Privacy Policy

HSK Your shower specialist partner

We are very pleased that you are interested in our Company. Data protection is particularly important to the management of HSK Duschkabinenbau AG. You will not have to submit any personal data when visiting the website of HSK Duschkabinenbau AG. If a visitor to our website should wish to avail himself of specific services offered by our Company, it is possible that personal data may have to be processed. If it is necessary to process personal data and if there is no legal basis for processing such data, we shall generally obtain the consent of the person concerned.

Personal data, for example, the name, address, e-mail address or telephone number of the person affected shall always be processed in accordance with General Data Processing Regulations and in compliance with the national data protection regulations in force applicable for HSK Duschkabinenbau AG. The objective of our Company’s data protection statement is to inform the public of the type, scope and purpose of the personal data collected, used and processed by us. Moreover, this data protection statement explains to the persons affected their rights.

HSK Duschkabinenbau AG has implemented a large number of technical and organisational measures for the body or persons responsible for processing with the aim of ensuring seamless protection for the personal data processed through this web site. Nevertheless, internal-based data transfers can, as a rule, have security vulnerabilities, so that total security cannot be guaranteed. For this reason every person affected is at liberty to pass over personal data by other means as well, over the telephone for example.

1. Definition of terms

The HSK Duschkabinenbau AG data protection statement is based on the concepts used by the European directives committee and legislature when the General Data Protection Regulations [GDPR] were promulgated. Our data protection statement has been drafted so that it is easy to read and understand not only for the general public, but also for our customers and business partners. To ensure this, we would like to begin by explaining the concepts used.

In this data protection statement we use, inter alia, the following terms:

Personal data

Personal data is all information which makes reference to an identified or identifiable natural person (hereinafter known as person affected). By identifiable is regarded a natural person who can be identified directly or indirectly, in particular, by means of allocation of an identifier such as a name, identification number, location data, online identifier or to one or more specific features expressing a physical, physiological, genetic, economic, cultural or social identity of this natural person.

Person concerned

A person affected is every identified or identifiable natural person whose personal data is processed by the person responsible for processing.

Processing

Processing is every procedure carried out or every such sequence of procedures in connection with personal data such as collection, capture, organisation, ordering, saving, amendment or modification, data retrieval, enquiry, use, disclosure through transmission, dissemination or another form of supplying data, or adjustment or providing links, restriction or deletion or destruction with or without the assistance of automation.

Restriction of processing

Restriction of processing means marking saved personal data with the aim of restricting its future processing.

Profiling

Profiling is every type of automated personal data processing, the objective of which is for this personal data to be used to assess specific personal aspects relating to a natural person. in particular to analyse or to forecast aspects regarding work performance, financial status, health, personal preferences, interests, reliability, conduct place of residence or change in residence of this natural person.

Anonymisation

Anonymisation is the processing of personal data in such a way so that the personal data can no longer be ascribed to a specific person affected without reference to further information, provided that this additional information is stored separately and is subject to technical and organisational measures ensuring that the personal data cannot be ascribed to an identified or identifiable natural person.

Body or Person responsible for processing

The person responsible for processing may be a natural person or legal entity, authority, organisation or other body, which decides inter alia on the processing objectives and methods alone or jointly with others. If the processing objectives and methods have been laid down by EU law or by the law of the member states, the body/person responsible or the specific criteria of its/ his appointment will be provided for in accordance with EU law or the law of the member states.

Order processor

The order processor may be a natural person or a legal entity, authority, organisation or other body processing the personal data on behalf of the responsible person / body.

Recipient

The recipient may be a natural person or a legal entity, authority, organisation or other body to whom / which the personal data is disclosed, regardless of whether this is a third party or otherwise. Authorities possibly receiving personal data as part of a specific analysis contract in accordance with the law of the EU or of the member states shall not, however, be regarded as recipients.

Third parties

A third party may be a natural person or a legal entity, authority, organisation or other body other than the person affected, the person/body responsible, the order processor and persons authorised in the direct responsibility of the person/body responsible or the order processor to process the personal data.

Consent

Consent is every informed and unmistakable declaration of intent submitted voluntarily by the person affected for a specific case in the form of a declaration or other clear confirmatory act in which the person affected gives to understand that he agrees to the personal data relating to him being processed.

