Data protection declaration

Data protection declaration

Last updated May 2018

I. Name and address of the data controller

The data controller within the meaning of the General Data Protection Regulation and other national data protection laws of the Member States as well as other data protection provisions is:

hünersdorff GmbH
Eisenbahnstrasse 6
71636 Ludwigsburg
Germany

info@huenersdorff.de
+49 7141 147-0
www.huenersdorff.de 

II. Name and address of the data protection officer

The data protection officer of the data controller is:

DataCo GmbH
Patrick Schweisthal
Dachauer Str. 65
80335 Munich
Germany

+49 89 740045840
datenschutz@dataguard.de
www.dataguard.de

III. Rights of the data subjects

The following enumeration encompasses all rights of the data subjects according to GDPR. Rights that are not relevant to your website need not be mentioned. The enumeration may be abbreviated if this is the case.

If your personal data are processed, you are a data subject within the meaning of GDPR, and have the following rights in respect of the data controller:

1 Right to information

You may request a confirmation from the data controller as to whether we process personal data that relate to you. If such processing occurs, you may request information about the following from the data controller:

(1) the purposes for which the personal data are processed;

(2) the categories of personal data that are processed;

(3) the recipients or the categories of recipients to whom the personal data concerning you have been disclosed or have yet to be disclosed;

(4) the planned storage duration of the personal data relating to you or, if specific information in this respect is not available, criteria for determining the storage duration;

(5) any right to rectification or erasure of the personal data relating to you, any right to restriction of the processing by the data controller, or any right to object to this processing;

(6) any right to lodge a complaint with a supervisory authority;

(7) all available information about the origin of the data if the personal data were not collected from the data subject;

(8) The occurrence of automated decision-making, including profiling pursuant to Art. 22 paras. 1 and 4 GDPR and – at least in these cases – meaningful information about the logic involved as well as the scope and desired effect of such processing as concerns the data subject.

You have the right to request information about whether personal data relating to you are transmitted to a third country or to an international organization. In this connection, you may request notification regarding the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

2. Right of rectification

You have a right of rectification and/or completion in respect of the data controller to the extent that the processed personal data relating to you are incorrect or incomplete. The data controller is required to undertake rectification without delay.

3. Right to restriction of processing

Subject to the following conditions, you may demand that the processing of the personal data relating to you be restricted:

(1) if you contest the accuracy of the personal data relating to you for a period permitting the data controller to review the accuracy of the personal data;

(2) if the processing is unlawful and you refuse the erasure of the personal data and instead demand a restriction in the use of the personal data;

(3) the data controller no longer requires the personal data for the purposes of processing, yet you require them in order to assert, exercise or defend legal claims, or

(4) if you have lodged an objection against the processing pursuant to Art. 21 (1) GDPR and it is not yet clear whether the legitimate grounds of the data controller override your grounds.

If the processing of the personal data related to you was restricted, these data may only – aside from their storage – be processed with your consent or for the assertion, exercise or defense of legal claims, or in order to protect the rights of another natural or legal person, or for reasons of an important public interest of the Union or a Member State.

If the restriction of processing according to the aforementioned conditions was restricted [sic], you will be informed by the data controller before the restriction is repealed.

4. Right of erasure

a) erasure obligation

You may demand of the data controller that the personal data relating to you be erased without delay, and the data controller is then obliged to erase these data without delay, insofar as one of the following is true:

(1) The personal data relating to you are no longer needed for the reasons for which they were collected or otherwise processed.

(2) You withdraw your consent on which processing pursuant to. Art. 6 para. 1 sentence 1 (a) or Art. 9 (2) (a) GDPR, and there is no other legal basis for processing.

(3) You lodge an objection pursuant to. Art. 21 para. 1 GDPR against the processing, and there are no priority legitimate grounds for processing, or you lodge an objection to the processing pursuant to Art. 21 para. 2 GDPR.

(4) The personal data relating to you were processed unlawfully.

(5) The erasure of the personal data relating to you is required in order to meet a legal obligation according to Union law or the law of the Member States to which the data controller is subject.

