Source: https://www.flachglas.de/en/data-protection/
Timestamp: 2019-04-20 20:47:08+00:00

Document:
User-related data (e.g., names, addresses).
Contact data (e.g., email, telephone numbers).
Content data (e.g., text entries, photographs, videos).
Use data (e.g., web pages visited, interest in contents, access times).
As a rule, we process data from you only for the purposes for which we have received or collected them. We will observe any and all duties of information according to Art. 13(3) GDPR and Art. 14(4) GDPR.
When personal data are processed on the basis of your consent, you have the right to withdraw your consent from us at any time with prospective effect.
When we process data on the basis of a balancing of interests, you as a data subject have the right, taking into account the provisions of Art. 21 GDPR, to object to such processing of personal data.
We process the data as long as necessary for the purpose concerned.
Where statutory retention duties apply, for example under commercial or tax law, the personal data concerned are stored for the duration of the retention duty. Once the retention duty expires, it is determined whether any further requirement for the processing is present. The data are deleted if there no longer is any such requirement.
You may demand, at any time, information about the data relating to your person that we have stored and, in the event that no requirement for those data exists, demand that the data be deleted or their processing restricted.
As a rule, your data are disclosed to third parties only if such disclosure is required for performance of our contract with you, the disclosure is permitted on the basis of a balancing of interests within the meaning of Art. 6(1) lit. f GDPR, we are obliged by law to make the disclosure, or you have given your consent thereto.
We process your personal data exclusively in Germany.
You have the right to information about the personal data relating to your person that are processed by us. Furthermore, you have the right to rectification or erasure of personal data and to have the processing of such data restricted in so far as you are entitled thereto by law. Furthermore, you have a right to object to the processing according to the provisions of law. The same applies to a right to data portability. You have the right to complain to a data protection supervisory authority about the processing of personal data by us.
The data subject’s personal data are deleted or blocked once the purpose of the storage no longer applies. The data may remain in storage thereafter if the European or national legislators have so provided in Union regulations, laws, or other rules to which the Controller is subject. The data are blocked or deleted also when a storage time limit prescribed by the aforementioned rules or regulations expires, unless further storage of the data is required for entry into or performance of a contract.
We process user-related data (e.g. names and addresses along with users’ contact data) and contract data (e.g. services used, names of contacts, payment information) for the purpose of performing contractual obligations and services in accordance with Art. 6(1) lit b GDPR. The entries marked on online forms as mandatory are required for entry into a contract.
When our online services are used, we store the user’s IP address and the time of the user’s action. These data are stored on the basis of our legitimate interests and of the user’s interest in protection from misuse and other unauthorised use. These data are never disclosed to third parties unless such disclosure is necessary for the pursuit of our claims or we are obliged by law to make such disclosure as provided in Art. 6(1) lit. c GDPR.
We process user data (e.g. the web pages visited on our online site, interest in our products) and content data (e.g. entries in the contact form such as a name, telephone number, email address) in order to offer contract proposals to the user.
The data are deleted once statutory warranty periods and comparable duties expire. In the case of statutory archiving duties, the data are deleted after those duties expire. If the customer has a customer account, the data it contains remain until the account is deleted.
If we process data in a “third country” (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or such processing takes place in connection with the use of third-party services or the disclosure or transfer of data to third parties, we do so only to perform our contractual or pre-contractual duties, on the basis of your consent, owing to a legal obligation, or on the basis of our legitimate interests. Subject to statutory or contractual permissions, we process the data, or have them processed, in a third country only if the special conditions provided in Art. 44 et seqq. GDPR are present. I.e., the processing is performed, for example, on the basis of special guarantees such as an officially recognised finding of a level of data protection that conforms to EU standards (for the U.S.A., for example, through the “Privacy Shield”) or observance of officially recognised special contractual obligations (referred to as “standard contract clauses”).
When our website is visited, our system automatically collects data and information from the accessing computer system.
