Privacy Policy

for the website of WESA-Armaturen GmbH

www.wesa-armaturen.de

1. Data protection at a glance

General information
The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information on data protection can be found in the Privacy Notice set out below.

Data collection on this website
Who is responsible for collecting data on this website?
Data processing on this website is carried out by the website operator. The operator's contact details can be found in the section entitled "Details of the controller" in this Privacy Notice.

How do we collect your data?
Some data is collected when you provide it to us. This may, for example, include data that you enter in a contact form.
Other data is collected automatically by our IT systems when you visit the website, or after you have given your consent. This primarily comprises technical data, such as your internet browser, operating system or the time at which the page was accessed. This data is collected automatically as soon as you enter this website.

What do we use your data for?
Some of the data is collected to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour. Where contracts can be concluded or initiated via the website, the data transmitted is also processed for contractual offers, orders or other order enquiries.

What rights do you have regarding your data?
You have the right at any time to receive, free of charge, information about the source, recipients and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data. If you have given consent to data processing, you may withdraw that consent at any time with effect for the future. You also have the right, in certain circumstances, to request restriction of the processing of your personal data. In addition, you have the right to lodge a complaint with the competent supervisory authority.
You may contact us at any time regarding this or any other questions concerning data protection.

Analytics tools and third-party tools
When you visit this website, your browsing behaviour may be statistically analysed. This is carried out primarily using analytics programs.
Detailed information on these analytics programs can be found in the following Privacy Notice.

2. Hosting

We host the content of our website with the following provider:

External hosting
This website is hosted externally. The personal data collected on this website is stored on the servers of the hosting provider or providers. This may primarily include IP addresses, contact enquiries, metadata and communications data, contract data, contact details, names, website access data and other data generated via a website.
External hosting is used for the purpose of performing contracts with our prospective and existing customers (Article 6(1)(b) GDPR) and in the interest of providing our online services securely, quickly and efficiently through a professional provider (Article 6(1)(f) GDPR). Where corresponding consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's terminal device, such as device fingerprinting, within the meaning of the TDDDG. Consent may be withdrawn at any time.
Our hosting provider or providers will process your data only to the extent necessary to fulfil their service obligations and will follow our instructions with regard to this data.
We use the following hosting provider:
Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, CA 94105, USA

Data processing agreement
We have entered into a data processing agreement (DPA) for the use of the service referred to above. This is an agreement required by data protection law which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link by searching for "Netlify, Inc.": https://www.dataprivacyframework.gov/list

3. General information and mandatory disclosures

Data protection
The operators of this website take the protection of your personal data very seriously. We treat your personal data as confidential and in accordance with the statutory data protection regulations and this Privacy Notice.
When you use this website, various items of personal data are collected. Personal data is data that can be used to identify you personally. This Privacy Notice explains what data we collect and what we use it for. It also explains how and for what purpose this is done.
Please note that data transmission over the internet, for example when communicating by email, may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

Details of the controller
The controller responsible for data processing on this website is:

WESA-Armaturen GmbH
Spanninger Straße 5
73650 Winterbach
Germany
Telephone: +49 (0) 7181 404-0
Email: info@wesa-armaturen.de

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data, such as names, email addresses or similar information.

Retention period
Where no more specific retention period is stated in this Privacy Notice, your personal data will remain with us until the purpose for which it was processed no longer applies. If you submit a legitimate request for erasure or withdraw your consent to data processing, your data will be erased unless we have other legally permissible grounds for storing your personal data, such as retention periods under tax or commercial law; in the latter case, the data will be erased once those grounds cease to apply.

General information on the legal bases for data processing on this website
If you have consented to data processing, we process your personal data on the basis of Article 6(1)(a) GDPR or Article 9(2)(a) GDPR where special categories of personal data within the meaning of Article 9(1) GDPR are processed. Where you have expressly consented to the transfer of personal data to third countries, processing is also based on Article 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your terminal device, for example by means of device fingerprinting, processing is additionally based on section 25(1) TDDDG. Consent may be withdrawn at any time. If your data is required for the performance of a contract or in order to take steps prior to entering into a contract, we process your data on the basis of Article 6(1)(b) GDPR. We also process your data on the basis of Article 6(1)(c) GDPR where this is necessary for compliance with a legal obligation. Data may also be processed on the basis of our legitimate interests under Article 6(1)(f) GDPR. Information on the legal bases applicable in each individual case is provided in the following paragraphs of this Privacy Notice.