(6) The personal data relating to you were collected in relation to offered information society services pursuant to Art. 8 para. 1 GDPR.

b) information to third parties

If the data controller has disclosed the personal data relating to you and if the data controller is obliged to erase those data pursuant to Art. 17 para. 1 GDPR, it shall take appropriate measures having regard to the available technology and implementation costs, including measures of a technical nature, in order to inform the data controllers that process the personal data that you, as a data subject, have demanded of them the erasure of all links to these personal data or of copies or replications of these personal data.

c) exemptions

There is no right of the erasure if the processing is necessary

(1) for the exercise of the right to freedom of expression and information;

(2) in order to meet a legal obligation requiring the processing under the law of the Union or of the Member States to which the data controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, where such task was transferred to the data controller;

(3) for reasons of the public interest in the area of public health pursuant to Art. 9 para. 2 (h) and (i) and Article 9 para. 3 GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes pursuant to. Art. 89 para. 1 GDPR, to the extent that the right set out under a) is likely to render impossible the achievement of the objectives of this processing, or to seriously impair such achievement, or

(5) for the assertion, exercise or defense of legal claims.

5. Right to information

If you have asserted the right of rectification, erasure or restriction of processing in respect of the data controller, the latter is obliged to notify all recipients to whom the personal data relating to you were disclosed of such rectification or erasure of the data, or of the restriction in processing, unless this proves to be impossible or involves disproportionate effort. You have the right to be informed of these recipients in respect of the data controller.

6. Right to data portability

You have the right to receive the personal data relating to you and which you have provided to the data controller in a structured, commonly used and machine-readable format. In addition, you have the right to transfer these data to another data controller without hindrance from the data controller to which the personal data have been provided, where

(1) the processing is based on consent pursuant to. Art. 6 para. 1 sentence 1 (a) or Art. 9 para. 2 (a) GDPR or based on a contract pursuant to Art. 6 para. 1 sentence 1 (b) GDPR and

(2) the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data relating to you transmitted directly from one data controller to another data controller, where technically feasible. The rights and freedoms of other persons must not be impaired as a result.

The right to data portability does not apply to the processing of personal data that is required for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, where such task was transferred to the data controller.

7. Right to object

You have the right, for reasons arising from your particular situation, to lodge an objection against the processing of personal data relating to you at any time, where such processing occurs on the basis of Art. 6 para. 1 sentence 1 (e) or (f) GDPR; the same also applies to any profiling based on these provisions.

The data controller will no longer process the personal data relating to you unless it is able to document mandatory grounds for the processing that are worthy of protection and override your interests, rights and freedoms, or unless processing serves the assertion, exercise or defense of legal claims.

If the personal data relating to you are processed for purposes of engaging in direct marketing, you have the right to lodge an objection at any time against the processing of your personal data for purposes of such marketing; the same also applies to the profiling, to the extent that it is related to such direct marketing.

If you object to the processing for purposes of direct marketing, the personal data relating to you will no longer be processed for these purposes.

In connection with the use of information society services, you have the opportunity – notwithstanding Directive 2002/58/EC – to exercise your right to object by means of an automated procedure for which technical specifications are used.

8. Right to revoke data protection consent

You have the right to revoke your data protection consent at any time. The revocation of your consent does not affect the legality of such processing as has been undertaken on the basis of your consent until the time of revocation.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. The foregoing does not apply if the decision

(1) is necessary for entering into, or performance of, a contract between you and the data controller,

(2) is permissible on the basis of Union legislation or legislation of Member States to which the data controller is subject and such legislation contains appropriate safeguards for the protection of your rights and freedoms as well as your legitimate interests, or

(3) is made with your explicit consent.

However, these decisions shall not be based on particular categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art. 9 para. 2 (a) or (g) GDPR applies and appropriate measures for the protection of rights and freedoms and of your legitimate interests have been taken.

In the cases referred to in (1) and (3), the data controller implements suitable measures to safeguard the rights and freedoms as well as your legitimate interests, including at least the right to obtain human intervention on the part of the data controller, to express your point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your place of residence, your place of work or the place of the alleged violation, if you are of the opinion that the processing of the personal data relating to you is in violation of GDPR. The supervisory authority with which the complaint was lodged shall inform the complainant of the status and the results of the complaint, including the opportunity for legal remedy pursuant to Art. 78 GDPR.