2. Name and Address of the body responsible for processing

Within the meaning of the General Data Processing Regulations, other data protection laws in force in the member states of the European Union and other regulations concerning data protection, the body responsible is

HSK Duschkabinenbau KG
Zum Hohlen Morgen 22
59939 Olsberg
Germany

Tel.: +49 2962 97903-0
E-Mail: info@hsk-duschkabinenbau.de
Website: www.hsk.de

3. Contact details of the Data Protection Officer

The data protection officer of the body responsible for processing may be contacted on:

Tel.: +49 2962 979031130
E-Mail: datenschutz@hsk-duschkabinenbau.de
Every person affected may contact our data protection officer at any time with data protection related queries and suggestions.

4. Cookies

The HSK Duschkabinenbau KG webpages use cookies. Cookies are text files which are deposited and stored via a web browser on a computer system.

A large number of webpages and servers use cookies. Many cookies contain a so-called Cookie-ID. A Cookie ID is a clear identification of the cookie. It consists of a string which can specifically identify web pages and server to the specific internet browser, in which the cookie has been stored. This makes it possible to distinguish the visited web pages and servers and the individual browser of the person affected from other internet browsers containing other cookies. A specific web browser can be recognised and identified by means of the clear cookie ID.

The use of cookies enables HSK Duschkabinenbau KG to allow visitors to avail themselves of user-friendly services which would not be possible without cookie settings.

The use of cookies enables information and offers on our website to be optimised for the user’s benefit. As already mentioned, cookies enable us to recognise the visitors to our website. The objective of recognition is to make it easier for visitors to use our webpages. The visitors to a website using cookies will not, for example, have to enter his access data again every time he visits the website. And the cookie deposited on the visitor’s computer system will be applied. Another example is the cookie of a shopping basket in the online shop. The online shop makes a note of all the items which a customer has put into the virtual shopping basket by using a cookie.

The person affected may block a cookie setting by using our website at any time by using the corresponding setting on the web browser used, and in doing so block cookies permanently. Moreover, cookies already set can be deleted at any time by means of web browser or other software programmes. This is possible in all common web browsers. If the person affected deactivates set cookies in the web browser used, it may prevent the full use of some functions on our website.

5. Capture of general data and information

Every time its website is visited by the person affected or by an automated system, HSK Duschkabinenbau KG captures a series of data and information. This general data and information is saved in the server’s log file. The following can be captured:

1. Browser models and versions used
2. The operating system used by the accessing system
3. The website from which the accessing system arrives at our website (so-called referrer).
4. The sub website, which can be navigated to by an accessing system on our website.
5. The date and time of access to the website.
6. An internet protocol address (IP address)
7. The internet service provider of the accessing system and
8. Other similar data and information for security purposes in the event of attacks on our information technology systems.

When using this general data and information HSK Duschkabinenbau KG shall not be able to identify the person concerned. This information is needed instead to

1. Supply the content of our webpage correctly
2. To optimise the content of our website plus advertising for this
3. To ensure that our IT systems function properly on a permanent basis and our website technology works.
4. To provide law enforcement agencies with the information necessary to prosecute criminal offences in the event of a cyber attack.

This data and information collected in anonymous format will therefore be analysed by HSK Duschkabinenbau KG for statistical purposes and in addition to this with the aim of enhancing data protection and data security in our Company. In order, in the final analysis, to ensure the best possible protection for the personal data processed by us, the anonymous data on the server log files will be saved separately from all personal data provided by a person concerned.

6. Registration on our website

The person affected has the option of registering on the website of the body responsible for processing by entering personal data. The respective input mask used for registration shows which personal data will be forwarded for processing. The personal data entered by the person affected will only be collected and saved for internal use by the body responsible for processing for internal purposes. The body responsible for processing may then arrange for the information to be sent to one or more order processors, for example a package service provider which likewise will only use the personal data internally attributable to the responsible body’s processing.

By registering on the website of the body responsible for processing the IP address given by the ISP of the person affected the data and time of registration will be saved. This data will be saved against the background that only by doing so can the misuse of our services be prevented, and this data makes it possible to clear up criminal acts committed. Given this, it is necessary to save this data for the safety of the body responsible for processing. As a matter of principle this data will not be forwarded to third parties, provided that there is not a statutory obligation to hand it over, or if it has to be handed over for the purposes of prosecution.

The registration by the person affected volunteering personal data helps the body responsible for processing to offer the person affected content or services which given the nature of the thing, can only be offered to registered users. Registered persons have the option of amending the personal data entered at registration at any time, or to have all of it deleted from the data base of the body responsible for processing..

