable or only partially available.

4.2. Consent management with Cookiebot

We use the ‘Cookiebot’ cookie consent tool provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, on our website within the framework of data processing on our behalf. The purpose of the processing is to obtain and document consent for the storage of certain cookies on your device or for the use of certain technologies, as well as to technically enable the withdrawal of consent that has been given. When you visit our website, the following personal data is transferred to Usercentrics:

Your IP address
Your consent(s) or the withdrawal of your consent(s)
Date and time of consent
Information about your browser
Information about your device
an anonymous, random and encrypted key value

Furthermore, Cookiebot stores a cookie in your browser to enable it to associate the consents you have given, or their withdrawal, with you.

The legal basis for the processing of the data is the fulfilment of a legal obligation according to Article 6(1)(c) of the GDPR. Insofar as Section 25 of the TDDDG applies to the storage of information on your device or access to information already stored, this is carried out on the basis of Section 25(2)(2) of the TDDDG.

The data collected in this way is stored for as long as is necessary for the documentation and administration of your consent. You may withdraw your consent at any time and delete the stored cookie via your browser settings. Mandatory statutory retention obligations remain unaffected.

Further information can be found in Usercentrics’ privacy policy at: https://www.cookiebot.com/de/privacy-policy/.

4.3. Web analytics with Google Analytics

On our website, we use the Google Analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’), for the statistical analysis of website usage and user interactions. This enables us, in particular, to analyse page views, interactions and the use of our website, and to optimise our online offering. In doing so, the following personal data may be processed in particular:

Usage data (e.g. page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and functions)
Meta, communication and procedural data (e.g. timestamps, identification numbers and technical information)
Online identifiers (e.g. cookie IDs and device identifiers)
Location data (e.g. region or city, derived from the IP address)

Google Analytics also uses cookies for this purpose.

When collecting data from users in the EU, Switzerland and the United Kingdom, IP addresses are not logged or stored in Google Analytics. The IP address is used to derive location data and is subsequently discarded. Google states that the processing of the IP address for the purpose of determining location takes place before the data traffic is forwarded to Analytics servers outside the EU, Switzerland or the United Kingdom.

The transfer of personal data to the USA cannot be ruled out when using Google services. Google LLC is certified under the EU-US Data Privacy Framework (DPF). Where personal data is transferred to the USA, this may be based according to the European Commission’s adequacy decision pursuant to Article 45 of the GDPR.

The legal basis for the use of this service is your consent in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG. You may withdraw your consent at any time with future effect via our cookie tool by unticking the box for this service. You can access our cookie tool by clicking on the icon at the bottom left of every page.

Further information on terms of use and data protection can be found at: https://policies.google.com/privacy.

4.4. Google Tag Manager

We use the ‘Google Tag Manager’ service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’) on our website.

Google Tag Manager is used to manage and trigger website tags. These are code elements that allow additional services and functions, such as Google Analytics, to be integrated into our website. Google Tag Manager itself is used in particular for the technical management and control of these tags. The data processing triggered by individual tags is carried out by the respective integrated services. We provide information about these services and the associated data processing in this privacy policy under the relevant service.

It cannot be ruled out that your personal data may also be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework (DPF). The transfer of personal data to the USA may therefore be based on the European Commission’s adequacy decision according to Article 45 of the GDPR.

The legal basis for the use of this service is your consent pursuant to Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG. You may withdraw the consent you have given at any time with future effect via our cookie tool by unticking the box for this service. You can access our cookie tool by clicking on the icon at the bottom left of every page.

Further information on terms of use and data protection can be found at: https://policies.google.com/privacy.

4.5. Google Fonts

On our website, we use fonts from the ‘Google Fonts’ library. The fonts used are embedded locally on our server. When you use the website, therefore, no connection is established with Google’s servers and no data is transmitted to Google.