Data Protection Officer
We have appointed a Data Protection Officer.

DIP Datenschutz GmbH
Groenerstraße 25
71636 Ludwigsburg
Telephone: 07141 6963880
Email: info@dip-datenschutz.com

Recipients of personal data
In the course of our business activities, we work with various external organisations. In some cases, this also requires personal data to be transferred to these external organisations. We disclose personal data to external organisations only where this is necessary for the performance of a contract, where we are legally obliged to do so, for example by disclosing data to tax authorities, where we have a legitimate interest in the disclosure under Article 6(1)(f) GDPR, or where another legal basis permits the disclosure. When using processors, we disclose our customers' personal data only on the basis of a valid data processing agreement. Where processing is carried out jointly, a joint controller arrangement is concluded.

Withdrawal of your consent to data processing
Many data processing operations are possible only with your express consent. You may withdraw consent that you have already given at any time. The lawfulness of data processing carried out before the withdrawal remains unaffected by the withdrawal.

Right to object to data collection in specific cases and to direct marketing (Article 21 GDPR)
IF DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ARTICLE 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT, AT ANY TIME, TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY NOTICE. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING IS FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ARTICLE 21(1) GDPR).
WHERE YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION UNDER ARTICLE 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority
In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement. This right is without prejudice to any other administrative or judicial remedies.

Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract provided to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will be carried out only where technically feasible.

Access, rectification and erasure
Within the framework of the applicable statutory provisions, you have the right at any time to receive, free of charge, information about your stored personal data, its source and recipients and the purpose of the data processing, and, where applicable, the right to have this data rectified or erased. You may contact us at any time regarding this or any other questions concerning personal data.

Right to restriction of processing
You have the right to request restriction of the processing of your personal data. You may contact us at any time for this purpose. The right to restriction of processing exists in the following cases:
If you dispute the accuracy of the personal data we hold about you, we generally need time to verify this. For the duration of the verification, you have the right to request restriction of the processing of your personal data.
If the processing of your personal data was or is unlawful, you may request restriction of data processing instead of erasure.
If we no longer need your personal data but you require it for the establishment, exercise or defence of legal claims, you have the right to request restriction of the processing of your personal data instead of erasure.
If you have objected under Article 21(1) GDPR, your interests and ours must be weighed against each other. Until it has been determined whose interests prevail, you have the right to request restriction of the processing of your personal data.
Where you have restricted the processing of your personal data, that data may, apart from being stored, be processed only with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the website operator, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address bar changing from "http://" to "https://" and by the padlock symbol in your browser's address bar.
When SSL or TLS encryption is enabled, the data that you transmit to us cannot be read by third parties.

Objection to unsolicited marketing emails
We hereby object to the use of contact details published as part of the statutory legal notice requirements for the purpose of sending unsolicited advertising or information material. The website operators expressly reserve the right to take legal action in the event of unsolicited advertising information, such as spam emails.

4. Data collection on this website

Server log files
The website provider automatically collects and stores information in server log files, which your browser automatically transmits to us. This information comprises:

browser type and browser version
operating system used
referrer URL
host name of the accessing computer
time of the server request
IP address

This data is not combined with data from other sources.
This data is collected on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website; the server log files must be collected for this purpose.
The above data is stored for the duration of the website visit and, for technical reasons, for no more than 30 days thereafter.

Cookies
Our websites use "cookies". Cookies are small data packages and do not cause any damage to your terminal device. They are stored on your terminal device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are deleted automatically at the end of your visit. Persistent cookies remain stored on your terminal device until you delete them yourself or they are deleted automatically by your web browser.
Cookies may originate from us (first-party cookies) or from third-party companies (third-party cookies). Third-party cookies make it possible to integrate certain services provided by third-party companies into websites, for example cookies used to process payment services.
Cookies perform various functions. Many cookies are technically necessary because certain website functions would not work without them, for example the shopping basket function or the display of videos. Other cookies may be used to analyse user behaviour or for advertising purposes.
Cookies that are required to carry out the electronic communications process, to provide certain functions that you have requested, such as the shopping basket function, or to optimise the website, such as cookies used to measure the website audience, are classed as necessary cookies and are stored on the basis of Article 6(1)(f) GDPR unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to provide its services in a technically error-free and optimised manner. Where consent to the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of that consent (Article 6(1)(a) GDPR and section 25(1) TDDDG); consent may be withdrawn at any time.
You can configure your browser to notify you when cookies are set, to allow cookies only in individual cases, to exclude the acceptance of cookies in certain cases or in general, and to enable cookies to be deleted automatically when the browser is closed. Disabling cookies may restrict the functionality of this website.
Where additional cookies and services are used on this website, details can be found in this Privacy Notice.

