Privacy statement

 

1. Privacy policy at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data are all data that can be used to identify you personally. You will find detailed information on the topic of data protection in or privacy statement provided below this text.

 

Collection of data on this website

Who is responsible for collecting data on this website?

The data on this website are processed by the operator of the website. You will find the operator's contact data in this privacy statement in section "The responsible party".

 

How do we collect your data?

We collect your data as a result of your sharing your data with us. These data may, for example, be data that you enter in our contact form.

Our IT systems collect other data automatically or after you have given your consent when you visit the website. These are mostly data of a technical nature (e.g. Internet browser, operating system or time when the page is called). These data are collected automatically as soon as you enter this website.

 

What do we use your data for?

A portion of the data is collected to ensure error-free provision of the website. Other data can be used to analyze your user behavior patterns.

 

What rights do you have over your data?

You have the right to obtain information about the source, recipients and purpose of your stored personal data free of charge. You also have the right to demand that your data are rectified or erased. If you have given your consent to data processing, you can revoke your consent at any time in the future. You also have the right to demand restriction of processing of your personal data under certain circumstances. You are also entitled to submit a complaint to the competent supervisory authority.

 

You can contact us at any time about this and further questions relating to data privacy.

 

2. Hosting

We use the following provider to host the contents of our website:

 

External hosting

This website is hosted externally. The personal data that are collected on this website are stored on the servers of the hoster or hosters. These may mainly include, but are not limited to, IP addresses, contact requests, metadata and communications, contract information, contact information, names, website accesses and other data generated through a website.

 

External hosting is used for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 Sec. 1 Letter b GDPR) and in the interest of secure, fast and efficient provision of our online services by a professional provider (Art. 6 Sec. 1 Letter f GDPR). Provided that your consent has been obtained, processing is performed exclusively on the basis of Art. 6 Sec. 1 Letter a GDPR and § 25 Sec. 1 TTDSG, wherever consent encompasses storage of cookies or access to information on the user's device (e.g. device fingerprinting) as defined in TTDSG. You can revoke your consent at any time.

 

Our hoster(s) will only process your data to the extent necessary to fulfill its performance obligations and to follow our instructions with respect to such data.

 

We use the following hoster(s):

Telekom AG

 

3. General information and mandatory information

 

Privacy policy

The operators of these web pages take the protection of your personal data very seriously. We treat your personal data in confidence and in compliance with the statutory data protection regulations and this privacy statement.

 

Whenever you use this website, various personal data are collected. Personal data are data that can be used to identify you personally. This privacy statement explains which data we collect as well as what we use this data for. It also explains how, and for which purpose the information is collected.

 

We hereby advise you that the transmission of data via the Internet (e.g. via e-mail communications) may be subject to security holes. It is not possible to protect data completely against third party access.

 

The responsible party

The party responsible for data processing on this website is:

The responsible party is the natural person or legal entity that single-handedly or jointly with others makes decisions as to the purposes of and methods for processing of personal data (e.g. names, e-mail addresses, etc.).

 

Storage duration

Unless a more specific storage period has been specified in this privacy statement, your personal data will remain with us until the purpose for which it was collected no longer applies. If you assert a justified request for erasure or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g. tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.

 

General information on the legal basis for data processing on this website

Where you have given your consent for data processing, we process your personal data on the basis of Art. 6 Sec. 1 Letter a GDPR or Art. 9 Sec. 2 Letter a GDPR, wherever special categories of data according to Art. 9 Sec. 1 GDPR are processed. In case of express consent to the transmission of personal data to third countries, data processing is also performed on the basis of Art. 49 Sec. 1 Letter a GDPR. Where you have given your consent to storage of cookies or to access to information on your device (e.g. via device fingerprinting), data processing is performed additionally on the basis of § 25 Sec. 1 TTDSG. You can revoke your consent at any time. If your data are required for performance of a contract or performance of precontractual measures, we process your data on the basis of Art. 6 Sec. 1 Letter b GDPR. We also process your data where they are required to meet a legal obligation on the basis of Art. 6 Sec. 1 Letter c GDPR. The data processing can be performed furthermore on the basis of our legitimate interest according to Art. 6 Sec. 1 Letter f GDPR. Information about the applicable legal bases in each individual case is provided in the following sections of this privacy statement.

 

Data protection officer

We have appointed a data protection officer.