5. When you use our online services

5.1. User account

Business customers can create a user account within our online service, for example to request quotes, manage orders, report complaints, save favourites and view retailer-specific prices.
As part of the registration process, we process the following personal data in particular:

First name and surname
Email address
Password
Company name and business address
Customer number (if applicable)

As part of the registration, login and use of the user account, we also process technical and usage-related data, in particular:

IP address
Date and time of the respective user action
Order history
Saved favourites

The data is processed for the purpose of setting up and managing the user account and providing the associated functions.
The legal basis for this is Article 6(1)(b) of the GDPR, insofar as the processing is necessary for the performance of the contract or pre-contractual measures. Furthermore, processing may take place on the basis of Article 6(1)(f) of the GDPR, insofar as it is necessary to safeguard our legitimate interests. This applies in particular to processing operations that serve to ensure security, prevent misuse and ensure the proper and secure operation of our online service.
Personal data will be erased as soon as it is no longer required for the use of the user account, provided there are no statutory retention obligations or other reasons for longer-term storage.

5.2. Order placement, conclusion of contract and order processing

Orders can be placed once a user account has been set up. When an order is placed, we process the data required to handle and fulfil the order. This includes, in particular, contact, delivery and billing details, company information, and the goods ordered and order items.

The processing is carried out for the purpose of handling the order, performing and fulfilling the contract, and meeting the obligations arising therefrom.

The legal basis for this is Article 6(1)(b) of the GDPR, insofar as the processing is necessary for the performance of the contract. Where the processing is necessary to comply with a legal obligation to which we are subject, it is carried out on the basis of Article 6(1)(c) of the GDPR. Furthermore, processing may take place on the basis of Article 6(1)(f) of the GDPR, insofar as it is necessary to safeguard our legitimate interests. This applies in particular to processing operations that serve to ensure security, prevent misuse and ensure the proper and secure operation of our online service.

Personal data will be erased as soon as it is no longer required for the use of the user account, provided there are no statutory retention obligations or other reasons for longer-term storage.

5.3. Payment processing

We use the payment service provider Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands (‘Mollie’) to process payments.
Depending on the payment method you have chosen, the personal data required for payment processing will be transferred to Mollie and, where applicable, to other payment service providers, banks or financial institutions involved in the payment process. This may include, in particular, your name, email address, billing and payment details, as well as information relating to your order.
We offer the following payment methods:

PayPal

Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg

Wero

Provider: EPI Company SE, Lignestraat 13, 1000 Brussels, Belgium

SEPA Direct Debit

Provider: relevant payment service provider/bank

Further information on data processing by Mollie can be found in Mollie’s privacy policy at https://www.mollie.com/de/legal/privacy.
The processing is carried out to facilitate the payment method you have selected and to execute and fulfil the contract closed with you. The legal basis is Article 6(1)(b) of the GDPR, insofar as the processing is necessary for the performance of the contract. Insofar as the processing is necessary to comply with a legal obligation, it is carried out on the basis of Article 6(1)(c) of the GDPR.

Furthermore, processing may be carried out on the basis of Article 6(1)(f) of the GDPR, insofar as it is necessary to safeguard our legitimate interests. This applies in particular to processing operations that serve to ensure security, prevent misuse and ensure the proper and secure operation of our online service.

Personal data will be erased as soon as it is no longer required for the use of the user account, provided there are no statutory retention obligations or other reasons for longer-term storage.

5.4. Dispatch and delivery

To process and fulfil orders, we process the data required for delivery, in particular the name and delivery address as well as details of the order.

Where necessary for delivery, we transfer the required data to shipping and logistics service providers commissioned by us.

The legal basis is Article 6(1)(b) of the GDPR, insofar as the processing is necessary for the performance of the contract. Where the processing is necessary to comply with a legal obligation to which we are subject, it is carried out on the basis of Article 6(1)(c) of the GDPR.

Personal data will be erased as soon as it is no longer required for the use of the user account, provided there are no statutory retention obligations or other reasons for longer-term storage.

