Privacy policy
Welcome to the GROB-WERKE GmbH website and thank you for your interest in our company. The protection of personal data is important to GROB-WERKE GmbH & Co. KG andis also required by law.
Whenever you use our services, this takes place on the basis of this privacy policy. We
give our users the option of adjusting the data settings that we collect, use, and share inaccordance with this privacy policy and the cookie information. With the following information, we would like to give you an overview of the processing of your personal data by
us and your rights under data protection law.
I. Contact details of the controller
GROB-WERKE GmbH & Co. KG
Industriestraße 487719 Mindelheim
The contact details can be found in the Legal Notice.
If you wish to assert your rights, report data privacy incidents, make any suggestions orcomplaints about how your personal data are processed or withdraw your consent, werecommend that you contact our Data Protection Officer.
II. Contact details of the Data Protection Officer
GROB-WERKE GmbH & Co. KG
Data Protection Officer
Industriestraße 487719 Mindelheim
Email: datenschutz@grob.de
III. General information about data processing
1. Scope of the processing of personal data
Essentially, we process the personal data of our users only to the extent required to provide a functional website and our contents and services. As a rule, users' personal data
are processed only if they have given their consent. Cases where consent cannot be obtained beforehand for practical reasons and data are allowed to be processed owing tostatutory regulations are excepted.
We invite you to participate in our web-based training and learning pathways on the
GROB Campus digital learning platform. To assign a selected learning pathway to you andprovide the necessary access data, we need to process your personal data in our registration form. If, for example, you are in a contractual relationship with us as an employee
or customer, or transmit or update your personal data as part of the initiation of a business relationship, we process this personal data to execute the contractual relationship orfor precontractual purposes as instigated by you (Art. 6(1)(b) GDPR).
Participation in online training (web-based training)
The storage and use of the personal data that you enter during registration, booking, andpayment is necessary in order to book and participate in online training courses. Your access data as well as the learning success and learning status you have achieved needs tobe stored for participation in the online training. These data are used as the basis for any
certification to document the successful completion of the online training.
Booking in-person training
The storage and use of personal data that you enter during registration, booking, andpayment is necessary in order to book and participate in in-person training courses. The
disclosure of these data or part of these data to third parties (e.g., payment services provider, executing third party, or certifying third party) may be necessary. Details can befound in the relevant General Terms and Conditions (GTC). The GTC are displayed as
Version 1.1

Last updated: 2024/04/24

Page 1/8

part of every booking process and must be approved. By booking an in-person training
course, you consent to the collection, use, and transmission of your data as per this privacy policy and any additional conditions specified in the GTC.
The following personal data are saved in the learning platform:➢ Personal master data (e.g., last name, first name, date of birth, address data)➢ Registration data (e.g., unique identifier/login name, password)➢ Image data (e.g., stored photos)➢ Contact details (e.g., telephone, email, IP address, preferred language, time zone)➢ Pedagogical data (e.g., information about courses attended, tutorials, and teaching staff, learning progress data)➢ Fields of interest (e.g., preferred topics, target group)➢ Forum data (e.g., course assessments, forum discussion, Wiki articles)➢ Specific usage data (e.g., login status/initial login, logging of entries and changes,
services used, downloads, reports)➢ General usage data (e.g., data to ensure functionality, security and abuse monitoring, access authorization concept)➢ Static data (e.g., aggregated information without reference to individual users)
All registered participants have access to these data:➢ Own profile data, learning status information, competence profile data
➢ Released learning contents (e.g., online learning, learning videos)➢ Assigned courses➢ Course offers in the standard catalog
2. Legal basis for processing personal data
Insofar as we obtain the consent of the data subject for processing personal data, Art.
6(1)(a) of the EU General Data Protection Regulation (GDPR) provides the legal basis.
Insofar as the processing of personal data is necessary to fulfil a legal obligation incumbent on our company, Art. 6(1)(c) GDPR provides the legal basis.
If the processing is necessary to safeguard a legitimate interest of our company or athird party and the interests, fundamental rights, and fundamental freedoms of the data
subject do not outweigh this interest, Art. 6(1)(f) GDPR provides the legal basis for theprocessing.
3. Data erasure and storage duration
The personal data of the data subject are erased or blocked as soon as the purpose forthe storage is no longer applicable. Storage may also occur, if this was provided for by
the European or national legislator in Union regulations, laws, or other provisions towhich the controller is subject. Data are also blocked or erased if a storage period specified by the standards expires, unless there is a need for further storage in compliancewith the principle of proportionality.
IV. Provision of the website and creation of logfiles
1. Description and scope of the data processing
Whenever our website is accessed, our system automatically collects data and information from the computer system accessing the website.
The following data are collected:
IP address of the terminal from which you access the online offer; our websites that you
visit; the date and duration of the visit; the identification data of the type of browser andoperating system used as well as the website from which you are visiting; and the httpsstatus code (e.g., "Request successful" or "Requested data no found").

