Get in touch

Privacy policy

NAME AND ADDRESS OF THE PERSON RESPONSIBLE:

Hubert Schmitz GmbH
Düsseldorfer Str. 4
52525 Heinsberg

Phone: +49(0)2452 9909-0
Fax: +49(0)2452 9909-20

E-mail: info(at)s-gard.de

Represented by the managing directors:

Dipl.-Ing. Hubert Schmitz
Business graduate Bruno Schmitz

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data are collected. Personal data are data that can be used to identify you personally.

This privacy policy explains which data we collect, what we use them for and for what purpose this is done.

Please note that data transmission over the internet may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

1. GENERAL INFORMATION AND MANDATORY INFORMATION

How do we collect your data?

Some data are collected automatically or after your consent by our IT systems when you visit the website. These are mainly technical data (e.g. web browser, time of page access), which are collected automatically when you visit the website.

Other data are collected when you provide them to us, for example by filling in the contact form.

What do we use your data for?

We collect and use your personal data mainly to ensure that the website is provided without errors. Some data may also be used to analyse your user behaviour.

What rights do you have?

You have the right to obtain information about the origin, recipients and purpose of your stored personal data at any time. You also have the right to have these data corrected or deleted. If you have given consent to data processing, you can withdraw this consent at any time. You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. You also have the right to lodge a complaint with the competent supervisory authority.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation; this also applies to profiling based on these provisions. The legal basis on which each processing operation is based can be found in this privacy policy. If you object, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection pursuant to Art. 21(1) GDPR). If your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for direct marketing purposes (objection pursuant to Art. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement. The right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Information, correction and deletion

Within the scope of the applicable legal provisions, you have the right at any time to free information about your stored personal data, their origin and recipients and the purpose of the data processing and, if applicable, a right to have these data corrected or deleted. You can contact us at any time regarding this and any other questions on the subject of personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases:

  • If you contest the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
  • If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of deletion.
  • If we no longer need your personal data, but you need them to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
  • If you have lodged an objection pursuant to Art. 21(1) GDPR, your interests and ours must be weighed against each other. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, these data – apart from their storage – may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

HOSTING

External hosting

This website is hosted externally. The personal data collected on this website are stored on the servers of the host(s). These may include, in particular, IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access data and other data generated via a website.

Our host will only process your data to the extent necessary to fulfil its service obligations and will follow our instructions with regard to these data.

External hosting is carried out for the purpose of fulfilling contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR). If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information on the user’s end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

We use the following host(s):

CDD GmbH & Co.KG, Wurmstr. 4, 52525 Heinsberg, Germany

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law which ensures that the host processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

STORAGE PERIOD

Unless a specific storage period has been stated, we store your personal data until the purpose of the processing no longer applies. If you make a justified request for deletion or withdraw your consent, your data will be deleted unless there are other legally permissible reasons for storing your personal data.

SSL ENCRYPTION

For security reasons and to protect the transmission of confidential content, this website uses SSL encryption. You can recognise an encrypted connection by the fact that the address bar of your browser changes from http:// to https:// and by the lock symbol in your browser bar.

OBJECTION TO ADVERTISING E-MAILS

We hereby object to the use of contact data published within the scope of the legal notice obligation for sending unsolicited advertising and information material. The operators of this website expressly reserve the right to take legal action in the event of unsolicited advertising information being sent.

Image sources / Image credits
The images used on this website are from:

  • JP Gansewendt Photography, https://www.jp-gansewendt-photography.de/
  • Per Schorn Fotografie, https://perschorn.com/
  • Veritas Medien, https://veritas-medien.de/
  • Our own photographs
  • Platforms such as Adobe Stock https://stock.adobe.com/de/

DATA PROTECTION OFFICER

If you have any questions about the processing of your personal data or about your data protection rights, please contact:

ITU
Innovative Technologie und Unternehmensberatung GmbH & Co. KG
Mr Michael Errens
Zechenring 10

41836 Hückelhoven, Germany

Phone +49 24 33 – 80 50 20
E-mail: info@itu-beratung.de

2. DATA COLLECTION ON OUR WEBSITE

CONSENT MANAGEMENT WITH COOKIEBOT

Our website uses the consent management platform Cookiebot to obtain your consent to the storage of certain cookies and the use of similar technologies and to document this consent in compliance with data protection law. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark („Cookiebot“).