5.5. Customer service and complaints

When handling complaints, we process the information you provide for this purpose, as well as any files provided via an upload function and the personal data contained therein. The processing is carried out for the purpose of examining and handling the complaint, as well as for the performance of the contract and to safeguard our resulting rights and obligations.

The legal basis is Article 6(1)(b) of the GDPR, insofar as the processing is necessary in connection with the contract. Where the processing is necessary to comply with a legal obligation to which we are subject, it is carried out on the basis of Article 6(1)(c) of the GDPR.

Personal data will be erased as soon as it is no longer required for the use of the user account, provided there are no statutory retention obligations or other reasons for longer-term storage.

6. Newsletter

You can subscribe to our newsletter via our website. Subscription details are stored exclusively in our own system and used from there to send out the newsletter. We do not use any external service providers.

When you subscribe to our newsletter, the following personal data is currently collected: title, company name, first name, email address and country. After submitting the form, you will receive a confirmation email (double opt-in). Your email address will only be added to our newsletter mailing list once you have confirmed your subscription.

The legal
basis for the processing of this data is Article 6(1)(a) of the GDPR. You may withdraw this consent at any time with future effect by unsubscribing from the newsletter; we provide a link for this purpose in every newsletter message. The lawfulness of any data processing operations that have already taken place remains unaffected by the withdrawal of consent.

To log the registration process, the date and time of registration, confirmation and, where applicable, unsubscription are stored. This data is processed in order to provide evidence of the proper granting, continued validity or withdrawal of consent, and to be able to trace unauthorised registrations or unauthorised use of the newsletter function. The IP address or browser identifier is not recorded or stored as part of the newsletter registration process.

The legal
basis for the processing of this data is Article 6(1)(f) of the GDPR. Our legitimate interest lies in being able to provide evidence of the proper granting and withdrawal of consent, as well as in safeguarding our rights in connection with the distribution of the newsletter.

No analysis of your behaviour in connection with the newsletter takes place. In particular, no tracking pixels are used and no open or click-through rates are measured. No recipient profiles are created, nor are newsletter recipients segmented on the basis of different interest groups or other categories.

Your data stored for the purpose of sending the newsletter will be deleted as soon as you unsubscribe from the newsletter, provided that no statutory retention obligations or other legal grounds preclude further storage. The log data required to provide evidence of consent may also be stored, insofar as this is necessary to safeguard our legitimate interests in providing evidence of proper consent.

7. Social networks (social media)

7.1. Basic information on social networks

We maintain publicly accessible profiles on social media platforms. You can find a list of the specific social media platforms we use below.
Social media platforms such as Facebook etc. can generally analyse your user behaviour in detail when you visit their website or a website featuring integral social media content (e.g. ‘Like’ buttons or advertising banners). Visiting our social media pages triggers numerous data-processing operations relevant to data protection.

Specifically: if you are logged into your social media account and visit our social media presence, the operator of the social media portal can link this visit to your user account. However, your personal data may also be collected even if you are not logged in or do not have an account with the relevant social media platform. In this case, data collection takes place, for example, via cookies stored on your device or by recording your IP address.
Using the data collected in this way, the operators of the social media platforms can create user profiles containing your preferences and interests. In this way, interest-based advertising may be displayed to you both on and off the respective social media platform. If you have an account with the relevant social network, interest-based advertising may be displayed on all devices on which you are logged in or have been logged in.
Please also note that we cannot track all data processing activities on the social media platforms. Depending on the provider, further data processing operations may therefore be carried out by the operators of the social media platforms. For details, please refer to the terms of use and privacy policies of the relevant social media platforms.

Legal basis
Our social media presence is intended to provide an informative online presence. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Where necessary, the legal basis is also Article 6(1)(a) of the GDPR. Any analysis processes initiated specifically by the social networks may be based on further legal grounds, which must be specified by the operators of the social networks (e.g. consent within the meaning of Article 6(1)(a) of the GDPR).