The body responsible for processing shall, upon request at any time, grant every person affected information about which personal data is saved on the person concerned. In addition to this, the body responsible for processing may amend or delete personal data at the request or instruction of the person affected provided that this is not in contravention of any statutory safekeeping periods. A data protection officer named in person in this data protection statement and all the employees of the body responsible for processing may be contacted by the person affected as a contact person in connection with this.

7. Order handling

We shall only use your personal data and information given by you when placing an order for internal purposes and within the Company instructed to handle orders. We work with various companies for order handling and they are responsible for handling payments and logistics. In doing so we ensure that our partners also comply with data protection regulations. Consequently we pass on your name and address to the respective company handling payment and logistics delivering the product you have ordered. The legal basis for this is Article 1 Paragraph 1 b) GDPR. Your personal data is required in the fulfilment of the contract with you.

8. Subscription to our Newsletter

On the HSK Duschkabinenbau KG website the visitor has the opportunity to subscribe to our newsletter. The input mask used for this shows which personal data is forwarded to the body responsible for processing when a newsletter is ordered.

HSK Duschkabinenbau KG informs its customers and business partners at regular intervals in its newsletter of its offers. Our newsletter may, as a matter of principle, be only be received by the person affected if

1. The person affected has a valid e-mail address.
2. The person affected registers for the newsletter to be sent out to him. A confirmation e- mail in the double opt-in procedure is used on the first occasion on which the person affected enters his e-mail address to receive a newsletter for legal reasons. The purpose of this confirmation e-mail is to check that the holder of the e-mail address as the person affected has authorised the receipt of the newsletter.

When subscribing to the newsletter, we also save the IP given by the ISP of the computer system of the person affected at the point in time of registration as well as the date and time of the subscription. This data has to be collected to be able to follow up any possible misuse of the e-mail address of a person affected subsequently and therefore provide the body responsible for processing with a legal safeguard.

The personal data collected in the course of subscribing for a newsletter is only used to send out a newsletter. In addition to this, newsletter subscribers may be informed by e- mail provided that this is necessary for operating the newsletter service or registration in connection with this, as could be the case in the event of changes in newsletter offers or technical modifications. The personal data collected as part of the newsletter service will not be passed on to third parties. Subscription to our newsletter may be cancelled at any time by the person concerned. The consent to the personal data being saved granted by the person affected to us for sending out newsletter may be revoked at any time. There will be a link in every newsletter for cancelling consent. In addition to this it will be possible to unsubscribe from the newsletter at any time directly on the website of the body responsible for processing or to inform the body responsible for processing by other means.

9. Newsletter dispatch via Clever Reach

This website uses Clever reach to dispatch newsletters. The supplier is CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede. CleverReach is a service with which the newsletter subscriptions can be organised and analysed. The data you have supplied (e.g. e-mail address) to have a newsletter sent out to you will be saved by the servers of CleverReach in Germany or Ireland.

The newsletter we send out with CleverReach enables us to analyse the behavioural patterns of the subscribers. This can be used, for example, to analyse how many subscribers have opened the newsletter and how often each link in the newsletter is clicked. With the assistance of the so-called conversion tracking we can also analyse whether after clicking on the link in the newsletter a pre-defined action (e.g. purchase of a product on our website) has occurred. You can obtain further information on data analysis by CleverReach at https://www.cleverreach.com/de/funktionen/reporting-und-tracking/

Data is processed on the basis of your consent (Article 6 Para 1 a GDPR). You may revoke your consent at any time and in doing so cancel your subscription to the newsletter. The legality of the data processing processes which have already taken place shall not be affected by revocation.

If you do not wish analysis to be carried out by CleverReach, you will have to cancel your newsletter subscription. There will be a link for this in every newsletter. Furthermore, you may also cancel your subscription directly on the website.

The data deposited by us for the purpose of you being sent the newsletter will be saved by us until you cancel your subscription and thereafter deleted not only by our servers, but also by the CleverReach servers. Data saved by us for other purposes (e.g. e-mail addresses for the members section) shall not be affected by this.

More detailed information is available in the CleverReach data protection regulations at https://www.cleverreach.com/de/datenschutz/

An order processing contract has been entered into with CleverReach.

