Source: https://www.steinco.de/en/data-protection/
Timestamp: 2019-04-25 00:08:53+00:00

Document:
We are delighted that you visit our website and would like to thank you for your interest in our company. Protecting your privacy when you use our website is of considerable importance to us. Therefore, we will strictly comply with the applicable legal data protection provisions when using your personal data. In the following, we will thus provide you with information as to how personal data is collected and used when using our website.
What is personal data? The term 'personal data' is defined in the Federal Data Protection Act (BDSG / BDSG (new)) and in the General Data Protection Regulation (GDPR). Accordingly, this relates to individual information about personal or material circumstances of an identified or identifiable natural person. This thus includes, for ex., your name, address, phone number, e-mail address or date of birth.
You can visit our website without providing us with information about your identity. In this context, we do not retain any personal data. To improve our services, we solely evaluate statistical data not allowing any conclusion to be drawn on your identity. Where personal data is collected on our websites (for ex. name, address or e-mail addresses), this is always made on a voluntary basis. Such data will not be forwarded to third parties without your explicit consent.
In the following, we would like to provide you with information about the processing of your personal data by us and your entitlements and rights acc. to legal data protection regulations.
Basically, we collect and use personal data of our users only where this is required to provide a functional website and our contents and services. Personal data of our users is collected and used regularly only after the user has given its consent. An exception to this applies in cases where prior obtainment of any consent is not possible for actual reasons and data processing is permitted by legal regulations.
Where we obtain any consent from the data subject for methods of personal data processing, Art. 6(1) Point a EU General Data Protection Regulation (GDPR) serves as a legal basis for personal data processing.
If processing personal data is necessary for the performance of a contract to which the data subject is party, Art. 6(1) Point b GDPR serves as a legal basis. This also applies to processing methods required to take steps prior to entering into a contract.
Where personal data processing is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1) Point c GDPR serves as a legal basis.
If processing is necessary in order to protect the vital interests of the data subject or of another natural person, Art. 6(1) Point d GDPR serves as a legal basis.
If processing is necessary for the purposes of any legitimate interest pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, Art. 6(1) Point f GDPR serves as a legal basis for processing.
The data subject's personal data will be erased or blocked once the purpose of such retention ceases to be relevant. In addition, data may be retained if this is provided for by the European or national legislator in legal EU regulations, laws or other regulations to which the controller is subject. Data is also erased or blocked if any retention period prescribed by the aforementioned standards expires, unless there is any need to continue retaining the data to conclude or fulfil a contract.
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing terminal.
This data is likewise retained in the log files of our system. This does not include the user's IP address or other data allowing to assign the data to a user. Such data is not retained together with other personal data of the user.
The legal basis for temporary data retention is Art. 6(1) Point f GDPR.
Temporary retention of the IP address by the system is necessary to ensure that the website contents can be delivered to the user's computer. To this end, the user's IP address must remain retained for the duration of the session.
Such purposes are also the basis for our legitimate interest in data processing acc. to Art. 6(1) Point f GDPR.
The data will be erased once it is no longer required to achieve the purpose of its collection. If data is collected to provide the website, this is the case once the respective session has been terminated.
Collection of the data to provide the website and to retain the data in log files is absolutely necessary to ensure operation of the website. Consequently, the user does not have any right to object.
The users' data collected in this manner is pseudonymised by technical precautions. It is thus no longer possible to assign the data to the accessing user. The data is not retained together with other personal data of the users.
The legal basis for personal data processing using technically required cookies is Art. 6(1) Point f GDPR.
The legal basis for personal data processing using cookies for analysing purposes where the user has given its consent thereto is Art. 6(1) Point a GDPR.
Technically required cookies are used to make it easier for the users to use websites. Some functions of our website cannot be provided without using cookies. To offer such functions, it is necessary for the browser to be recognised even after a page break.
Analytical cookies are used to improve the quality and contents of our website. By using analytical cookies, we can find out how the website is used and can thus constantly enhance our services. To this end, we use the analytical cookies of Google Analytics. An order data processing contract with the provider of the analytical cookies is available.
