Source: https://www.stahlgruber.de/en/privacy
Timestamp: 2019-04-25 12:24:31+00:00

Document:
The protection of your personal data and your right to informational self-determination have always been of great importance to us at STAHLGRUBER GmbH. In the following we would like to inform you about how your personal data is processed by us and what rights you have as the data subject pursuant to Articles 13, 14 and 21 of the European General Data Protection Regulation (GDPR). The following general information is valid as of May 25, 2018, and may replace any previously published information or versions. If a special situation arises regarding processing, you will receive separate or supplementary information. This includes, for example, the data protection statements on our websites, terms of participation concerning events, and information regarding consent. The following general information will be updated as needed. The current version can be viewed at https://www.stahlgruber.de/en/privacy.
1. Who is responsible for the processing of personal data and how can you contact the Data Protection Officer?
Which categories of personal data are processed by us and where does the data come from?
If you access the websites of STAHLGRUBER GmbH or use other electronic services provided by us, we will process various IT-specific information. In addition to the type, time and duration of access, such processing also includes the IP addresses that you use, as well as data about the devices that you use, such as: operating system, browser and amount of transmitted data. As part of the processing activities referred to in Point 3, so-called “cookies” are also used. Further information can be found in the specific information concerning data protection for each respective website or electronic service. The information for the website “stahlgruber.de” is available at the end of this document.
3. For what purposes is your personal data processed and on which legal basis is such processing based?
The processing of your personal data is carried out in accordance with the provisions of the European General Data Protection Regulation (GDPR), the Federal Data Protection Act as amended on June 30, 2017, and any other applicable data protection regulations.
A large part of the personal data is processed by us in order to be able to fulfil contracts with you or to carry out pre-contractual measures at your request. The legal basis for this is Article 6 (1) Sent. 1 (b) of the GDPR. The processing activities, which include any associated purpose, arise in particular from the respective contract and include, above all, the provision of our catalogues and ordering systems, the preparation of offers, the acceptance of orders, the commissioning of goods, delivery, and if necessary assembly and/or operationalisation and/or maintenance activities, as well as the provision of other services, such as training sessions and invoicing, which includes order-related payments, payment reminders/warnings and tax assessments. Also required in this context are order-related communications, the documentation of transactions, the booking of business transactions and the processing of claims, including fulfilment of any warranty claims.
Like any other company, STAHLGRUBER GmbH has to fulfil and comply with a wide variety of legal obligations. To do this, personal data must also be processed. The legal basis for this is Art. 6 Para. 1 Sent. 1 (c) of the GDPR. Furthermore, personal data may have to be processed during the performance of a task carried out in the public interest. The legal basis for this is Art. 6 Para. 1 Sent. 1 (e) of the GDPR. The requirements and the resulting processing activities and purposes arise, in particular, from commercial and tax law but also from other supervisory or regulatory requirements. The retention periods for business documents require, for example, that a large number of documents, including the personal data that such documents contain, are stored on a long-term basis.
Other regulatory-related processing activities may include the implementation or support of recall actions, the prevention of money laundering, the prevention, combating and resolution of terrorist financing, the fulfilment of tax inspection and reporting obligations, as well as identity verification and reconciliation with anti-terror lists. Judicial or regulatory measures may require that personal data be processed and, in particular, disclosed. Such measures include law enforcement activities, evidence gathering activities, enforcement or defence of civil claims or audits by tax and/or regulatory authorities. The legal requirements for data protection and data security also require certain processing activities. This includes record keeping with the framework of data security measures, e.g. when visiting our websites, when using other electronic services provided by us, or when communicating via e-mail, fax or telephone, as well as making inquiries with regard to data protection.
Furthermore, we process personal data for the purpose of advertising as well as market or opinion research. Approaches for advertising purposes are made personally, by telephone and by post. If you have purchased goods or services from us, we may use your e-mail address to send you information about similar products and services by e-mail. If the legislator requires consent for this, we will obtain it. We also exchange personal data with affiliated companies within the framework of legal regulations. Processing within the framework of a weighing of interests will only take place if you have not objected to it and if the legislator does not require explicit consent. We will inform you separately below about your right of objection pursuant to art. 21 GDPR.
Certain processing operations may require us to obtain your consent. The legal basis for such processing activity is art. 6 para. 1 sentence 1 letter a) GDPR. Consents granted before 25.05.2018 generally remain valid. If we need your consent, we will inform you about the planned use before you grant your consent. You can revoke both new consents and consents granted in the past at any time with effect for the future. However, the revocation of consent does not affect the legality of the processing until the time of revocation.