10. Contact options through the website

In compliance with statutory regulations, the HSK Duschkabinenbau KG website includes information enabling rapid electronic contact to be made with our businesses as well as direct communication with us, which likewise covers a general address of the so-called electronic mail (e-mail address). Insofar as a person affected makes contact with the body responsible for processing by e-mail or via a contact form, the personal data sent in by the person affected will be saved automatically. Such personal data sent to the body responsible for processing on a voluntary basis will be saved for the purposes of processing or for making contact with the person concerned.

This personal data will not be handed over to third parties.

11. Routine deletion and blocking of personal data

The body responsible for processing shall only process and save the personal data of the person affected for the period of time necessary for achieving the objective for which the data has been saved or insofar as this has been provided for by the European directives committee and legislature or another legislative body in laws or regulations to which the body responsible for processing is subject.

If the purpose for which data has to be saved no longer applies, or if a period of time set by the European directives committee and legislature or prescribed by another responsible body has expired, the personal data will be blocked or deleted on a routine basis and in compliance with statutory regulations.

12. Rights of the person affected

Right of confirmation 

Every person affected has the right granted by the European directives committee and legislature to request confirmation from the body responsible for processing as to whether it will be processing personal data concerning him. If a person affected avails himself of this right of confirmation, he may contact our data protection officer or another employee of the body responsible for processing at any time to do so.

Right to information

Every person affected by the processing of personal data shall have the right granted by the European directives committee and legislature to receive information about the personal data saved about him and a copy of it from the body responsible for processing at any time free of charge. Moreover, the European directives committee and legislature has conceded the right to the person affected to information about the following:

• Purpose of processing
• The categories of personal data processed
• The recipients or categories of recipient to whom the personal data has been disclosed or to whom personal data is still to be disclosed. In particular recipients in countries other than Germany or international organisationsn
• If possible the planned period of time over which the personal data is to be saved or if this is not possible, the criteria for stipulating the said period of time
• The existence of the right to correction or deletion of the personal data concerning you or the right to have the scope of processing restricted by the body responsible for processing or a right of objection to processing.
• The existence of a right to lodge a complaint with a regulatory authority.
• If the personal data cannot be collected about the person affected: all available information about the origin of the data.
• The existence of an automated decision-making system including profiling in accordance with Article 22 Para 1 and 4 GDPR and – at least in these cases – meaningful information about the reasoning involved plus the scope and impact sought after of such processing for the person affected.

Right to correction 

Every person affected by the processing of personal data shall have the right granted by the European directives committee and legislature to request that relevant incorrect personal data is corrected immediately. Moreover, the person affected shall be entitled, taking into consideration the purpose of processing, to request that incomplete dat5a is completed even by means of a supplementary statement.

Should a person affected avail himself of this right to have a correction made, he may contact our data protection officer or another employee of the body responsible for processing at any time.

Right to deletion (Right to be forgotten)

Every person affected by the processing of personal data shall have the right granted by the European directives committee and legislature to request from the responsible body that the personal data concerned is deleted immediately provided that one of the following reasons applies and provided that processing is not necessary:

• The personal data was collected for such purposes or processed in such a way that it is no longer required.
• The person affected revokes his consent upon which processing is based in accordance with Article 6 Para 1 d GDPR or Article 9 Para 2 a GDPR, and there is a lack of another legal basis for processing.
• The person affected lodges an objection in accordance with Art 21 Para 1 GDPR to processing and there exist no higher ranking reasons for processing or the person affected lodges an objection to processing in accordance with Art 21 Para 2 GDPR.
• The personal data was processed unlawfully.
• Deletion of the personal data is necessary to fulfil a legal obligation in accordance with the European Union law or the law of the member states governing the body responsible.
• The personal data was collected in connection with the services offered by the information company in accordance with Art 8 Para 1 GDPR.

Right to restrict processing 

Every person affected by personal data processing shall have the right granted by the European directives committee and legislature to request that processing is restricted by the responsible body, if one of the following preconditions has been satisfied:

• The correctness of the personal data is contested by the person affected and, to be more precise, for a period of time enabling the responsible body to check whether the personal data is correct.
• The processing is unlawful, the person affected the rejects deletion of the personal data and instead demands that use of the personal data is restricted.
• The responsible body no longer needs the personal data for the purposes of processing, but the person affected needs it to assert, exercise, or mount a defence against legal claims.
• The person affected has lodged an objection to processing in accordance with Article 21 para 1 GDPR and it is not yet certain whether the justified reasons of the responsible body on the other hand prevail over those of the person affected.