Consent management with Cookiebot
Our website uses Cookiebot's consent management technology to obtain your consent to the storage of certain cookies on your terminal device or to the use of certain technologies and to document that consent in compliance with data protection law. The provider of this technology is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark (referred to below as "Cookiebot").
When you enter our website, a connection is established to Cookiebot's servers in order to obtain your consent and other declarations regarding the use of cookies. Cookiebot then stores a cookie in your browser so that the consents you have given, or their withdrawal, can be assigned to you. The data collected in this way is stored until you ask us to erase it, delete the Cookiebot cookie yourself or the purpose for which the data was stored no longer applies. Mandatory statutory retention obligations remain unaffected.
Cookiebot is used to obtain the consents required by law for the use of cookies. The legal basis for this is Article 6(1)(c) GDPR.

Contact form
If you send us enquiries via the contact form, the information you provide in the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We will not disclose this data without your consent.
This data is processed on the basis of Article 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary in order to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in dealing effectively with enquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR), where this has been requested; consent may be withdrawn at any time.
The data you enter in the contact form will remain with us until you ask us to erase it, withdraw your consent to its storage or the purpose for which the data was stored no longer applies, for example once your enquiry has been fully dealt with. Mandatory statutory provisions, in particular retention periods, remain unaffected.

Contact by email
If you contact us via one of the email addresses we provide, the personal data you disclose will be processed exclusively for the purpose of handling your enquiry, corresponding with you and, where applicable, taking steps to enter into and conclude a contract with you in accordance with Article 6(1)(b) GDPR. The personal data collected will be erased automatically once your enquiry has been dealt with; this is the case where the circumstances indicate that the matter concerned has been conclusively resolved and provided that no statutory retention obligations prevent erasure.

Job applications
If you apply to us, we process personal data concerning you for the purpose of your application for employment to the extent necessary for deciding whether to establish an employment relationship with you. The legal basis is Article 88 GDPR in conjunction with section 26(1) and (8), sentence 2 BDSG, and, for the performance of a contract or steps taken prior to entering into a contract, Article 6(1)(b) GDPR. We may also process personal data concerning you where this is necessary to defend against legal claims asserted against us arising from the application process. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is, for example, the need to provide evidence in proceedings under the General Equal Treatment Act (AGG). If an employment relationship is established between you and us, we may, in accordance with section 26(1) BDSG, further process the personal data already received from you for the purposes of the employment relationship where this is necessary for carrying out or terminating the employment relationship or for exercising or fulfilling the existing statutory rights and obligations.
We process data relating to your application that you send to us. For this purpose, we provide the dedicated email address karriere@wesa-armaturen.de, which can be accessed only by our HR department. We do not currently use any external applicant management systems in which the data is stored. Your applicant data is not transferred to a third country. We store your personal data for as long as is necessary to decide on your application. If no employment relationship is established between you and us, we may continue to store data to the extent necessary to defend against possible legal claims. The application documents will be erased two months after notification of the rejection decision, unless longer storage is required because of legal disputes.

Google Forms
We have integrated Google Forms into this website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (referred to below as "Google").
Google Forms enables us to create online forms in order to record messages, enquiries and other input from visitors to our website in a structured manner. All entries you make are processed on Google's servers. Google Forms stores a cookie in your browser containing a unique ID (NID cookie). This cookie stores various items of information, such as your language settings.
Google Forms is used on the basis of our legitimate interest in identifying the nature of your enquiry in as user-friendly a manner as possible (Article 6(1)(f) GDPR). Where corresponding consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's terminal device, such as device fingerprinting, within the meaning of the TDDDG. Consent may be withdrawn at any time.
The data you enter in the form will remain with us until you ask us to erase it, withdraw your consent to its storage or the purpose for which the data was stored no longer applies, for example once your enquiry has been fully dealt with. Mandatory statutory provisions, in particular retention periods, remain unaffected.
Further information can be found in Google's Privacy Policy at https://policies.google.com/.
The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