When you enter our website, a Cookiebot cookie („CookieConsent“) is stored in your browser, in which the consents you have given or their withdrawal are stored. The following data are processed:

  • Your IP address in shortened form
  • Date and time of consent
  • Browser information
  • URL from which the consent was sent
  • An anonymous, random and encrypted key
  • Your consent status

These data are stored on servers within the European Union. The cookie remains stored for 12 months unless you delete it yourself beforehand. You can change or withdraw your consent at any time via the cookie icon or the corresponding link on our website.

Further information can be found in Cookiebot’s privacy policy: https://www.cookiebot.com/en/privacy-policy/

Cookiebot is used to obtain the legally required consents for the use of cookies and to be able to prove them. The legal basis for this is Art. 6(1)(c) GDPR.

Data processing agreement

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This ensures that Cookiebot processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

COOKIES

Our website partly uses so-called cookies. Cookies do not cause any damage to your computer and do not contain viruses. Cookies serve to make our offering more user-friendly, effective and secure. Cookies are small text files that are placed on your computer and stored by your browser.

Most of the cookies we use are so-called „session cookies“. They are automatically deleted at the end of your visit. Other cookies remain stored on your end device until you delete them. These cookies enable us to recognise your browser on your next visit.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be limited.

Cookies that are required to carry out the electronic communication process, to provide certain functions you have requested (e.g. the shopping cart function) or to optimise the website (e.g. cookies for measuring the web audience) (necessary cookies) are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies for the technically error-free and optimised provision of its services.

If consent to the storage of cookies and similar recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG); consent can be withdrawn at any time. You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be limited. Which cookies and services are used on this website can be found in this privacy policy.

SERVER LOG FILES

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Host name of the accessing computer
  • Time of the server request
  • IP address

These data cannot be assigned to specific persons. These data are not merged with other data sources. We reserve the right to check these data retrospectively if we become aware of specific indications of unlawful use.

These data are collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website – for this purpose, the server log files must be recorded.

ENQUIRIES BY E-MAIL, TELEPHONE OR FAX

If you contact us by e-mail, telephone or fax, your enquiry including all resulting personal data (name, enquiry) will be stored and processed by us for the purpose of handling your request. We will not pass on these data without your consent.

These data are processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested; consent can be withdrawn at any time.

The data you send to us via contact enquiries will remain with us until you ask us to delete them, withdraw your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

CONTACT FORM

If you send us enquiries via the contact form, your details from the form, including the contact details you provided there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We will not pass on these data without your consent.

The data entered in the contact form are therefore processed exclusively on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time. An informal e-mail to us is sufficient for this purpose. The lawfulness of the data processing operations carried out until the withdrawal remains unaffected by the withdrawal.

The data you enter in the contact form will remain with us until you ask us to delete them, withdraw your consent to storage or the purpose for data storage no longer applies. Mandatory statutory provisions – in particular retention periods – remain unaffected.

ONLINE JOB APPLICATIONS

In the case of online job applications, the application data are collected and processed electronically by Hubert Schmitz GmbH for the purpose of handling the application procedure. This also includes forwarding the applicant profile internally to the responsible department.

The legal basis for the collection and processing of the data is based on statutory provisions for the stated purposes (Section 26 BDSG (new version); Art. 88 GDPR, Art. 6(1)(b) GDPR, Art. 9(2)(b) GDPR) and is necessary for carrying out the selection procedure.

If the job application is rejected, the transmitted data will be deleted automatically two months after notification of the rejection. This does not apply if, due to legal requirements (burden of proof under the German General Equal Treatment Act, AGG), longer storage of up to four months or until the conclusion of legal proceedings is necessary.

The legal basis for this is Art. 6(1)(f) GDPR or Section 24(1) No. 2 BDSG.
The legitimate interest of the provider lies in legal defence.

If you have expressly consented to longer storage of the data in a database of prospective candidates, the data will be processed further on the basis of this consent and deleted after 12 months at the latest.

The legal basis for this is Art. 6(1)(a) GDPR. This consent can be withdrawn at any time with effect for the future by notifying the provider in accordance with Art. 7(3) GDPR.

EVENTS/INVITATIONS

For event registrations we use the services of taptic GmbH, a ticketing software.