Right to data transfer

Every person affected by personal data processing shall have the right granted by the European directives committee and legislature to request that he receives the relevant personal data which was provided by the person affected to a body responsible for processing in a structured and common machine-readable format. He shall, moreover, be entitled to send this data to another responsible body without hindrance by the body responsible to which the data was provided. Provided that processing is based upon consent in accordance with Article 6 Para 1 a GDPR or Article 9 Para 2a GDPR or on a contract in accordance with Article 6 Para 1 b GDPR and processing passed over to the responsible body is carried out with the aid of automated processes, provided that processing is not necessary for discharging a duty which is in the public interest or incites public violence.

Moreover, when exercising his right to data transfer in accordance with Article 20 Para 1 GDPR, the person affected has the right to have the personal data sent directly from one responsible body to another responsible body provided that this is technically feasible and provided that the rights and freedoms of other persons are not affected adversely.

The person affected may contact the data protection officer appointed by HSK Duschkabinenbau KG or another employee at any time to assert data transfer rights.

Right of objection 

Every person affected by the processing of personal data shall have the right granted by the European directives committee and legislature to lodge a complaint for reasons arising from his specific circumstances at any time against the processing of personal data concerning him, which occurs as a result of Article 6 Para 1 e or f GDPR. This shall also apply for profiling based upon these regulations.

HSK Duschkabinenbau KG shall stop processing in the event that an objection is lodged, unless we are able to prove compelling reasons meriting protection for processing and such reasons prevail over the rights and freedoms of the person affected, or processing serves to assert, exercise or mount a defence against legal claims.

If HSK Duschkabinenbau KG processes personal data for the purposes of direct advertising, the person affected shall have the right to raise an objection at any time to personal data being processed for the purposes of such advertising. This shall also apply for profiling, provided that it is connected with such direct advertising. If the person affected raises an objection with HSK Duschkabinenbau KG against processing for the purposes of direct advertising, HSK Duschkabinenbau KG shall stop processing personal data for these purposes.

Furthermore, the person affected has the right, for reasons arising from his specific circumstances, to lodge an objection to the personal data concerning him being processed for scientific or historical research purposes or statistical purposes by HSK Duschkabinenbau KG in accordance with Article 89 Para 1 GDPR, unless such processing is necessary in the fulfilment of a task being carried out in the public interest.

To exercise this right of objection the person affected my contact the data protection officer at HSK Duschkabinenbau KG or another employee directly, The person affected, shall, moreover, be at liberty to exercise his right of objection in connection with the use of services of the information company, irrespective of the Directive 2002/58/EG, by means of an automated procedure, in which technical specifications are used.

Automated decisions in given cases including profiling

Every person affected by the processing of personal data shall have the right granted by the European directives committee and legislature not to be exclusively subject to a decision based on automated processing, including profiling, which develops legal effect against him or which could have considerable adverse impact on him provided that the decision (1) is not necessary for a contract to be entered into or fulfilled between the person affected and the body responsible, or (2) as a result of European Union legal regulations, or those of the member states, to which the body responsible is subject, the decision is permissible and these legal regulations contain appropriate measures for protecting the rights and freedoms as well as the justified interests of the person affected, or (3) takes place with the express consent of the person affected.

If the decision (1) is necessary for entering into or for fulfilling a contract between the person affected and the responsible body, or (2) it is made with the express consent of the person affected, HSK Duschkabinenbau KG shall take appropriate measures to protect the rights and freedoms as well as the justified interest of the person affected: this shall also include as a minimum the right of the body responsible to have a person present its own position and to contest the decision.

Should the person affected assert rights relating to automated decisions, he may contact our data protection officer or another employee of the body responsible for processing at any time..

Right to revoke consent granted under data protection law 

Every person affected by data being processed shall have the right granted by the European directives committee and legislature to revoke at any time his consent to his personal data being processed.

If the person affected wishes to assert his right to revoke consent, he may contact our data protection officer or another employee of the body responsible for processing at any time to do so.

13. Data protection for job applications and in the job application procedure

The body responsible for processing shall collect and process the personal data of applicants for the purposes of handling the application procedure. Processing may also be carried out electronically. This is in particular the case if an applicant sends in his application documents by electronic means for example by e-mail or via the web form on our website, to the responsible body.

If the body responsible for processing enters into an employment contract with an applicant, the data sent in for the purposes of handling the job will be saved in compliance with the statutory regulations. If an employment contract is not entered into by the body responsible for processing with the applicant, the application documents shall consequently be automatically deleted two months after announcing the rejection, provided that deletion is not contrary to the justified interests of the body responsible for processing. For this purpose, other justified interests are, for example, a legal obligation to furnish proof in proceedings in accordance with the German Equal Treatment Act [AGG].