IV. General information about data processing

1 Scope of the processing of personal data

In principle, we only process personal data of our users to the extent necessary in order to provide a functional website along with our content and services. Processing of our users' personal data generally only takes place with the consent of the user. There is an exception for cases in which it is not possible to obtain consent for factual reasons and where processing of the data is permitted by law.

2. Legal basis for the processing of personal data

To the extent that we obtain the consent of the data subject for processing operations related to personal data, the legal basis is provided by Art. 6 para. 1 sentence 1 (a) of the EU General Data Protection Ordinance (GDPR).

For processing of personal data required for the performance of a contract to which the data subject is party, the legal basis is provided by Art. 6 para. 1 sentence 1 (b) GDPR. The foregoing also applies to processing operations required for the performance of pre-contractual measures.

To the extent that processing of personal data is required for the fulfillment of a legal obligation to which our company is subject, the legal basis is provided by Art. 6 para. 1 sentence 1 (c) GDPR.

In the event that vital interests of the data subject or of another natural person renders the processing of personal data necessary, the legal basis is provided by Art. 6 para. 1 sentence 1 (d) GDPR.

If the processing is necessary in order to safeguard a legitimate interest of our company or of a third party and if the interests, fundamental rights and fundamental freedoms of the data subject do not override the aforementioned interest, the legal basis of the processing is provided by Art. 6 para. 1 sentence 1 (f) GDPR.

3. Data erasure and duration of storage

The personal data of the data subject are stored or blocked as soon as the purpose of storage lapses. Storage may continue beyond this point where provided for by European or national legislators in Union ordinances, laws or other legislation to which the data controller is subject. The data will also be blocked or erased if a storage period prescribed by the aforementioned standard expires, unless there is a need for additional storage of the data for purposes of concluding a contract, or for purposes of contractual fulfillment.

V. Provision of the website and creation of log files

1 Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.

The following data are collected in so doing:

  • Information about the type of browser and the version used
  • The operating system of the user
  • The user's Internet service provider
  • The user's IP address
  • The date and time of access
  • The websites from which the user system reaches our website
  • Websites accessed by the user system via our website

The data are also stored in our system's log files. These data are not stored together with other personal data of the user.

2. Legal basis for the data processing

The legal basis for temporary storage of the data and log files is provided by Art. 6 para. 1 sentence 1 (f) GDPR.

3. Purpose of data processing

The temporary storage of the IP address by the system is necessary in order to enable delivery of the website to the user's computer. To do so, the user's IP address must be stored for the duration of the session. Data are stored in log files in order to ensure the functionality of the website. In addition, the data help us to optimize the website and to ensure the security of our IT systems. The data are not evaluated for marketing purposes in this connection.

Our legitimate interest in data processing pursuant to Art. 6 para. 1 sentence 1 (f) GDPR also derives from these purposes.

4. Duration of storage

The data will be erased as soon as they are no longer required for the achievement of the purpose of their collection. In the event that the data are collected to provide the website, this happens when each session is ended. If the data are saved in log files, this happens after no more than seven days. It is possible for data to be saved beyond that length of time. In this case the IP addresses of the users will be erased or defamiliarized so that it is no longer possible to attribute them to the accessing client.

5. Option of objection and elimination

It is absolutely necessary to collect the data in order to provide the website; saving the data in log files is also absolutely necessary for the operation of the website. Consequently, the user has no option to object.

VI. Use of cookies

1 Description and scope of data processing

Our website uses cookies. Cookies are text files that are saved in the Internet browser or by the Internet browser on the user's computer system. If a user visits a website, a cookie may be saved in the user's operating system. This cookie contains a characteristic character string enabling unique identification of the browser the next time the website is accessed.

We use cookies in order to make our website more user-friendly. Some elements of our website require that it be possible to identify the requesting browser after a page change as well.