Version 1.1

Last updated: 2024/04/24

Page 2/8

The logfiles contain IP addresses or other data that enable assignment to a user. For example, this could be the case if the link to the website from which the user reaches thewebsite or the link to the website to which the user switches contains personal data.
The data are also saved in our system's logfiles. These data are not saved together withother personal user data.
Our websites use SSL and TLS encryption for security reasons and to protect the transmission of confidential contents, such as registrations or inquiries that you send to us as
the site operator. The data that you transmit to us can therefore not be read by third parties.
2. Legal basis for the data processing
The legal basis for the temporary storage of the data and logfiles is Art. 6(1)(f) GDPR.
3. Purpose of the data processing
The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. This requires the user's IP address to be
stored for the duration of the session.
The storage in logfiles takes place to ensure the functionality of the website. We also use
the data for the technical optimization of the website and to ensure the security of our
information systems. The data are not evaluated for marketing purposes in this respect.
These purposes also reflect our legitimate interest in data processing as defined in Art.
6(1)(f) GDPR.
4. Duration of storage
The data will be deleted as soon as they are no longer required to achieve the purpose
for which they are collected. If the data are collected to provide the website, this is thecase when the relevant session ends.
If the data are stored in logfiles, this is the case after no more than 30 days. Storage beyond this period is possible. In this case, the user's IP addresses are erased or modified
so that they can no longer be assigned to the accessing client.
5. Possibility of objection and removal
The collection of the data to provide the website and the storage of the data in logfiles isan essential requirement for operating the website. Consequently, the user does not havea right to object.
V. Commissioning service providers
We commission service providers with tasks such as marketing services, programming,
website support, web analysis, conversion tracking, and data hosting. We carefully selectthese service providers and monitor them regularly, in particular their careful handling ofdata and the associated technical security. We commit all service providers to confidentiality and to comply with the statutory data protection requirements. To the extent legally
necessary, we have concluded data processing agreements with our service providers.
VI. Use of cookies
1. Description and scope of the data processing
Our website uses cookies. Cookies are text files that are stored in the web browser or by
the web browser on the user's computer system. A cookie may be stored on the user's
operating system when a user accesses a website. This cookie contains a characteristic
character sequence that allows the browser to be clearly identified when the website isaccessed again.
We use cookies to improve the functionality of our website. Some elements of our website require the accessing browser to be identified even after changing websites.
Version 1.1

Last updated: 2024/04/24

Page 3/8

Our websites also uses cookies that enable the surfing behavior of users to be analyzed.
You can view a detailed list of cookies used here under "Further information".
When a user accesses our website, they are informed about the use of cookies for analysis purposes and their consent to the processing of their personal data used in this context is obtained. Reference is also made to this Privacy Policy in this respect.
2. Legal basis for the data processing
The legal basis for processing personal data using technically necessary cookies as defined in Section 25(2) TTDSG (German Telecommunications and Telemedia Data Protection Act) is Art. 6(1)(f) GDPR.
The legal basis for processing personal data using cookies for analysis purposes if theuser has provided their consent for this purpose is Art. 6(1)(a) GDPR.
The basis of the data processing within the scope of the use of the Consent Management
tool is Art. 6(1)(b) GDPR.
3. Purpose of the data processing
The purpose of using technically necessary cookies is to enable the use of the website by
the user. Some functions of our website cannot be offered without the use of cookies.
They require the browser to be recognized even after changing websites. The user datacollected by technically necessary cookies are not used to create user profiles.
Analysis cookies are also used to improve the quality of our website and its contents.
Analysis Cookies tell us how our website is used, and this allows us to continuously optimize its contents.
These purposes also reflect our legitimate interest in processing personal data as definedin Art. 6(1)(f) GDPR.
4. Duration of storage, possibility of objection and removal
Cookies are stored on the user's computer and transmitted from this computer to our
website. This gives you, as the user, full control over the use of Cookies. You can disableor restrict the storage of cookies by changing the settings in your web browser. Stored
cookies can be erased at any time. This may also take place automatically.
You can manage your consent for cookies for our website here at any time. If cookies are
disabled for our website, it may no longer be possible to make full use of all the website'sfunctions.
5. Data processing agreement
As part of the Learning Management system, we use the platform provided by imc information multimedia communication AG, Scheer Tower, Uni-Campus Nord, 66123 Saarbrücken, Germany. The platform helps us to provide learning content, organize learning
processes, support learning scenarios, and track learning progress. It also enables communication between students and teaching staff. We have concluded a corresponding
data processing agreement as defined in Art. 28 GDPR in this respect.
VII. Forms and email contact
1. Description and scope of the data processing
On our website we provide forms that can, for example, be used for electronic contact,
service inquiries, or registration purposes. If a user makes use of this opportunity, thedata entered into the input screen are transmitted to us and stored. The input screens
distinguish between mandatory inputs and optional inputs, which you can voluntarily provide. In addition, the following data are stored at the time the message is sent: user's IP
address, date, and time.