14. Data Protection Regulations governing the input and use of Facebook

The body responsible for processing has integrated components of the Facebook company on this website. Facebook is a social network.

A social network is a social meeting place operated in the internet, an online community enabling users as a rule to communicate with one another and to interact in virtual space. A social network may serve as a platform for exchanging opinions and experiences or makes it possible for the internet community to provide personal or company-related information. Facebook makes it possible for users of the social network inter alia to produce private profiles to upload photographs and to network via friendship requests.

The operating company of Facebook is Facebook Inc. 1 Hacker Way, Menlo Park, CA 94025 USA. If a person affected lives outside the USA or Canada, the body responsible for processing personal data is Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

The web browser information technology system of the person affected will automatically be prompted by the respective Facebook components to download a presentation of the corresponding Facebook components from Facebook every time one of the webpages of this website, which is operated by the body responsible for processing, is downloaded and on which a Facebook component (Facebook plug-in) has been integrated. An overall summary of all Facebook plug-ins can be downloaded from https://developers.facebook.com/docs/plugins/?locale-de

SAs part of this technical procedure Facebook will become aware of which actual subsites in our website are visited by the person affected.

Provided that the person affected is logged into Facebook at the same time, Facebook will recognise our website every time it is downloaded by the person affected and for the whole duration of the of the respective visit to our website which actual webpages on our website are visited by the person affected. This information will be collected by the Facebook components and allocated by Facebook to the respective Facebook account of the person affected. If the person affected confirms one of the Facebook buttons integrated on our website, for example the “I like it” button, or if the person affected submits a comment, Facebook will allocate this information to the personal Facebook user account of the person affected and will save this personal data.

Facebook will always receive information about whether the person affected has visited our website via the Facebook components, if the person affected at the point in time of visiting our website has logged in to Facebook at the same time. This will happen regardless of whether the person affected clicks on the Facebook component or not. If it is not wished by the person affected that information should be sent to Facebook in this manner, he can prevent the information from being sent by logging off from his Facebook account prior to visiting our website.

The data policy published by Facebook which can be downloaded from https:/de-de.facebook.com/about/privacy/ provides information about the collection, processing and use of personal data by Facebook. Moreover, it explains which setting options Facebook provides for protecting the Privacy of the person affected. In addition to this, various applications are available enabling you to suppress data transfer to Facebook. Such applications may be used by the person affected to suppress data transfer to Facebook.

15. Data Protection Regulations governing the input and use of Instagram

The body responsible for processing has integrated components of the Instagram service on this website. Instagram is a service which is to be qualified as an audio-visual platform and enables the users to share photographs and videos and in addition to this, to distribute such data in other social networks..

The operating company of Instagram services is Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA USA.

As a result of every visit to the individual web pages of this web site operated by the body responsible for processing and on which an Instagram component (Insta-button) has been integrated, the web browser on the IT system of the person affected will automatically be prompted by the respective Instagram components to download the corresponding components of Instagram. In the course of this technical procedure Instagram will receive information about which specific subsites in our website are being visited by the person affected.

Provided that the person affected is logged in to Instagram at the same time, Instagram recognises on the occasion of every visit to our website by the person affected and for the duration of the entire viewing on our website which actual subsites the person affected visits. This information is collected by the Instagram components and allocated by Instagram to the respective Instagram account of the person affected.

If the person affected confirms one of the Instagram buttons integrated on our website, the information and information transferred with it will be allocated to the personal Instagram user account of the person affected and saved by Instagram.

Instagram will always receive information via the Instagram components that the person affected has visited our website, if the person affected at the point in time of visiting the website is logged into Instagram at the same time. This will happen regardless of whether the person affected clicks on the Instagram components or not. If the person affected does not want the information to be transferred in this way to Instagram, he can prevent the transfer of information by logging out of Instagram account prior to visiting our website.

Further information and the Instagram data protection regulations in force may be downloaded from https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/

16. Google Maps

On this website we use Google Maps (provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). This enables maps to be shown with an interactive facility in the website as well as making it easy to use the map function including the production of route maps. For these purposes we also have a justified interest in data processing in accordance with Article 6 Para 1 f GDPR.