The service provider is taptic GmbH, Alter Wall 32, 20457 Hamburg, Germany. The company has committed itself to the General Data Protection Regulation and thus fulfils all currently legally required principles of data protection. The privacy policy of taptic GmbH can be accessed at: taptic | Privacy policy.

In addition to the information you provide when voluntarily participating in the event, the following information is also collected:

  • Surname and first name
  • E-mail address
  • Postal address
  • Date and time of your visit
  • Referrer URL
  • IP address

The purpose of the processing is the provision of admission tickets to events. The legal basis for the use and the associated processing and storage of your personal data is Art. 6(1)(b) and (f) GDPR.

By registering for our events, you consent to the collection, storage and use of the above personal data.
By registering, you expressly agree that Hubert Schmitz GmbH may also pass on the participant’s personal data to third parties commissioned with carrying out the event. Hubert Schmitz GmbH ensures that the participant’s rights are safeguarded in this process.

The e-mail address may only be used for sending information material from Hubert Schmitz GmbH and event-related information. In this case, sending invitations electronically is equivalent to sending them by post.
You can withdraw this consent at any time with effect for the future.
Please send your withdrawal to Hubert Schmitz GmbH in good time before the event.

The legal basis for the processing is Art. 6(1)(b) GDPR (performance and fulfilment of pre-contractual obligations), (c) (legal obligations) and (f) (legitimate interest).

Information on photographs and their use

Photographs are regularly taken at our events, some of which are published on our website and on our social media channels.

If you do not wish to be photographed, please speak directly to the photographer on site.

We will remind you of your options for objecting again on the day of the event.

Legal basis: The processing is based on the legitimate interest of the controller in documenting the event it has organised in pictures and reporting positively on it to a wider public (Art. 6(1)(f) GDPR) and on your consent to the processing pursuant to Art. 6(1)(a) GDPR.

Events organised by partner companies

On our website you will find links to events organised by our partner companies. If you click on such a link, you leave our website and are redirected directly to the website of the respective partner company.

Please note that registration for these events takes place directly via the partner company’s website. The processing of your personal data in connection with registration for and participation in the event is solely the responsibility of the respective partner company.

We have no influence on the processing of your personal data by the partner companies. Please inform yourself directly on the partner’s website about their data protection provisions. The corresponding privacy policies can usually be found on the partner website to which you are redirected.

We do not transmit any personal data to the partner companies unless you have expressly given us your consent or there is a legal basis for doing so. Redirection takes place exclusively by clicking on the respective link.

3. ANALYTICS TOOLS AND ADVERTISING

GOOGLE ANALYTICS

We use Google Analytics to analyse website usage. The data obtained are used to optimise our website and our advertising measures.

Google Analytics is a web analytics service operated and provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, United States). Google processes the website usage data on our behalf and contractually undertakes to take measures to ensure the confidentiality of the processed data.

During your website visit, the following data, among others, are recorded:

  • Pages visited
  • The achievement of „website goals“
  • Your behaviour on the pages (time spent, clicks, scrolling behaviour, etc.)
  • Your approximate location (country and city)
  • Your IP address (in shortened form, so that no unique assignment is possible)
  • Technical information such as browser, internet provider, end device and screen resolution
  • Source of your visit (i.e. via which website or which advertising medium you came to us)

These data are transferred to Google servers in the USA. Please note that the same level of data protection as within the EU cannot be guaranteed in the USA.

Google Analytics stores cookies in your web browser for a period of two years since your last visit. These cookies contain a randomly generated user ID with which you can be recognised on future website visits.

The recorded data are stored together with the randomly generated user ID, which enables the evaluation of pseudonymous user profiles.

If you do not agree to this data collection, you can prevent it by installing the browser add-on to deactivate Google Analytics once or by rejecting it in our cookie banner.

The legal basis for the processing of personal data described here is Art. 6(1)(f) GDPR. Our legitimate interest lies in the great benefit that the functions described above have for our offering. The statistical evaluation of user behaviour in particular enables us to respond to interests and optimise our offering.

GOOGLE TAG MANAGER

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), allows us to manage so-called website tags via an interface. The Tag Manager tool itself, which implements the tags, is a cookieless domain and does not collect any personal data. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access these data. If deactivation has been carried out at domain or cookie level, it remains in place for all tracking tags implemented with Google Tag Manager.