 

Note on data transfer to the USA and other third countries

Among others, we use tools from companies based in the USA or other third countries that are not secure in terms of data protection law. If these tools are active, your personal data may be transferred to these third countries and processed there. We would like to point out that no level of data protection comparable to that in the EU can be guaranteed in these countries. For example, U.S. companies are obligated to hand over personal data to security authorities without you as the data subject being able to take legal action against this. It can therefore not be excluded that U.S. authorities (e.g., intelligence services) for monitoring purposes process, evaluate and permanently store your data located on U.S. servers. We have no influence on these processing activities.

 

Withdrawal of consent for data processing

Many data processing operations are only possible with your express consent. You can revoke consent that you have given at any time. The lawfulness of the data processing performed until the revocation remains unaffected by the revocation.

 

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF DATA ARE PROCESSED ON THE BASIS OF ART. 6 SEC. 1 LETTER E OR F GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR GROUNDS ARISING FROM YOUR UNIQUE SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. TO DETERMINE THE LEGAL BASIS ON WHICH ANY PROCESSING OF DATA IS PERFORMED, PLEASE CONSULT THIS PRIVACY STATEMENT. IF YOU LODGE AN OBJECTION, WE WILL CEASE THE DATA PROCESSING UNLESS COMPELLING LEGITIMATE GROUNDS FOR THE CONTINUATION OF THE PROCESSING EXIST THAT OVERRIDE YOUR INTERESTS OR THE PROCESSING SERVES THE EXERCISE, DEFENSE OR ASSERTION OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21 SEC. 1 GDPR).

 

IF YOUR PERSONAL DATA ARE BEING PROCESSED IN ORDER TO ENGAGE IN DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR RELEVANT PERSONAL DATA FOR THE PURPOSES OF SUCH ADVERTISING; THIS ALSO APPLIES TO PROFILING WHEREVER IT IS CONNECTED TO SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSES OF DIRECT ADVERTISING (OBJECTION PURSUANT TO ART. 21 SEC. 2 GDPR).

 

Right to submit a complaint to the competent supervisory authority

In the event of violations of the GDPR, data subjects are entitled to lodge a complaint with a supervisory authority, in particular in the member state of their habitual domicile, place of work or at the place where the alleged violation occurred. The right to lodge a complaint remains regardless of any other administrative or judicial proceedings available as legal recourses.

 

Right to data transferability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another responsible party, this will only be done where it is technically feasible.

 

Information, rectification and erasure of data

Within the scope of the applicable statutory provisions, you have the right at any time to demand information about your stored personal data, their source and recipients as well as the purpose of the processing of your data, and, where applicable, also a right to have your data rectified or erased. If you have further questions about this or any other questions relating to personal data, you can contact us at any time.

 

Right to restriction of processing

You have the right to demand the restriction of the processing of your personal data. You can contact as at any time about this. The right to restriction of processing applies in the following cases:

 

If you dispute the accuracy of the personal data stored by us, we usually need some time to verify this. While this investigation is ongoing, you have the right to demand that we restrict the processing of your personal data.

If processing of your personal data is/was unlawful, you can demand restriction of processing instead of erasure of the data.

If we no longer need your personal data, but you still need the data to exercise, defend or enforce legal claims, you have the right to demand restriction of processing instead of erasure of the data.

If you have lodged an objection to processing pursuant to Art. 21 GDPR, your interests and our interests will have to be weighed up against each other. As long as it has not been determined whose interests prevail, you have the right to demand a restriction of the processing of your personal data.

If you have restricted the processing of your personal data, such data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural person or legal entity or for reasons of important public interest of the European Union or of a Member State.

 

SSL and/or TLS encryption

For security reasons and to protect the transmission of confidential content, such as purchase orders or inquiries that you submit to us, the website operator, this website uses either an SSL or a TLS encryption program. You can recognize an encrypted connection by checking whether the address line of the browser switches from "http://" to "https://" and also by the appearance of the lock icon in the browser line.

If SSL or TLS encryption is activated, data that you transmit to us cannot be read by third parties.

 

 

4. Collection of data on this website

Cookies

Our website uses so-called "cookies". Cookies are small data packages and do not cause any damage to your device. They are either stored on your device temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are deleted automatically at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or they are automatically deleted by your web browser.

In some cases, cookies from third-party companies can also be stored on your device if you enter our website (third-party cookies). These enable us and you to use certain services of third-party companies (e.g. cookies for processing payment services).