When the website is visited Google receives information that you have visited corresponding subsites in our website. In addition to this, the data named under III.1 of this statement will be transferred. This will occur regardless of whether Google sets up a user account through which you are logged in. If you are logged in to Google your data will be allocated directly to your account. If you do not wish the allocation to your profile at Google, you will have to log out prior to activating the button. Google will save your data as a usage profile and will use it for the purposes of advertising, market research and/or designing its website as required. This type of analysis will be carried out in particular (even for users who are not logged in) to deliver appropriate advertising and in order to inform other users of the social network of its activities on our website. You are entitled to a right of objection against the creation of this user profile, whereby you will have to exercise this right against Google. You have the option of deactivating the Google Maps service: it is easy to do so. This will prevent data from being transferred to Google. To do so, you will have to deactivate JavaScript in your browser. We would, however, point out that in this case you will not be able to show maps..

You can find additional information on the purpose and scope of data collection and processing in the providers data protection statements. There you will also have further information about your rights with regard to this and setting options to protect your privacy. https://www.google.de/intl/de/policies/privacy

17. Matomo

On this website, data is collected and stored using the web analysis service software Matomo (https://matomo.org/), a service of the provider InnoCraft Ltd (Matomo), InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, on the basis of our legitimate interest in the statistical analysis of user behaviour for optimisation purposes pursuant to Art. 6 (1) lit. f DSGVO. Pseudonymised user profiles can be created and evaluated from this data for the same purpose. Cookies can be used for this purpose. Cookies are small text files that are stored locally in the cache of the site visitor's internet browser. Among other things, the cookies enable the recognition of the internet browser. The data collected using Matomo technology (including your pseudonymised IP address) is processed on our servers.

The information generated by the cookie in the pseudonymous user profile is not used to personally identify the visitor to this website and is not merged with personal data about the bearer of the pseudonym.

Possibilities of objection

If you do not agree to the storage and evaluation of this data from your visit, you can object to its storage and use at any time by clicking on the following link. In this case, a so-called opt-out cookie will be stored in your browser, which means that Matomo will not collect any session data. Please note that if you delete your cookies completely, the opt-out cookie will also be deleted and you may have to reactivate it.

Furthermore, you can activate the Do-Not-Track or Do Not Follow setting in your browser. As long as this setting is active, no session data will be collected. Please note that the Do-Not-Track instruction usually only applies to the one device and the one browser in which you have activated the setting.

18. Userlike (Live-Chat)

On our website we use Userlike chat from the firm Userlike UG, Deisterweg 7, D- 51109 Cologne (hereinafter known as userlike), to enable you to make contact by means of live chat. Userlike uses cookies when rendering its service. The information generated by the cookie is sent to the Userlike server. In the course of this the following data will be processed:

• Date and time of the call
• Browser model / version
• Operating system used
• URL of the website visited beforehand and the volume of data transferred

We process this data on the basis of our prevailing interest in the optimal processing of our online offer in accordance with Article 6 Para 1 f GDPR. You may also prevent data from being collected by setting your browser software accordingly. Further information on data protection at Userlike can be found at https://www.userlike.com/de/terms#privacy

19. Google ReCaptcha

We use Google reCAPTCHA (hereinafter known as reCAPTCHA) von our website. The provider is Google Inc. 1600 Ampitheater Parkway, Mountain View, CA 94043 USA (Google)

The aim of reCAPTCHA is to review whether the data input on our websites (e.g. in a contact form) has been entered by a person or by an automated programme. To this end reCAPTCHA analyses the conduct of the website visitor on the basis of various characteristics. This analysis begins automatically, as soon as the website visitor enters the website. To conduct the analysis reCAPTCHA uses various information (e.g. IP address, duration of visit to the website, or mouse movements made by the user). The data logged by the analysis will be forwarded to Google.

The reCAPTCHA analyses run completely in the background. The website visitors are not made aware that an analysis is being conducted. Data is processed on the basis of Article 6 Para 1 f GDPR. The website operator has a justified interest in protecting his site offers from misuse by automatic spying and from SPAM.

Further information about Google reCAPTCHA as well as the Google data protection statement is available at www.google.com/intl/de/policies/privacy/ and www.google.com/recaptcha/intro/android.html.

20. Data Protection Regulations governing the input and use of YouTube

The body responsible for processing has integrated YouTube components on this website. YouTube is an internet video portal enabling video publishers to put in video clips free of charge and allowing other users to watch them, assess them and comment on them free of charge. YouTube allows all types of videos to be published which is why not only complete films and television broadcasts but also music videos, trailers or videos made by the users themselves may be downloaded from the internet portal.