Google’s privacy policy can be found at: https://policies.google.com/privacy. Further information: https://privacy.google.com/businesses/adsservices

Google Tag Manager is used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the quick and uncomplicated integration and management of various tools on its website. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; consent can be withdrawn at any time.

GOOGLE RECAPTCHA

We use Google reCAPTCHA (version 2) in our online job application form. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA is used to check whether data are being entered by a human or by an automated program (e.g. bots). For this purpose, reCAPTCHA analyses the behaviour of the website visitor based on various characteristics, such as the IP address, the time spent on the page, mouse movements and technical information about the browser and end device. The data collected during the analysis are forwarded to Google.

Further information can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=en and at https://policies.google.com/terms?hl=en.

The company is certified under the „EU-US Data Privacy Framework“ (DPF). Further information is available at: https://www.dataprivacyframework.gov/participant/5780

The data processing is based on Art. 6(1)(f) GDPR. We have a legitimate interest in protecting our application form from abusive automated use and from spam. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG; consent can be withdrawn at any time.

4. PLUGINS, TOOLS AND SOCIAL MEDIA

GOOGLE MAPS

This website uses the map service Google Maps to display geographical information visually. When Google Maps is used, Google collects, processes and uses data about the use of the map function. Detailed information about data processing by Google can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=en

Google Maps is used in the interest of an appealing presentation of our online offering and to make the locations we indicate on the website easy to find. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information on the user’s end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

LINKEDIN

Our website uses a function of the LinkedIn network. The provider is LinkedIn Corporation (2029 Stierlin Court, Mountain View, CA 94043, USA; hereinafter: LinkedIn).

If you click on the LinkedIn button (plug-in), you will be redirected to our LinkedIn page in a separate browser window. This establishes a direct connection between your browser and the LinkedIn server. LinkedIn thereby receives the information that you have visited our website with your IP address.

If you click the „LinkedIn“ button while logged into your own LinkedIn account, you can link the content of our website to your user account. This allows LinkedIn to associate your visit to our website with your user account. Please note that we have no knowledge of the content of the transmitted data or of its use by LinkedIn. Further information can be found in LinkedIn’s privacy policy (http://www.linkedin.com/legal/privacy-policy).

LinkedIn is certified under the Privacy Shield agreement and thereby guarantees compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active).

If you do not want LinkedIn to be able to associate your visit to our website, please log out of your LinkedIn user account.

LinkedIn Insight is used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in effective advertising measures, including social media. If consent has been requested (e.g. consent to the storage of cookies), processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; consent can be withdrawn at any time.

INSTAGRAM

Functions of the Instagram service are integrated into this website. These functions are offered by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If the social media element is active, a direct connection is established between your end device and the Instagram server. Instagram thereby receives information about your visit to this website. If you are logged into your Instagram account, you can link the content of this website to your Instagram profile by clicking the Instagram button. This allows Instagram to associate your visit to this website with your user account. Please note that, as the provider of these pages, we have no knowledge of the content of the transmitted data or of its use by Instagram. This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be withdrawn at any time. Insofar as personal data are collected on our website with the help of the tool described here and forwarded to Facebook or Instagram, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and their forwarding to Facebook or Instagram. The processing by Facebook or Instagram that takes place after the forwarding is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. The text of the agreement can be found at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the data protection information when using the Facebook or Instagram tool and for the secure implementation of the tool on our website in terms of data protection. Facebook is responsible for the data security of the Facebook and Instagram products. You can assert data subject rights (e.g. requests for information) regarding the data processed by Facebook or Instagram directly with Facebook. If you assert your data subject rights with us, we are obliged to forward them to Facebook. Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum

https://privacycenter.instagram.com/policy/

https://www.facebook.com/help/566994660333381

Further information can be found in Instagram’s privacy policy: https://privacycenter.instagram.com/policy/.

The company is certified under the „EU-US Data Privacy Framework“ (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link:

Data Privacy Framework

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be withdrawn at any time.

FACEBOOK

Our website uses so-called social plugins („plugins“) of the social network Facebook, which is operated by Meta Platforms Inc. or, for the European region, by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland („Facebook“).