Version 1.1

Last updated: 2024/04/24

Page 4/8

In order to process the data, your consent is obtained and reference is made to this privacy policy as part of the submission process.
For security reasons and to protect the transmission of confidential contents, our siteuses the latest TLS encryption. This ensures that your data cannot be read by unauthorized third parties.
Alternatively, contact can be made using the email address provided. In this case, the user's personal data transmitted in the email are stored. If you wish to contact us by email,please be aware that the confidentiality of the transmitted information is not guaranteed.
The content of your email can be viewed by unauthorized third parties.
The data are not disclosed to third parties. The data are used solely to process the conversation.
2. Legal basis for the data processing
The legal basis for the data processing if the user has provided their consent for this purpose is Art. 6(1)(a) GDPR.
The legal basis for the processing of the data that is transmitted as part of an email isArt. 6(1)(f) GDPR. If the email contact occurs for the purpose of establishing a contract,
an additional legal basis for the processing is Art. 6(1)(b) GDPR.
3. Purpose of the data processing
We exclusively process the personal data from the input screen for the purpose inherent
in the form, such as the processing of the contact or the registration of your participationin one of our events. In the event of email contact, this establishes the necessary legitimate interest in processing the data.
The other personal data processed during the submission process are used to prevent
any misuse of the contact form and to ensure the security of our information systems.
4. Duration of storage
We store your login information, the consent, and any collected withdrawal for three
years from the time the consent or withdrawal is issued to be able to provide evidence ofa formerly issued consent. The processing of these data is restricted to the possible defense against claims.
The remaining data collected via the input screen or based on the content of your email
is erased as soon as they are no longer required to achieve the purpose for which they
are collected. If your consent is withdrawn, the data are erased no later than 14 days after receipt of the withdrawal. The same applies for the additional personal data collectedduring the submission process.
5. Possibility of objection and removal
The user has the opportunity to withdraw their consent to process personal data at any
time. To do so, the user can email info@de.grobgroup.com to cancel the storage of theirpersonal data at any time. In this case, the conversation cannot be continued and the
purpose of the form cannot be implemented.
VIII. Rights of the data subject
If your personal data are processed, you are a data subject for the purposes of the GDPR
and you have the following rights in relation to the controller:
1. Right of access
You have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed,
Version 1.1

Last updated: 2024/04/24

Page 5/8

and, where that is the case, access to the following information:(1)
the purposes for which the personal data are processed;(2)
the categories of personal data that are processed;(3)
the recipients or categories of recipient to whom the personal data concerning
you have been or will be disclosed;(4)
the envisaged period for which the personal data concerning you will be stored,
or, if no specific information is possible, the criteria used to determine that period;(5)
the existence of the right to request from the controller rectification or erasure of
personal data or restriction of processing of personal data concerning you or to object tosuch processing;(6)
the right to lodge a complaint with a supervisory authority;(7)
where the personal data are not collected from the data subject, any available information as to their source;(8)
the existence of automated decision-making, including profiling, referred to in
Art. 22(1) and (4) GDPR and, at least in those cases, meaningful information about thelogic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You have the right to be informed of whether personal data concerning you are transmitted to a third country or an international organization. In this respect, you may request
to be informed of the appropriate guarantees as defined in Art. 46 GDPR in connection
with the transmission.
2. Right to rectification
You have a right to rectification and/or completion in relation to the controller if the processed personal data concerning you are incorrect or incomplete. The controller must immediately rectify the data.
3. Right to restriction of processing
You have a right to restrict the processing of personal data concerning you under the following conditions:(1)
if you contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;(2)
the processing is unlawful and you oppose the erasure of the personal data andrequest the restriction of their use instead;(3)
the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise, or defense of legal
claims; or(4)
you have objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override yours.
Where processing of the personal data concerning you has been restricted, such personal
data shall, with the exception of storage, only be processed with your consent or for theestablishment, exercise or defense of legal claims or for the protection of the rights ofanother natural or legal person or for reasons of important public interest of the Union orof a Member State.
If processing has been restricted under the above conditions, you will be informed of thecontroller before the restriction is lifted.
4. Right to erasurea. Erasure obligation
You have the right to obtain from the controller the erasure of personal data concerning
you without undue delay and the controller is obliged to erase these data without undue
delay where one of the following grounds applies:(1)
The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
(2)
You withdraw your consent on which the processing is based according to Art.
6(1)(a) or Art. 9(2)(a) GDPR and there is no other legal ground for the processing.
Version 1.1