The operating company of YouTube is YouTube llc, 901 Cherry Ave, San Bruno, ca, 94066 USA. YouTube LLC is a subsidiary of Google Inc, 1600 Ampitheatre Parkway, Mountain View, CA 94043 USA.

Every time one of the individual web pages on this website is called up which is operated by the body responsible for publishing, and on which a YouTube component (YouTube-Video) has been integrated, the web browser on the IT system of the person affected will automatically be prompted by the respective YouTube component to download the corresponding presentation of the YouTube components from YouTube. Additional information about YouTube may be downloaded from https://www.youtube.com/yt/about/de As part of this technical procedure YouTube and Google will obtain knowledge about which actual subsites of our website are visited by the person affected.

If the person affected is logged in to YouTube at the same time, YouTube will recognise when a subsite on which there is a YouTube video is called up which actual subsites of our website the person affected is visiting. This information is collected by YouTube and Google and allocated to the respective YouTube account of the person affected.

YouTube and Google will always receive information about the person affected visiting our website if the person affected at the point in time of the visit to our website is at the same time logged in to YouTube. This will occur regardless of whether the person affected clicks on a YouTube video or not. If such a transfer of this information to YouTube and Google is not desired by the person affected, this can be prevented by you logging off from your YouTube account prior to visiting our website.

The data protection regulations published by YouTube which can be downloaded from https://www.google.de/ntl/de/policies/privacy provide information on the collection, processing and use of personal data by YouTube and Google.

21. Legal basis of processing

Article 6 I a GDPR serves as a legal basis for our Company for processing procedures in which we obtain consent for a specific processing objective. If personal data has to be processed to fulfil a contract, to which the contractual party is the person affected, such as, for example, the case for processing procedures necessary for the delivery of goods or services or rendering another service or counter service, processing will consequently be based upon Article 6 I b GDPR . The same shall apply for those processing procedures which are necessary for carrying out pre-contractual measures, for example, in cases of enquiries about our products or services. If our Company is subject to a legal obligation as a result of which processing of personal data is necessary, such as, for example, to fulfil tax obligations, processing shall be based on Article 6 I c GDPR. In rare cases processing could be necessary for personal data in order to protect vital interests of the person affected or another natural person. This would, for example be the case if a visitor to our Company was injured and then his name, age, health fund data or other vital information had to be handed over to a doctor, a hospital or other third party. Then processing would be based upon Article 6 I d GDPR. Finally, processing procedures could be based upon Article 6 I f GDPR. Processing procedures which are not covered by any of the above legal bases will be based upon this processing procedure if processing is necessary to protect a justified interest of our Company or third party, provided that the interests, basic rights and basic freedoms of the person affected do not prevail. We are allowed such processing procedures in particular because they have been specifically mentioned by the European legislative. Given this, it was of the opinion that a justified interest could be assumed if the affected person is a customer of the body responsible for processing (recital 47 Sentence 2 GDPR).

22. Justified interests in processing which are pursued by the body responsible for processing or a third party

If the processing of personal data is based upon Article 6 I f GDPR, our justified interest is the conducting our business activity in favour of all our employees and our shareholders.

23. Duration over which the personal data is saved

The criterion determining the length of time over which personal data has to be saved is the respective statutory safekeeping period. After this period of time has expired, the corresponding data is deleted on a routine basis, provided that it is no longer needed to fulfil the contract or set up a contract.

24. Statutory or contractual regulations governing the provision of personal data; Requirement for entering into a contract; Obligation of the person affected to provide personal data; possible consequences of not providing personal data.

We are explaining to you that the provision of personal data is in part a statutory requirement (e.g. tax regulations) or can also be stipulated by contractual terms (e.g. information about the party to the contract).Sometimes it may be necessary for entering into a contract that a person affected provides us with personal information, which subsequently has to be processed by us. The person affected is, for example, obliged to provide us with personal data if our Company enters into a contract with him. Failing to provide personal data would result in it not being possible to enter into a contract with the person affected. The person affected will have to contact our data protection officer prior to providing his personal data. Our data protection officer will explain to the person affected depending upon the given circumstances, whether the personal data is required by law or if it is a contractual requirement, and whether there is an obligation to provide personal data and what the consequences of failing to provide personal data would be.

25. Existence of an automated decision-making function

As a responsible Company, we will not use automated decision-making or profiling.