Cookies have various functions. Many cookies are technically necessary because certain website functions would not work without them (e.g. the shopping cart function or display of videos). Other cookies are used to analyze the user's behavior or to display advertising.

Cookies that are required to perform the electronic communication function, to provide certain functions that you require (e.g. the shopping cart function) or to optimize the website (e.g. cookies for measuring visitor numbers) (necessary cookies) are stored on the basis of Art. 6 Sec. 1 Letter f GDPR where no other legal basis is stated. The operator of the website has a legitimate interest in storing necessary cookies for the technically error-free and optimized provision of its services. Where consent to the storage of cookies and comparable recognition technologies has been obtained, processing is performed exclusively on the basis of this consent (Art. 6 Sec. 1 Letter a GDPR and § 25 Sec. 1 TTDSG); the consent can be revoked at any time.

You can set your browser in such a way that you are informed about cookie setting and only allow cookies on an individual basis, accept cookies in certain cases or reject all cookies and activate automatic deletion of cookies when the browser is closed. If you do not accept cookies, the functionality of this website may be restricted.

Where cookies are used by third-party companies or for analytics purposes, we will inform you about this specially in this privacy statement and ask for your consent where applicable.

 

Consent with Cookie Notice & Compliance

Our website uses the consent technology of Cookie Notice & Compliance for GDPR to obtain your consent to storing certain cookies on your device or for the use of certain technologies and to document these in compliance with data protection.

Cookie Notice & Compliance for GDPR is installed locally on our servers so that no connection is established to the servers or third parties. Cookie Notice & Compliance for GDPR stores a cookie in your browser to enable you to allocate the consents you have given and revocations thereof. The cookie remains active for 1 month. Otherwise, your data are stored until you request us to erase them, delete the consent cookie yourself or the purpose of the data processing no longer applies. Mandatory statutory retention obligations are unaffected by this.

Cookie Notice & Compliance for GDPR is used to obtain the consents for the use of cookies prescribed by law. The legal basis for his is Art. 6 Sec. 1 Letter c GDPR.

 

Server log files

The provider of this website automatically collects and stores information in so-called server log files, which your browser communicates to us automatically. This information comprises:

 

Type and version of browser

The operating system used

Referrer URL

Hostname of the server inquiry

Time of the server inquiry

IP address

This data is not merged with other data sources.

 

This data is collected on the basis of Art. 6 Sec. 1 Letter f GDPR. The operator of the website has a legitimate interest in the technically error-free display and the optimization of its website, for which purpose server log files must be collected.

 

5. Plug-ins and tools

Google Maps

This page uses the mapping service of Google Maps. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

To enable the use of the Google Maps features, your IP address must be stored. As a rule, this information is transferred to one of Google's servers in the USA, where it is stored. The operator of this website has no control over this data transfer. When Google Maps is activated, Google can be used for standardized display of the Google Fonts. When Google Maps is called, your browser downloads the necessary web fonts into your browser cache to display texts and fonts.

We use Google Maps to present our online content in an appealing manner and to make the locations stated on our website easy to find. This constitutes a legitimate interest as defined in Art. 6 Sec. 1 Letter f GDPR. Provided that your consent has been obtained, processing is performed exclusively on the basis of Art. 6 Sec. 1 Letter a GDPR and § 25 Sec. 1 TTDSG, wherever consent encompasses storage of cookies or access to information on the user's device (e.g. device fingerprinting) as defined in TTDSG. You can revoke your consent at any time.

The transfer of data to the USA is based on standard contract clauses of the EU Commission. You will find details here: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

You will find more information on handling user data in Google's privacy statement: https://policies.google.com/privacy?hl=de.

 

6. Own services

Whistleblower Reporting System

The German Bundestag implemented the European Union's Whistleblower Protection Directive into German law. This EU whistleblower directive requires companies to set up secure channels for reporting irregularities from July 2023. Precautions must also be taken to protect whistleblowers from disciplinary or professional disadvantages such as warnings, denial of a promotion or bullying of whistleblowers.

For this reason, we offer a structured framework for reporting possible irregularities and give you the opportunity to report violations using different and secure internal communication channels. Below you will find all the essential information.

How can a violation be reported?