Moreover, you can prevent data created by the cookie and related to your use of the website (incl. your IP address) from being collected by Google as well as its processing by Google by downloading and installing the browser plug-in available at the following link: tools.google.com/dlpage/gaoptout.
Such purposes are also the basis for our legitimate interest in personal data processing acc. to Art. 6(1) Point f GDPR.
Alternatively, we can be contacted using the e-mail address provided. In this case, the user's personal data transferred with the e-mail is retained.
The data is not forwarded to third parties in this context. The data is exclusively used to process the conversation.
Furthermore, our website offers a contact form for online applications which can be used to contact us electronically. If a user uses this service, the data entered in the input mask and the documents enclosed are transferred to and retained by us.
The data is not forwarded to third parties in this context. The data is exclusively used for the application process.
The legal basis for data processing where the user has given its consent thereto is Art. 6(1) Point a GDPR.
The legal basis for the processing of data in the course of sending an e-mail is Art. 6(1) Point f GDPR. If the e-mail contact is aimed at concluding a contract, an additional legal basis for processing is Art. 6(1) Point b GDPR.
We process personal data from the input mask only to process the establishment of contact and/or application. Any contact established by e-mail thus also forms the basis for the necessary legitimate interest in data processing.
The other personal data processed during the sending process is used to avoid any misuse of the contact form and to ensure an adequate level of security for our IT systems.
The data will be erased once it is no longer required to achieve the purpose of its collection. This applies to the personal data from the input mask of the contact form and to personal data provided by e-mail if the respective conversation with the user has been terminated. The conversation is deemed terminated once it becomes clear from the circumstances that the relevant issue has been conclusively resolved.
The personal data additionally collected during the sending process is deleted after a period of seven days at the latest.
The user can withdraw its consent to personal data processing at any time. If the user contacts us by e-mail, it may object to the retention of its personal data at any time. In such a case, the conversation cannot be continued. Further conversation in this case will only be possible by mail. In this case, all of the personal data retained in the course of the establishment of contact will be erased.
You can request a confirmation from the controller as to whether we process personal data related to you.
You have the right to get access to information as to whether your personal data is transferred in a third country or to an international organisation. In this context, you can request to be notified of appropriate safeguards acc. to Art. 46 GDPR in connection with the transfer.
You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data related to you is incorrect or incomplete. The controller must perform rectification immediately.
You challenge the accuracy of your personal data for a period enabling the controller to verify the accuracy of such personal data.
Processing is unlawful and you refuse erasure of the personal data, requesting instead that use of the personal data be restricted.
The controller does no longer require the personal data for processing purposes, but you need it for the establishment, exercise or defence of legal claims.
You have objected to processing acc. to Art. 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of you.
If processing of your personal data has been restricted, such data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
If processing has been restricted according to the conditions above, you will be informed by the controller before the restriction of processing is lifted.
You withdraw your consent on which processing is based acc. to Art. 6(1) Point (a) or Art. 9(2) Point a GDPR, and there is no other legal ground for processing.
You object to processing acc. to Art. 21(1) and there are no overriding legitimate grounds for processing, or you object to processing acc. to Art. 21(2) GDPR.
Your personal data has been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.
Where the controller has made your personal data public and is obliged acc. to Art. 17(1) GDPR to erase it, the controller, taking account of available technology and the cost of implementation, takes reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, such personal data.
If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis the controller, the latter is obliged to notify all recipients, to whom your personal data have been disclosed, of such rectification or erasure of the data or restriction of processing, unless this turns out to be impossible or produces unreasonable burdens.
In exercising such right, you further have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.
You have the right to object, on grounds relating to your particular situation, at any time to any processing of your personal data which is based on Art. 6(1) Point e or f GDPR, including profiling based on those provisions.
The controller no longer processes your personal data, unless the controller demonstrates compelling legitimate grounds for processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Where your personal data is processed for direct marketing purposes, you have the right to object at any time to any processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
You have the right to withdraw at any time your consent given under privacy law. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
Nevertheless, such decisions must not be based on special categories of personal data referred to in Art. 9(1) GDPR, unless Art. 9(2) Point a or g applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 8
 Art. 17
 Art. 6
 Art. 9
 Art. 9