You can recognise the Facebook plugins by the Facebook logo or the „Like“ button on our website. An overview of the Facebook plugins can be found here: http://developers.facebook.com/docs/plugins/. When you visit our pages, the plugin establishes a direct connection between your browser and the Facebook server. Facebook thereby receives the information that you have visited our website with your IP address. If you click the Facebook „Like“ button while logged into your Facebook account, you can link the content of our pages to your Facebook profile. This allows Facebook to associate your visit to our pages with your user account. Please note that, as the provider of these pages, we have no knowledge of the content of the transmitted data or of its use by Facebook.

If you do not want Facebook to be able to associate your visit to our pages with your Facebook user account, please log out of your Facebook user account.

Further information can be found in Facebook’s privacy policy at https://www.facebook.com/policy.php

The company is certified under the „EU-US Data Privacy Framework“ (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link:

Data Privacy Framework

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be withdrawn at any time.

TIKTOK

Our website uses so-called social plugins („plugins“) of the social network TikTok. For the European Economic Area, the network is operated by TikTok Technology Limited, Ireland.

You can recognise the TikTok plugins by the TikTok logo on our website.

As the operator of our TikTok profile, we receive anonymised statistical data from TikTok. These data do not allow us to draw any conclusions about individual visitors. Nor can the statistical data we receive be linked to our users‘ profile data. We use the data contained in the statistics exclusively to analyse user behaviour so that we can better align our TikTok profile and our offering with the needs and interests of our users. We only use the data provided to us by TikTok that are necessary for the purposes stated here.

If you do not want TikTok to be able to associate your visit to our pages with your TikTok user account, please log out of your user account.

Further information can be found in TikTok’s privacy policy at https://www.tiktok.com/legal/page/eea/privacy-policy/en

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG and on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.

Consent can be withdrawn at any time.

We do not know the full extent of the data TikTok collects about a visitor or the purposes for which TikTok processes these data.

Please note that the operators of the platform are mostly companies based in the USA, and your data may therefore also be processed outside the European Union and the European Economic Area. This may give rise to risks, e.g. because it could be more difficult for users to enforce their rights. According to its privacy policy, TikTok uses service providers and hosting providers that are each certified under the Privacy Shield and undertake to comply with EU data protection standards.

Further information can be found in TikTok’s privacy policy at https://www.tiktok.com/legal/page/eea/privacy-policy/en

YOUTUBE

On the basis of consent pursuant to Art. 6(1)(1)(f) GDPR, we use components (videos) on our website from YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (hereinafter: „YouTube“), a company of Google Inc., Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter: „Google“).

We use the „privacy-enhanced mode“ option provided by YouTube.

When you access a page that contains an embedded video, a connection to the YouTube servers is established and the content is displayed on the website by notifying your browser.

According to YouTube, in „privacy-enhanced mode“ your data – in particular which of our web pages you have visited and device-specific information including the IP address – are only transmitted to the YouTube server in the USA when you watch the video. By clicking on the video, you consent to this transmission.

If you are logged into YouTube at the same time, this information will be assigned to your YouTube member account. You can prevent this by logging out of your member account before visiting our website.

Google complies with the data protection provisions of the „US Privacy Shield“ and is registered with the „US Privacy Shield“ programme of the US Department of Commerce.

Further information can be found at:

https://www.youtube.com/intl/ALL_en/howyoutubeworks/user-settings/privacy/

https://policies.google.com/privacy

YouTube is used in the interest of an appealing presentation of our online offering. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TTDSG, insofar as the consent includes the storage of cookies or access to information on the user’s end device within the meaning of the TTDSG. Consent can be withdrawn at any time.

MYFONTS

For the uniform display of fonts, this website uses so-called MyFonts, which are provided by Monotype Imaging Holdings Inc., 600 Unicorn Park Drive, Woburn, Massachusetts 01801, USA. When you access a page, your browser loads the required fonts into its browser cache in order to display texts and fonts correctly. For this purpose, the browser you use must connect to the servers of Monotype Imaging Holdings Inc. As a result, Monotype Imaging Holdings Inc. becomes aware that this website has been accessed via your IP address.

MyFonts is used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the uniform presentation of the typeface on its website. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information on the user’s end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

If your browser does not support MyFonts, a standard font from your computer will be used.