4. Which categories of recipients have access to your personal data or to whom is this data transmitted?
Within STAHLGRUBER GmbH, the departments have access to personal data which they require for their professional activities and for carrying out the processing described under point 3. Your personal data will only be passed on to entities outside STAHLGRUBER GmbH if this is legally permitted and is necessary as part of the processing mentioned under point 3.
- The transfer is necessary for the fulfilment of legal obligations to which STAHLGRUBER GmbH is subject.
- It involves order processing within the meaning of art. 28 GDPR.
These service providers may also be affiliated companies.
How long does STAHLGRUBER GmbH store your personal data?
STAHLGRUBER GmbH processes your personal data as long as is necessary to conduct the business relationship, including pre-contractual measures, and to comply with statutory obligations.
Furthermore, STAHLGRUBER GmbH is obligated to observe retention periods under commercial and tax law. These are defined, in particular, in the German Commercial Code, the German Tax Code and the German Prevention of Money-Laundering Act and can be up to 10 years after the business relationship or contract formation phase has ended.
Due to other statutory provisions, it may be necessary to retain the data for longer periods in order to preserve evidence. Section 195 of the German Civil Code stipulates limitation periods of up to 30 years, whereby the standard limitation period is three years.
Where the aforementioned periods have expired, the personal data shall be deleted on a regular basis. Exceptions to this rule apply only where further processing is necessary to safeguard a legitimate interest pursuant to 3 c). According to Section 35 of the German Federal Data Protection Act (FDPA) (amended version), such an interest can also be deemed to exist where, due to the specific method of storage, the deletion of data is not possible or only possible with an unreasonable amount of effort, and the interest of the data subject in having the data deleted is considered negligible. Data deletion shall be superseded by the restriction on data processing by means of suitable technical and organisational measures.
6. Will your personal data be forwarded to a third country or to an international organisation?
g) contract processing is involved.
- contractual clauses approved by the supervisory authorities.
Upon request, we shall provide you with detailed information in this regard. This shall also include information on suitable or adequate safeguards and how to obtain a copy of these. Please address your inquiry to the company Data Protection Officer.
As a data subject, you have various rights that you can assert against STAHLGRUBER GmbH under certain conditions. These include the right to information (Article 15 GDPR), the right to correction (Article 16 GDPR), the right to deletion (Article 17 GDPR), the right to restricted processing (Article 18 GDPR) and the right to data portability (Article 20 GDPR). Restrictions in accordance with Sections 34 and 35 FDPA (amended version) shall apply to the rights to information and deletion. You have the right to object to the processing of data on grounds of a legitimate interest (Article 21 (1) GDPR). In such cases, we shall cease processing the data unless compelling legitimate reasons exist for processing, or if processing is necessary for asserting, exercising or defending legal claims. This shall apply analogously for the processing of your personal data for direct marketing purposes (Article 21 (2) GDPR). You may withdraw your consent at any time pursuant to Article 7 (3) GDPR. This shall also apply for any consent given prior to 25.05.2018. The withdrawal of consent shall not affect the lawfulness of any processing for which consent was given and which was carried out prior to the withdrawal thereof.
You also have the right to lodge a complaint with the competent supervisory authority for data protection (Article 77 GDPR in connection with Section 19 FDPA).
If you would like to exercise your rights, please contact the STAHLGRUBER GmbH Data Protection Officer, preferably in writing. The contact details are listed under 1 above.
8. Are you obligated to provide personal data?
You are required to provide any and all personal data that is necessary for entering into and conducting a business relationship, for implementing pre-contractual measures and for fulfilling the contractual obligations related thereto. You are also required to provide any and all data that STAHLGRUBER GmbH is legally obligated to process. Without this data, we shall not be able to conclude or perform the respective contract with you. Such an obligation to provide personal data may only arise at a later stage of the business relationship. Any other personal data provided is done so on a voluntary basis.
9. Will an automated individual decision-making process (including profiling) be used?
STAHLGRUBER GmbH uses automated individual decision-making processes pursuant to Article 22 GDPR for the performance of contracts. If the buyer is repeatedly in default of payment, the option of making a purchase with a specific payment target shall be automatically blocked. This measure aims to reduce payment defaults. The data subjects shall have the right to obtain human intervention on the part of the controller, to express their own point of view and to contest the decision.
To some extent, personal data is also processed automatically, thereby enabling the analysis of particular personal aspects (so-called profiling). In order to provide you with specific information about products and services and make offers that are appropriate to your needs, we use evaluation mechanisms which take into account, among other things, your industry affiliation and past sales for specific product groups.