Data controller and exercising your rights
When you visit one of our social media pages, we are jointly responsible with the operator of the social media platform for the data processing operations triggered by that visit. You may, in principle, exercise your rights (right of access, rectification, erasure, restriction of processing, data portability and the right to lodge a complaint) both with us and with the operator of the relevant social media platform.
Please note that, despite our joint responsibility with the social media platform operators, we do not have full control over the data processing operations carried out by the social media platforms. Our options depend largely on the corporate policy of the respective provider.

Retention
period Data collected directly by us via our social media presence is deleted from our systems as soon as the purpose for which it was stored no longer applies, you request its deletion, or you withdraw your consent to its storage. Stored cookies remain on your device until you delete them. Mandatory legal provisions – in particular retention periods – remain unaffected.
We have no influence over the retention period of your data stored by the operators of social networks for their own purposes. For further details, please contact the operators of the social networks directly (e.g. in their privacy policies, see below).

7.2. Social networks in detail

7.2.1. Facebook

We have a profile on Facebook. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Further information on data protection by Facebook can be found at: https://www.facebook.com/about/privacy/.

7.2.2. Instagram

We have a profile on Instagram. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Further information on Instagram’s data protection practices can be found at: http://instagram.com/about/legal/privacy/.

7.2.3. LinkedIn

We have a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Further information on data protection by LinkedIn can be found at: https://www.linkedin.com/legal/privacy-policy.

7.2.4. YouTube

We use the YouTube.com platform to make our own videos publicly available for promotional purposes. The provider of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information on data protection by YouTube (Google) can be found at: https://www.google.com/policies/privacy/.

8. Links to other websites

Where we provide links to websites operated by other organisations, this privacy policy does not apply to the processing of personal data by those organisations. We therefore recommend that you read the privacy policies on the other websites you visit.

9. Your rights as a data subject

As a data subject, you have the following rights under the GDPR:

Right of access (Art. 15 GDPR):
You have the right to request, free of charge, confirmation as to whether we are processing personal data relating to you. If this is the case, you have the right to access this data, as well as to further information and a copy of the personal data in accordance with the statutory requirements.

Right to rectification (Art. 16 GDPR):
You have the right to request the immediate rectification of inaccurate personal data and the completion of incomplete personal data.

Right to erasure (Art. 17 GDPR):
You have the right to request that we erase personal data relating to you without undue delay, provided that the processing is no longer necessary and the other conditions for erasure under Art. 17 GDPR are met.

Right to restriction of processing (Art. 18 GDPR):
You have the right to request that the processing of your personal data be restricted.

Right to data portability (Art. 20 GDPR):
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, or to request that this data be transmitted to another controller.

Right to object (Article 21 of the GDPR):
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, provided that the processing is based on Article 6(1)(f) of the GDPR; this also applies to profiling based on these provisions. In such cases, we will generally cease processing, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
If your personal data is processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing. This also applies to profiling insofar as it is related to such direct marketing.

Withdrawal of consent (Art. 7(3) GDPR):
If you have given us your consent to the processing of your personal data, you may withdraw this consent at any time with effect for the future. The lawfulness of the processing carried out on the basis of your consent up until its withdrawal remains unaffected.

Right not to be subject to a decision based solely on automated processing (Article 22 of the GDPR):
You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you.

Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR):
You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. In particular, you may lodge a complaint with the supervisory authority for your usual place of residence, your place of work or the place where the alleged infringement occurred.

For further information on your rights, please contact our Data Protection Officer.

10. Changes to our Privacy Policy

To ensure that our Privacy Policy always complies with the latest legal requirements, we reserve the right to make changes at any time. This also applies in the event that the Privacy Policy needs to be amended due to new or revised services, for example new services.

11. Data protection notices for other groups of people

Data protection notices for business partners

Data protection notices for job applicants