Further information on MyFonts can be found at https://www.myfonts.com/pages/website-use-privacy-policy

5. ONLINE SHOP

SHOPIFY

Our online shop is operated with the shop system Shopify. The provider is Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland („Shopify“).

The data entered during the ordering process (e.g. name, address, e-mail address, telephone number, order and payment data) as well as technical data such as your IP address are processed and stored on Shopify’s servers. Orders are completed via Shopify Checkout. Shopify may also transfer data to its parent company Shopify Inc. in Canada; an adequacy decision of the EU Commission exists for Canada. Any transfer to the USA is based on the standard contractual clauses of the EU Commission.

Further information can be found in Shopify’s privacy policy: https://www.shopify.com/legal/privacy

The processing is carried out for the performance of a contract (Art. 6(1)(b) GDPR) and on the basis of our legitimate interest in the secure and reliable operation of our online shop (Art. 6(1)(f) GDPR). If consent has been requested, processing is carried out on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG; consent can be withdrawn at any time.

Data processing agreement

We have concluded a data processing agreement (DPA) with Shopify, which ensures that our customers‘ data are processed only in accordance with our instructions and in compliance with the GDPR.

ORDERING PROCESS/CUSTOMER ACCOUNT

All data entered by customers in the course of order processing are stored. These include:

  • Surname, first name
  • Address
  • Payment data
  • E-mail address
  • Telephone number

Data that are strictly necessary for delivery or order processing are passed on to third-party service providers. The processed data are only stored for as long as is necessary for the intended purpose or required by law.

The legal basis for this is Art. 6(1)(b) GDPR.

PAYMENT

Payment data are collected during the ordering process. For orders on our website, you can choose between various payment methods.

SHOP PAY

We offer the option of processing payment via Shop Pay, an express checkout service provided by Shopify (Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland).

If you use Shop Pay, you can save your e-mail address, telephone number, delivery address and payment information for future orders. To log in, you receive a verification code by SMS. In particular, name, address, e-mail address, telephone number, payment data and order data are processed.

Further information can be found in Shop Pay’s privacy policy: https://shop.app/legal/privacy

The processing is carried out for the performance of a contract (Art. 6(1)(b) GDPR). The storage of your data for future orders is based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

GOOGLE PAY

We offer the option of processing payment via Google Pay. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

If you select Google Pay, the data required for payment processing (e.g. name, address, e-mail address, order amount) are transmitted to Google. Your card details are not passed on to us but are processed by Google in encrypted form.

Further information can be found in the Google Pay privacy notice: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en

The company is certified under the „EU-US Data Privacy Framework“ (DPF): https://www.dataprivacyframework.gov/participant/5780

The processing is carried out for the performance of a contract (Art. 6(1)(b) GDPR).

PAYPAL

We offer the option of processing payment via the payment service provider PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg).

In this context, we pass on the following data to PayPal insofar as this is necessary for the performance of the contract (Art. 6(1)(b) GDPR):

First name
Surname
Address
E-mail address
Telephone number

The processing of the data specified in this section is neither required by law nor by contract. Without the transmission of your personal data, we cannot carry out a payment via PayPal.

You have the option of choosing another payment method (advance payment, cash on collection and, where applicable, invoice).

For various services such as direct debit payments, PayPal carries out a credit check to ensure your willingness and ability to pay. This corresponds to PayPal’s legitimate interest (pursuant to Art. 6(1)(f) GDPR) and serves the performance of the contract (pursuant to Art. 6(1)(b) GDPR). For this purpose, your data (name, address and date of birth, bank account details) are passed on to credit agencies. We have no influence on this process and only receive the result of whether the payment has been carried out or rejected or whether a review is pending.

Further information on options for objection and removal with regard to PayPal can be found at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Your data will be stored until payment processing has been completed. This also includes the period required for processing refunds, receivables management and fraud prevention.

The use of PayPal corresponds to our legitimate interest in offering an efficient and secure payment method (Art. 6(1)(f) GDPR).

CREDIT CARD

In the payment window, you will be asked to enter your credit card details. The data entered are then checked and verified. After the data have been approved, you can print or save the summarised transaction details if you wish.

Optionally, a security check via SecureSMS may be required before the payment is initiated.