STAHLGRUBER GmbH evaluates the creditworthiness of business partners. For these purposes, scoring can be used. In this process, the probability that a business partner will meet their payment obligations is calculated on the basis of mathematical and statistical procedures. The values are included in the assessment of creditworthiness, in the granting of payment terms and in risk management. The computation can include industry affiliation, company size, information from credit agencies, information about the history of the company, experience gained from the business relations and payment history.
No use is made here of special categories of personal data pursuant to Art. 9 GDPR or of data concerning your nationality.
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning your person, provided that the processing is based on Art. 6 (1) (1) (e) GDPR (processing in the public interest) or on Art. 6 (1) (1) (f) GDPR (processing in the interest of STAHLGRUBER GmbH or a third party). This applies also to profiling based on this regulation within the meaning of Art. 4 (4) GDPR.If you object, STAHLGRUBER GmbH will no longer process the personal data concerning your person unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing is for the assertion, exercise or defence of legal claims.
STAHLGRUBER GmbH uses your personal data for direct marketing purposes. You have the right to object at any time to the processing of personal data concerning your person for such marketing purposes. This includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, STAHLGRUBER GmbH will no longer process your personal data for such purposes.
When you visit our website, information of a general nature is automatically collected. This information (server log files) includes, for instance, the type of web browser, the operating system used, the domain name of your internet service provider and the like. None of the information collected allows you to be identified. This information is necessary for technical reasons, so that the content of websites you visit can be correctly displayed, and is indispensable for the use of the Internet. We statistically evaluate anonymous information of this kind in order to optimise our online presence and the underlying technology.
For the provision of chargeable services, we ask for additional data, such as payment details.
In order to protect the security of your data during the transmission, we use encryption methods in line with state-of-the-art technology (e.g. SSL) via HTTPS.
The data you provide when you register to receive our newsletter are used solely for that purpose. Subscribers can also receive e-mail updates concerning circumstances that are relevant to the service or the registration (for instance, changes to the newsletter offer or technical matters).
For the registration to be effective, we require a valid e-mail address. In order to verify that the registration is carried out by the owner of the e-mail address, we implement the double opt-in method. To this end, we log the order of the newsletter, the sending of a confirmation e-mail and receipt of the reply requested in that e-mail. No further data are collected. The data are used solely for the newsletter distribution and are not passed to any third party.
When you contact us by e-mail or by using the contact form, the information provided by you is saved for the purpose of processing the enquiry and for possible follow-up questions.
We abide by the principles of data avoidance and data economy. We therefore only save your personal data for as long as necessary to achieve the purposes named here or as envisaged by the diverse retention periods stipulated by the legislator. When the respective purpose no longer applies or after the expiry of these deadlines, the corresponding data will be restricted or deleted as a routine measure and in accordance with the statutory provisions.
This website uses Google Analytics, a web analysis service from Google Inc. (hereinafter: “Google”). Google Analytics uses what are known as “cookies”, i.e. text files, that are stored on your computer and that enable analysis of how you use the website. The information generated by cookies about your use of this website is usually transferred to a Google server in the USA and stored there. However, due to the implementation of IP anonymisation on these websites, your IP address will be truncated beforehand within the European Union member states or in other states party to the agreement on the European Economic Area. Only in exceptional circumstances, the full IP address will be transferred to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activities and to deliver other services that are associated with website use and Internet use with regards to the website operator. The IP address transmitted by your browser as part of Google Analytics is not merged with other data from Google.
In addition or as an alternative to the browser add-on, you can prevent tracking by Google Analytics on our webpages by clicking on this link Google Analytics Opt-Out-Cookie setzen. To do so, an opt-out cookie will be installed on your device. The collection of data by Google Analytics for this website and for this browser will thus be prevented in future as long as the cookie remains installed on your browser.
You have the right to receive information about the personal data stored at any time. You also have the right to correction, restriction, or, apart from the prescribed data stored to carry out a business transaction, deletion of your personal data. To do so, please contact our data protection officer. The contact details are listed below.
In order to be able to consider restricting data at any time, this data must be kept for monitoring purposes in a lock file. You can also request the deletion of the data if there is no statutory obligation of retention. If such an obligation exists, we will block your data on request. You can make changes or revoke consent by providing us with appropriate notice with effect for the future.
We reserve the right to adapt this data protection declaration occasionally so that it always corresponds to the current legal requirements or in order to implement changes to our services in the data protection declaration, e.g. during the introduction of new services. The new data protection declaration will then apply when you visit again.

References: Art. 6
 Art. 6
 art. 21
 art. 6
 art. 28
 Art. 9
 Art. 6
 Art. 6
 Art. 4