Last updated: 2024/04/24

Page 6/8

(3)You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to
Article 21(2) GDPR.
(4)
The personal data concerning you have been unlawfully processed.
(5)
The personal data concerning you have to be erased for compliance with a legal
obligation in Union or Member State law to which the controller is subject.
(6)
The personal data concerning you have been collected in relation to the offer of
information society services referred to in Article 8(1) GDPR.
b. Information to third parties
Where the controller has made the personal data concerning you public and is obliged
pursuant to Art. 17(1) GDPR to erase the personal data, the controller, taking account ofavailable technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data thatyou as the data subject have requested the erasure by such controllers of any links to, or
copy or replication of, those personal data.
c. Exceptions
The right to erasure does not apply to the extent that processing is necessary(1)for exercising the right of freedom of expression and information;(2)
for compliance with a legal obligation which requires processing by Union orMember State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;(3)
for reasons of public interest in the area of public health in accordance with Art.
9(2)(h) and (i) as well as Art. 9(3) GDPR;(4)
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) GDPR in so far as the right referred to in paragraph a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or(5)for the establishment, exercise or defense of legal claims.
5. Right to notification
If you have asserted the right to rectification, erasure, or restriction of the processing in
relation to the controller, the controller shall communicate this rectification or erasure of
personal data or restriction of processing to each recipient to whom the personal data
have been disclosed, unless this proves impossible or involves disproportionate effort.
You have the right to be informed about these recipients by the controller.
6. Right to data portability
You have the right to receive the personal data concerning you, which you have provided
to a controller, in a structured, commonly used and machine-readable format. and havethe right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:(1)
the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a)GDPR or on a contract pursuant to Art. 6(1)(b) GDPR; and(2)
the processing is carried out by automated means.
In exercising this right to data portability, you also have the right to have the personal
data concerning you transmitted directly from one controller to another, where technicallyfeasible. This right shall not adversely affect the rights and freedoms of others.
The right to data portability does not apply to processing personal data that is necessary
for the performance of a task carried out in the public interest or in the exercise of official
authority vested in the controller.

Version 1.1

Last updated: 2024/04/24

Page 7/8

7. Right to object
You have the right to object, on grounds relating to your particular situation, at any timeto processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR,
including profiling based on those provisions.
The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override
your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims.
Where personal data concerning you are processed for direct marketing purposes, youhave the right to object at any time to processing of personal data concerning you forsuch marketing, which includes profiling to the extent that it is related to such direct
marketing.
If you object to processing for direct marketing purposes, the personal data concerning
you shall no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive
2002/58/EC, you may exercise your right to object by automated means using technicalspecifications.
8. Right to withdraw the data privacy declaration of consent
You have the right to withdraw your data privacy declaration of consent at any time. A
revocation of consent does not affect the lawfulness of the processing carried out basedon the consent up until the time of withdrawal.
Recipient of an objection
An objection can be submitted informally with the subject "Objection", indicating yourname and address, and can be addressed to:
GROB-WERKE GmbH & Co. KG
Industriestraße 487719 Mindelheim
Email: info@campus.grobgroup.com
9. Right to lodge a complaints with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right tolodge a complaint with a supervisory authority, in particular in the Member State of yourhabitual residence, place of work, or place of the alleged infringement if you consider
that the processing of personal data concerning you infringes the GDPR.
Our data protection supervisory authority is the Bavarian Regional Office for Data Protection Supervision, PO Box 1349, 91504 Ansbach.

Version 1.1

Last updated: 2024/04/24

Page 8/8