The following data are saved and transmitted in the cookies:

  • Language settings

In addition, we use cookies on our website to enable an analysis of user browsing behavior. In this way, the following data may be transmitted:

  • Search terms entered
  • Frequency of pageviews
  • Use of website features

The user data collected in this way are rendered pseudonymous by technical means. For this reason, it is no longer possible to attribute the data to the requesting user. The data are not stored in common with other personal user data. When accessing our website, users are informed about the use of cookies for analytics purposes by an information banner that also refers them to this Privacy Policy. In this connection, reference is also made to how the browser settings can be configured to prevent the saving of cookies.

2. Legal basis for the data processing

The legal basis for the processing of data using cookies is provided by Art. 6 para. 1 sentence 1 (f) GDPR.

3. Purpose of data processing

The purpose of using technically necessary cookies is to simplify the use of websites for the users. Some features of our website cannot be offered without using cookies. For cookies to work, the browser has to be recognized after a page change as well.

We require cookies for the following uses:

  • Takeover of language settings

Our legitimate interest in the processing of personal data pursuant to Art. 6 para. 1 sentence 1 (f) GDPR also derives from these purposes.

4. Duration of storage, Option of objection and elimination

Cookies are saved on the user's computer and are transmitted from it to our site. For this reason, as the user you also have complete control over the use of cookies. By changing the settings in your web browser, you can disable or restrict the transmission of cookies. Cookies that have been saved already can be deleted at any time. This can also be automated. If cookies are disabled for our website, it is possible that not all the features of the website can be used to the full extent any longer.

VII. Contact form and email contact

1 Description and scope of data processing

There is a contact form on our website that can be used to get in touch electronically. If the user makes use of this opportunity, the data entered in the entry screen are transmitted to us and stored. These are the data:

  • Email address
  • Surname
  • First name
  • Address
  • Phone/mobile phone

The following data are also stored at the time the message is submitted:

  • The user's IP address
  • Message

In order to process the data, we obtain your consent as part of form submission and make reference to this Privacy Policy. Alternately, it is also possible to get in touch using the email address provided. In this case, the personal user data transmitted with the email will be stored. The data are not passed on to third parties in this connection. The data are used exclusively for purposes of processing the conversation.

2. Legal basis for the data processing

If consent has been provided, the legal basis for processing the data is provided by Art. 6 para. 1 sentence 1 (a) GDPR. The legal basis for the processing of the data transmitted when sending an email is provided by Art. 6 para. 1 sentence 1 (f) GDPR. If the email contact is aimed at the conclusion of a contract, an additional legal basis for processing is provided by Art. 6 para. 1 sentence 1 (b) GDPR.

3. Purpose of data processing

The processing of the personal data from the input screen serves exclusively to handle the contact thus initiated. If contact is established by email, the necessary legitimate interest in the processing of the data also derives from such handling. The other personal data processed upon submission serve to prevent abuse of the contact form and to ensure the security of our IT systems.

4. Duration of storage

The data will be erased as soon as they are no longer required for the achievement of the purpose of their collection. For the personal data from the contact form input screen and for personal data transmitted by email, this is the case once the given conversation with the user has been ended. The conversation is considered to have been ended once it can be inferred from the circumstances that the matter in question has been clarified with final effect.

The additional personal data collected during the submission process are erased after a maximum of seven days.

5. Option of objection and elimination

The user has the option to revoke his consent to the processing of personal data at any time. If the user establishes contact with us by email, he may object to his personal data being saved at any time. In such a case, the conversation cannot be continued. All personal data that were saved in the course of the contact will be erased in this case.

VIII. Use of Facebook plug-in

1. Scope of the processing of personal data

We use the Plug-In of Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025 United States resp. if you are resident in the EU, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. By activating this plug-in, your browser connects to Facebook servers. This way, Facebook learns that you access our website from your IP address. In addition, Facebook receives information about the date, time, browser type and version, operating system and version as well as any Facebook cookies already stored in your browser. Facebook can use this information to detect which webpages with Facebook content you have visited.