The data are stored in our system’s log files. These data are needed only for analysis of any disruptions that may take place and are deleted within no more than seven days. The legal basis for temporary storage of the data and for the log files is provided in Art. 6(1) lit. f GDPR. Temporary storage of IP addresses by the system is necessary to enable delivery of the website to the user’s computer. For this purpose the user’s IP address must be stored for the duration of the session. Storage in log files serves the purpose of ensuring that the website is functional. In addition, the data enable us to optimise the website and to ensure the security of our information-related systems. No analysis of the data for marketing purposes takes place in this connection, and no conclusions are drawn as to your personal identity. It is in these purposes that our legitimate interest in data processing lies according to Art. 6(1) lit. f GDPR. Collection of the data for the purpose of providing the website and storage of the data in log files for the website’s operation are absolutely necessary. The user, consequently, has no basis on which to raise an objection.
The Data Controller responsible for the processing collects and processes the personal data of applicants for the purpose of carrying out the application process. Such processing can be done also by electronic means. This is the case in particular when an applicant sends the appropriate application papers by electronic means, for example by email or through a web form located on our website, to the Data Controller responsible for processing them. If the Data Controller enters into a contract of employment with the applicant, the transferred data are saved for the purpose of establishing the employment relationship in compliance with the applicable provisions of law. If the Data Controller does not enter into a contract of employment with the applicant, then the application papers are automatically deleted once the decision to reject the applicant is made known, provided that their deletion is not prevented by any other legitimate interests of the Controller. Other legitimate interests in this sense include, for example, a burden of proof in legal proceedings according to the German General Equal Treatment Act [Gleichbehandlungsgesetz] (AGG). The statutory time limits for archiving and deletion apply.
Google is certified under the Privacy Shield framework and thereby offers a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
Google will use this information on our behalf to analyse the user’s use of our website, to compile reports on activities within this website, and to provide us with other services associated with the use of this website and of the Internet. Pseudonymised user profiles may be created from the processed data.
We use Google Analytics only with IP anonymisation activated. This means that the user’s IP address is truncated by Google within the Member States of the European Union or in other countries that are signatories to the Agreement on the European Economic Area. Only in exceptional cases is the entire IP address transferred to a Google server in the U.S.A. and truncated there.
The IP address transmitted by the user’s browser is not combined by Google with other data. Users may prevent cookies from being stored by making the appropriate setting in their browser software; they may in addition prevent Google from collecting and processing the data generated by the cookie and relating to their use of the website by downloading and installing the browser plug-in that is available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de.
You can find more information about how data are used by Google, setting options and means of opposition on Google’s web pages: https://www.google.com/intl/de/policies/privacy/partners (“How Google uses data when you use our partners’ websites or apps”), http://www.google.com/policies/technologies/ads (“Use of data for advertising purposes”), http://www.google.de/settings/ads (“Managing information that Google uses to display advertising to you”).
In addition, we link to the page at www.google.de so that you can set a bookmark for our homepage in your browser. This is subject to the terms of Google referred to above.
The reach analysis performed by Matomo entails processing of the following data on the basis of our legitimate interests (i.e. our interest in the analysis and in optimisation and economic operation of our online site within the meaning of Art. 6(1) lit. f GDPR): the type of browser you are using and the browser version, the operating system you are using, your country of origin, the date and time of the server request, the number of visits, the duration of your stay on the website, and the external links that you click on. The user’s IP address is anonymised before it is stored.
Users may opt out of anonymised data collection by the Matomo program at any time, with prospective effect, by clicking on the link below. If this option is exercised, an “opt-out” cookie is placed in your browser, as a result of which Matomo will no longer collect any session data. If users delete their cookies, the opt-out cookie is deleted along with them and must therefore be re-activated by the users.
You may demand of the Controller confirmation as to whether personal data relating to you are processed by us.
you have the right to demand disclosure of whether personal data relating to you are transferred to a third country or an international organisation. In this connection, you may demand to be instructed as to the appropriate safeguards according to Art. 46 GDPR in connection with the transfer of personal data.