Betroffenenrechte Hinweisgebermeldeportal

As a data subject, you have the right to:

Information – You have the right to access the personal data stored about you. The identity of the whistleblower is generally excluded from this right to information. If the exercise of this right jeopardizes the clarification of the facts or the securing of necessary evidence, Wartenfelser GmbH & Co. KG is only permitted to comply with the right at a later date.

Correction - If the legal requirements are met, you also have the right to have incorrect data corrected or changed. A corresponding adjustment will be made immediately after checking.

Deletion - In accordance with Article 17 Paragraph 1 DSGVO, you have the right to have us delete the personal data collected about you if

• the data is either no longer needed;
• due to the revocation of your consent, the legal basis for processing no longer exists without replacement;
• you have objected to the processing and there are no legitimate grounds for the processing;
• your data is processed unlawfully;
• a legal obligation requires this or a survey has taken place in accordance with Art. 8 Para. 1 GDPR.

 

According to Art. 17 Para. 3 DSGVO, the right does not exist if

• the processing is necessary to exercise the right to freedom of expression and information;
• Your data has been collected on the basis of a legal obligation;
• the processing is necessary for reasons of public interest;
• the data is necessary to assert, exercise or defend legal claims.

 

Right to withdraw

If you have given us express consent to process your personal data (Art. 6 Para. 1 lit. a DSGVO or Art. 9 Para. 2 lit. a GDPR), you can revoke this at any time. Please note that this does not affect the lawfulness of processing based on consent until its revocation.

 

Right to object

In accordance with Article 21 of the DSGVO, you have the right to object at any time to the processing of personal data concerning you that has been collected on the basis of Article 6 (1) (f) (within the context of a legitimate interest). You only have this right if special circumstances speak against storage and processing.

 

Right to data portability

We will transfer the personal data directly to a person responsible for your request, as long as this is technically feasible. Please note that we are not allowed to transfer data that interferes with the freedoms and rights of other people in accordance with Article 20 (4) DSGVO.

 

Handling data from job applications

We offer you the opportunity to submit job applications to us (e.g. via email, via postal services or by submitting the online job application form). Below, we will brief you on the scope, purpose and use of the personal data collected from you as part of the application process. We assure you that the collection, processing and use of your data will occur in compliance with the applicable data privacy rights and all other statutory provisions and that your data will always be treated as strictly confidential.

 

Scope and purpose of the collection of data

If you submit a job application to us, we will process any connected personal data (e.g. contact and communication data, application documents, notes taken during job interviews, etc.) if they are required to make a decision concerning the establishment of an employment relationship. The legal grounds for this are § 26 BDSG according to German Law (Negotiation of an Employment Relationship), Art. 6 Sec. 1 Letter b GDPR (General Contract Negotiations) and – provided you have given us your consent – Art. 6 Sec. 1 Letter a GDPR. You can revoke your consent at any time. Within our company, your personal data will only be shared with individuals who are involved in the processing of your job application.

 

If your job application results in your recruitment, the data you have submitted will be archived on the basis of § 26 BDSG and Art. 6 Sec. 1 Letter b GDPR for the purpose of implementing the employment relationship in our data processing system.

 

Data archiving period

If we are unable to make you a job offer or you reject a job offer or withdraw your application, we reserve the right to retain the data you have submitted on the basis of our legitimate interests (Art. 6 Sec. 1 Letter f GDPR) for up to 6 months from the end of the application procedure (rejection or withdrawal of the application). Afterward the data will be deleted, and the physical application documents will be destroyed. Retention serves, in particular, to provide evidence in the event of a legal dispute. If it is evident that the data will be required after the expiry of the 6-month period (e.g. due to an impending or pending legal dispute), deletion will only take place when the purpose of further storage no longer applies.

Longer storage may also occur if you have given your consent (Art. 6 Sec. 1 Letter a GDPR) or if statutory data retention requirements preclude the deletion.

 

Admission to the applicant pool

If we do not make you a job offer, you may be able to join our applicant pool. In case of admission, all documents and information from the application will be transferred to the applicant pool in order to contact you in case of suitable vacancies.

Admission to the applicant pool is based exclusively on your express consent (Art. 6 Sec. 1 Letter a GDPR). The submission of consent is voluntary and has no relation to the ongoing application procedure. The data subject can revoke their consent at any time. In this case, the data from the applicant pool will be irrevocably deleted, provided there are no legal reasons for storage.

The data from the applicant pool will be irrevocably deleted no later than two years after consent has been granted.