The plug-in is part of Facebook and is always merely displayed on our site. Every interaction with the plug-in is an interaction on "facebook.com".
If you are logged in to Facebook, your Facebook login number will be transmitted as well when the plug-in is activated. Your visit to our website can be connected to your Facebook account in this way. Depending on the settings of your Facebook account, your click on the plug-in will also be published on Facebook. You can avoid that by logging out of your Facebook account before activating the plug-in and deleting all Facebook cookies after visiting websites with Facebook plug-ins.

2. Legal basis for the processing of personal data

The legal basis for the processing is provided by Art. 6 para. 1 sentence 1 (a) GDPR.

3. Purpose of data processing

Facebook processes these data in order to detect errors in its own system, to improve its own products and to adapt them to user behavior, and for verification, placement and customization of advertisements. In addition, the processing serves purposes of localization, tracking the way in which websites with Facebook content are used, and market research.

4. Duration of storage

Facebook stores data according to its own data up to 90 days. Thereafter, the data will continue to be used only in anonymous form.

5. Option of objection and elimination

Further information on data usage and collection can be found in the Facebook privacy policy at: facebook.com/about/privacy/.

IX. Use of Google AdSense

1. Scope of the processing of personal data

On our website, we use Google AdSense by Google Inc., 1600 Amphiteatre Parkway, Mountain View, CA 94043, United States. We run advertisements using this service. As part of this, cookies from Google or third parties may be saved on your computer. The information contained in the cookies may be collected and evaluated by Google and third parties. In addition, simple actions, including visitor traffic, may be collected and evaluated using small invisible graphics. The data processed by Google are transmitted to a server in the United States and stored there.

2. Legal basis for the processing of personal data

The legal basis for the processing is provided by Art. 6 para. 1 sentence 1 (f) GDPR.

3. Purpose of data processing

Google evaluates the data in order to help them understand your behavior from the point of view of the AdSense advertisements. The data may also be passed on to third parties if there is a legal obligation to do so or if the data are processed on Google's behalf.

4. Duration of storage

Advertising data in server logs are anonymized by Google by deleting parts of the IP address and cookie information after 9 and 18 months, respectively.

5. Option of objection and elimination

You can prevent the processing of your data by Google AdSense by disabling cookies in your browser. If so, it is possible that you will no longer be able to use our website to the full extent.

You can also object to the use of cookies by Google at the following link: www.google.de/settings/ads. You can find more information at www.google.com/intl/de/policies/privacy/.

X. Use of Google AdWords

1 Scope of the processing of personal data

On our website, we use Google AdWords by Google Inc., 1600 Amphiteatre Parkway, Mountain View, CA 94043, United States. This is an online advertising program that uses conversion tracking. If you reach our website via a Google ad, Google AdWords serves a cookie on your computer. Each Google AdWords customer is served a different cookie.

2. Legal basis for the processing of personal data

The legal basis for the processing is provided by Art. 6 para. 1 sentence 1 (f) GDPR.

3. Purpose of data processing

We only receive information about the total number of users who responded to our ad. No information is passed on that would allow us to identify you. The use does not serve tracking purposes.

4. Duration of storage

The cookie's validity expires after 30 days.

5. Option of objection and elimination

You can disable Google conversion tracking by turning off tracking in your browser. You can find more information at www.google.com/intl/de/policies/privacy/.

XI. Use of Google Maps plug-in

1 Scope of the processing of personal data

On our website, we use Google Maps by Google Inc., 1600 Amphiteatre Parkway, Mountain View, CA 94043, United States. The use of Google Maps on our website means that information about how our website is used, your IP address and (for the Directions feature) the addresses entered will be transmitted to a Google server in the United States and saved there. By using our website, you agree to the processing of your data collected by Google Maps.

2. Legal basis for the processing of personal data

The legal basis for the processing is provided by Art. 6 para. 1 sentence 1 (f) GDPR.

3. Purpose of data processing

We are neither aware of the purpose of data collection nor of the use of the data by Google.

4. Duration of storage

We are not aware of the duration of storage.

5. Option of objection and elimination

You can find more information at www.google.com/intl/de/policies/privacy/.

 

This Privacy Policy was created with the assistance of DataGuard.