Identification with SecureSMS

When identifying with SecureSMS, you will be asked to enter your mobile phone number in the payment window. Within the next few seconds, we will send you a unique and tamper-proof TAN by SMS to your mobile phone. This process is free of charge for you. Depending on your telephone provider, further steps may be required. By entering the TAN received in the payment window, you authorise the purchase and payment by credit card.

The following data are collected and stored during the credit card payment process:

  • Credit card type
  • Credit card number
  • Credit card expiry date
  • Security code
  • Transaction details
  • IP address

The technical processing of your credit card payment is carried out with the involvement of Heinsberger Volksbank, Siemensstraße 5, 52525 Heinsberg, Germany.

Information on data protection at Heinsberger Volksbank can be found at:

https://www.volksbank-heinsberg.de/service/rechtliche-hinweise/datenschutzhinweis-zur-website.html

The collection, storage, processing and transfer of your data is based on Art. 6(1)(a) GDPR and Art. 6(1)(b) GDPR.

LINK BY STRIPE

We offer the option of processing payment via the payment service provider Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland („Stripe“).

This corresponds to our legitimate interest in offering an efficient and secure payment method (Art. 6(1)(f) GDPR).

In this context, we pass on the following data to Stripe insofar as this is necessary for the performance of the contract:

  • Name of the cardholder
  • E-mail address
  • Customer number
  • Order number
  • Bank details
  • Credit card data
  • Credit card expiry date
  • Credit card verification code (CVC)
  • Date and time of the transaction
  • Transaction amount
  • Name of the merchant

The processing of the data specified in this section is neither required by law nor by contract. Without the transmission of your personal data, we cannot carry out a payment via Link by Stripe. You have the option of choosing another payment method.

Stripe has a dual role in data processing activities as both controller and processor. As a controller, Stripe uses the data you transmit to fulfil regulatory obligations.

This corresponds to Stripe’s legitimate interest (pursuant to Art. 6(1)(f) GDPR) and serves the performance of the contract (pursuant to Art. 6(1)(b) GDPR).

We have no influence on this process.

Link by Stripe acts as a processor in order to complete transactions within the payment networks. Within the scope of the processing relationship, Stripe acts exclusively on our instructions and has been contractually obliged to comply with data protection provisions within the meaning of Art. 28 GDPR.

Link by Stripe has implemented compliance measures for international data transfers. These apply to all global activities in which Stripe processes personal data of natural persons in the EU. These measures are based on the EU standard contractual clauses (SCCs).

Further information on Link by Stripe can be found at:

https://link.com/privacy

We store your data until payment processing has been completed. This also includes the period required for processing refunds, receivables management and fraud prevention.

The legal basis for this is Art. 6(1)(b) GDPR.

KLARNA

On our website you have the option of using the payment service of Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden; „Klarna“). If you select and use payment via Klarna, the data required for payment processing are transmitted to Klarna so that the contract with you can be fulfilled using the selected payment method.

This processing is based on Art. 6(1)(b) GDPR.

Cookies may be stored in this context that enable your browser to be recognised.

The resulting data processing is based on Art. 6(1)(f) GDPR due to our overriding legitimate interest in offering a customer-oriented range of payment methods.

For certain payment methods such as „invoice“, „direct debit“ or „instalment purchase“, Klarna reserves the right to obtain a credit report, where applicable, on the basis of mathematical-statistical procedures using credit agencies.
For this purpose, Klarna transmits the personal data required for a credit check, such as:

  • First name and surname
  • Address
  • Gender
  • E-mail address
  • IP address
  • Data related to the order

These data are used by a credit agency for the purpose of identity and credit checks. The information obtained provides information on the statistical probability of a payment default for a balanced decision on the establishment, performance or termination of the contractual relationship. The credit report may contain probability values (score values), which are calculated on the basis of scientifically recognised mathematical-statistical procedures and in the calculation of which, among other things, address data are included. Your legitimate interests are taken into account in accordance with the statutory provisions.

The data processing serves the purpose of a credit check for the initiation of a contract. The processing is based on Art. 6(1)(f) GDPR due to our overriding legitimate interest in protection against payment default if Klarna makes advance payment.

The provision of the data is necessary for the conclusion of the contract with the payment method you have requested. Failure to provide the data means that the contract cannot be concluded with the payment method you have selected.

Further information on Klarna can be found at:

https://www.klarna.com/international/privacy-policy/