You have a right to rectification and/or completion by the Controller if the processed personal data relating to you are inaccurate or incomplete. The Controller must make the rectification without delay.
if you have objected to processing pursuant to Article 21(1) GDPR and it has not yet been established whether the legitimate grounds of the controller outweigh your grounds.
If processing of personal data relating to you has been restricted, then those data may be processed, apart from their storage, only with your consent, to assert, exercise or defend legal claims, to protect the rights of another natural or legal person, or on grounds of a substantial public interest of the Union or of a Member State.
If data processing has been restricted in accordance with the aforementioned conditions, you will be informed by the Controller before the restriction is lifted.
You withdraw your consent which provided the legal basis for the processing according to Art. 6(1) lit. a or Art. 9(2) lit. a GDPR, and there is no other legal basis for the processing.
You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR.
The personal data relating to you have been processed unlawfully.
Erasure of the personal data relating to you is required for compliance with a legal obligation in Union or Member State law to which the Controller is subject.
The personal data relating to you were collected in reference to offered information society services according to Article 8(1) GDPR.
If the Controller has made the personal data relating to you public and is obliged according to Art. 17(1) GDPR to erase them, the Controller, taking into account the available technology and the cost of implementation, will take appropriate steps, including those of a technical nature, to inform controllers that are processing the personal data that you, as a data subject, have requested of them the erasure of all links to, or copies or replications of, those personal data.
If you have asserted to the Controller your right to rectification, erasure or restriction of processing, then the Controller is obliged to make such rectification, deletion, or restriction of data known to all recipients to whom the personal data relating to you have been disclosed, unless doing so proves impossible or would entail a disproportionate cost.
You have a right to be informed of those recipients by the Controller.
In exercising this right, you have, further, the right to have the personal data relating to you transferred directly from one Controller to another, if this is technically feasible. The rights and freedoms of other persons must not be infringed thereby.
The right to data portability does not apply to processing of personal data necessary for performance of a task that is in the public interest or that is performed in exercise of official authority that has been vested in the Controller.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you that is performed on the basis of Art. 6(1) lit. e or f GDPR; this applies also to profiling that is based on those provisions.
The Controller will no longer process the personal data relating to you unless the Controller can show compelling grounds for the processing that are worthy of protection and which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.
If the personal data relating to you are processed for direct marketing purposes, then you have the right to object at any time to the processing of personal data relating to you for the purposes of such marketing; this applies also to profiling when it is related to such direct marketing.
If you object to processing for direct marketing purposes, then the personal data relating to you will no longer be processed for such purposes.
In connection with the use of information society services - notwithstanding Directive 2002/58/EC - you have the option of exercising your right to object by automated means for which technical specifications are used. For this purpose you can send an email message to our data protection officer.
You have the right to withdraw, at any time, a declaration of consent that has been made pursuant to data protection law. Withdrawal of your consent will not affect the lawfulness of such processing as was performed with your consent before the withdrawal of your consent.
These decisions must not, however, be based on special categories of personal data according to Art. 9(1) GDPR, unless Art. 9(2) lit. a or g GDPR applies and suitable measures have been taken to safeguard your rights and freedoms and your legitimate interests.
In respect of the cases mentioned in (1) and (3), the Controller will take suitable measures to safeguard your rights and freedoms and your legitimate interests, among which are, at a minimum, the right to bring about human intervention on the part of the Controller, to express your point of view and to contest the decision.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or place of the alleged infringement if you are of the opinion that the processing of personal data relating to you violates the GDPR.
The supervisory authority to which the complaint is submitted will inform the complainant of the status and the results of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

References: Art. 13
 Art. 14
 Art. 21
 Art. 6
 Art. 6
 Art. 6
 Art. 44
 Art. 6
 Art. 6
 Art. 6
 Art. 46
 Art. 6
 Art. 9
 Art. 21
 Art. 17
 Art. 6
 Art. 9
 Art. 9
 Art. 78