5. Social media

Instagram
Functions of the Instagram service are integrated into this website. These functions are provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
When the social media element is activated, a direct connection is established between your terminal device and Instagram's server. Instagram thereby receives information that you have visited this website.
If you are logged in to your Instagram account, you can link the content of this website to your Instagram profile by clicking the Instagram button. This allows Instagram to associate your visit to this website with your user account. Please note that, as the website provider, we have no knowledge of the content of the data transmitted or how Instagram uses it.
This service is used on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.
Where personal data is collected on our website using the tool described here and forwarded to Facebook or Instagram, we and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, are joint controllers for this processing (Article 26 GDPR). Joint controllership is limited exclusively to collecting the data and forwarding it to Facebook or Instagram. Processing carried out by Facebook or Instagram after the data has been forwarded is not part of the joint controllership. The obligations incumbent on us jointly have been set out in a joint controller arrangement. The text of the arrangement is available at: https://www.facebook.com/legal/controller_addendum. Under this arrangement, we are responsible for providing privacy information when using the Facebook or Instagram tool and for implementing the tool on our website in a manner that complies with data protection law. Facebook is responsible for the data security of Facebook and Instagram products. You may assert data subject rights, such as requests for access, in relation to data processed by Facebook or Instagram directly against Facebook. If you assert data subject rights against us, we are required to forward them to Facebook.
Data transfers to the USA are based on the European Commission's Standard Contractual Clauses. Details can be found at: https://www.facebook.com/legal/EU_data_transfer_addendum, https://privacycenter.instagram.com/policy/ and https://de-de.facebook.com/help/566994660333381.
Further information can be found in Instagram's Privacy Policy at: https://privacycenter.instagram.com/policy/.
The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/4452.

LinkedIn
This website uses elements of the LinkedIn network. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
Whenever a page of this website containing LinkedIn elements is accessed, a connection to LinkedIn's servers is established. LinkedIn is informed that you have visited this website using your IP address. If you click LinkedIn's "Recommend" button while logged in to your LinkedIn account, LinkedIn can associate your visit to this website with you and your user account. Please note that, as the website provider, we have no knowledge of the content of the data transmitted or how LinkedIn uses it.
This service is used on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.
Data transfers to the USA are based on the European Commission's Standard Contractual Clauses. Details can be found at: https://www.linkedin.com/help/linkedin/answer/a1343190/datenubertragung-aus-der-eu-dem-ewr-und-der-schweiz?lang=de
Further information can be found in LinkedIn's Privacy Policy at: https://www.linkedin.com/legal/privacy-policy.
The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5448.

XING
This website uses elements of the XING network. The provider is New Work SE, Am Strandkai 1, 20457 Hamburg, Germany.
Whenever one of our pages containing XING elements is accessed, a connection to XING's servers is established. To the best of our knowledge, no personal data is stored in this process. In particular, no IP addresses are stored and user behaviour is not analysed.
This service is used on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.
Further information on data protection and the XING Share button can be found in XING's Privacy Policy at: https://privacy.xing.com/de/datenschutzerklaerung.

6. Analytics tools and advertising

Google Tag Manager
We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Tag Manager is a tool that enables us to integrate tracking or analytics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies or carry out any independent analyses. It is used solely to manage and deploy the tools integrated through it. However, Google Tag Manager records your IP address, which may also be transmitted to Google's parent company in the United States.
Google Tag Manager is used on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in integrating and managing various tools on its website quickly and easily. Where corresponding consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's terminal device, such as device fingerprinting, within the meaning of the TDDDG. Consent may be withdrawn at any time.
The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

Google Ads
The website operator uses Google Ads. Google Ads is an online advertising programme provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Ads enables us to display advertisements in the Google search engine or on third-party websites when a user enters certain search terms into Google (keyword targeting). Targeted advertisements may also be displayed on the basis of user data held by Google, such as location data and interests (audience targeting). As the website operator, we can analyse this data quantitatively, for example by analysing which search terms triggered the display of our advertisements and how many corresponding clicks those advertisements received.
This service is used on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.
Data transfers to the USA are based on the European Commission's Standard Contractual Clauses. Details can be found at: https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/.
The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

Google Conversion Tracking
This website uses Google Conversion Tracking. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Conversion Tracking enables Google and us to determine whether a user has carried out certain actions. For example, we can analyse which buttons on our website were clicked, how often they were clicked and which products were viewed or purchased particularly frequently. This information is used to compile conversion statistics. We learn the total number of users who clicked our advertisements and the actions they performed. We do not receive any information with which we can identify the user personally. Google itself uses cookies or comparable recognition technologies for identification.
This service is used on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.
More information on Google Conversion Tracking can be found in Google's Privacy Policy at: https://policies.google.com/privacy?hl=de.
The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

7. Newsletter

Newsletter data
If you would like to receive the newsletter offered on the website, we require an email address from you as well as information enabling us to verify that you are the owner of the email address provided and that you consent to receiving the newsletter. No other data is collected, or only on a voluntary basis. We use the newsletter service providers described below to manage newsletter distribution.

Brevo
This website uses Brevo to send newsletters. The provider is Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.
Brevo is a service that can be used, among other things, to organise and analyse the distribution of newsletters. The data you enter for the purpose of receiving the newsletter is stored on the servers of Sendinblue GmbH in Germany.

Data analysis by Brevo
Brevo enables us to analyse our newsletter campaigns. For example, we can see whether a newsletter message has been opened and which links, if any, have been clicked. This enables us, among other things, to determine which links are clicked particularly frequently.
We can also determine whether certain predefined actions were carried out after the newsletter was opened or a link was clicked (conversion rate). For example, we can determine whether you made a purchase after clicking a link in the newsletter.
Brevo also enables us to divide newsletter recipients into different categories ("clusters"). For example, newsletter recipients can be divided according to age, gender or place of residence. This allows the newsletters to be better tailored to the respective target groups.
If you do not want Brevo to analyse your data, you must unsubscribe from the newsletter. We provide a corresponding link in every newsletter message for this purpose.
Detailed information on Brevo's functions can be found at: https://www.brevo.com/de/newsletter-software/.

Legal basis
Data processing is carried out on the basis of your consent (Article 6(1)(a) GDPR). You may withdraw this consent at any time. The lawfulness of data processing operations already carried out remains unaffected by the withdrawal.

Retention period
The data you provide to us for the purpose of receiving the newsletter is stored by us or by the newsletter service provider until you unsubscribe from the newsletter and is erased from the newsletter distribution list after you unsubscribe. Data stored by us for other purposes remains unaffected by this.
After you unsubscribe from the newsletter distribution list, your email address may be stored by us or by the newsletter service provider on a blacklist where this is necessary to prevent future mailings. The data on the blacklist is used only for this purpose and is not combined with other data. This serves both your interest and our interest in complying with the statutory requirements for sending newsletters (legitimate interest within the meaning of Article 6(1)(f) GDPR). Storage on the blacklist is not limited in time. You may object to storage if your interests outweigh our legitimate interest.
Further details can be found in Brevo's privacy policies at: https://www.brevo.com/de/datenschutz-uebersicht/ and https://www.brevo.com/de/legal/privacypolicy/.

8. Plugins and tools

YouTube in privacy-enhanced mode
This website embeds videos from YouTube. The website operator is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
When you visit one of our pages on which YouTube is embedded, a connection is established to YouTube's servers. The YouTube server is informed which of our pages you have visited. If you are logged in to your YouTube account, you enable YouTube to associate your browsing behaviour directly with your personal profile. You can prevent this by logging out of your YouTube account.
We use YouTube in privacy-enhanced mode. According to YouTube, videos played in privacy-enhanced mode are not used to personalise browsing on YouTube. Advertisements displayed in privacy-enhanced mode are also not personalised. No cookies are set in privacy-enhanced mode. Instead, local storage elements are stored in the user's browser; like cookies, these may contain personal data and may be used for recognition purposes. Details of privacy-enhanced mode can be found at: https://support.google.com/youtube/answer/171780.
Further data processing operations over which we have no control may be triggered once a YouTube video is activated.
YouTube is used in the interest of presenting our online services attractively. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR. Where corresponding consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's terminal device, such as device fingerprinting, within the meaning of the TDDDG. Consent may be withdrawn at any time.
Further information about data protection at YouTube can be found in its Privacy Policy at: https://policies.google.com/privacy?hl=de.
The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

Further questions about data protection and your rights
If you have any further questions, comments or other enquiries concerning your personal data that are not answered here, please contact us or our Data Protection Officer using the contact details provided.

This document is a translation without guarantee. The German version applies.