Source: https://www.koehlerpaper.com/en/privacy-policy/
Timestamp: 2019-04-18 22:45:23+00:00

Document:
Papierfabrik August Koehler SE would like to promote user confidence in the Web and is therefore laying out its policy for handling personal data. The following section will show you what information we collect for what purposes and how we use it.
It is a matter of course for us to deal with your data carefully and to treat it as confidential. We therefore ask you to send us only serious applications and to check attached files in advance for viruses etc. before you forward them to us.
2.The provider of online content, and therefore legally responsible for data privacy, is Papierfabrik August Koehler SE, Hauptstrasse 2, 77704 Oberkirch, Germany, e-mail: nfkhlrpprcm (hereinafter referred to as “we” or “us”). For details of representatives and more contact options, please refer to our masthead: https://www.koehlerpaper.com/en/imprint/index.php.
3.Our data privacy officer can be contacted at the e-mail address: dtnschtzkhlrpprcm.
4.The term “users” used in the following includes the applicant as well as other website visitors. All terms used such as “applicants” are to be understood as gender-neutral.
1. We process the personal data of users strictly in compliance with the relevant data protection laws. This means that the data of users will only be processed if this is permitted by law, i.e., in particular, if data processing is required in order for us to perform our contractual services (e.g. process an order) and online services, where it is prescribed by law, if we have the consent of the user or if processing is based on our legitimate interests (i.e. our interest in the analysis, optimization and economic operation and security of our online service in terms of Art. 6 (1) (f) GDPR and, until the GDPR applies, on the basis of Section 15 (3) of the German Telemedia Act (TMG)), particularly with regard to measuring coverage, creating profiles for advertising and marketing purposes, collecting access data and the use of services of third-party providers.
2. With regard to the processing of personal data on the basis of the General Data Protection Regulation (GDPR), the legal basis regarding consent is Art. 6 (1) (a) and Art 7 GDPR, the legal basis for processing in order to perform our services and contractual activities is Art. 6 (1) (b) GDPR, the legal basis for processing in order to fulfill our statutory duties is Art. 6 (1) (c) GDPR and the legal basis for processing to maintain our legitimate interests is Art. 6 (1) (f) GDPR.
3. Irrespective of the aforementioned purposes, we also process your contact data (particularly your name, address and email address) within the legally permissible scope for marketing and advertising purposes, i.e. for example in order to send you information about our products, our company, special offers or events. Finally, if we have obtained your contact data in the context of a business event, a business meeting (e.g. by exchanging business cards) or an order, we also process them to manage our business contacts and transfer them to our CRM system (customer relationship management system).
As we have a legitimate economic interest in maintaining contacts established in the course of conducting business beyond the first contact, to use the same to establish a business relationship and to maintain contact with the respective persons for this purpose, the aforementioned processing of your personal data is performed on the basis of Art. 6 (1) (f) GDPR.
1.We take organizational, contractual, and technical security measures in accordance with the state of the art in order to ensure that the provisions of the data privacy laws are complied with and to ensure that the data processed by us is protected from accidental or intentional manipulation, loss, destruction, or access by unauthorized persons.
2.The security measures include, in particular, the encrypted transfer of data between your browser and our server.
1.Forwarding of data to third parties only takes place within the framework of the legal guidelines. We forward the data of users to third parties only if this is necessary, for example, for billing purposes or for other purposes if these are necessary in order to fulfill our contractual obligations vis-à-vis the users.
2.If we use subcontractors in order to provide our services, we will take appropriate legal measures and appropriate technical and organizational measures for the protection of personal data in accordance with the relevant statutory provisions.
4.Third countries are countries in which the GDPR is not directly applicable, i.e., in principle, countries outside the European Union (EU) or the European Economic Area (EEA).
5.The transfer of data to third countries is carried out if an adequate level of protection for the data, user consent, or otherwise legal permission exists.
1.We process applicant data only for the purpose and within the framework of the application procedure in accordance with the legal requirements. The processing of applicant data is carried out in order to fulfill our contractual obligations and on the basis of our legitimate interests, as well as the interests of the applicant in the implementation of a rapid and effective application process.
1.In general, we do not pass on applicant data to third parties. In the context of the application process, however, we may receive support from external service providers or other companies within our group. In this case, the service provider may also process data of the applicant. The service providers process the data of the applicant only on our behalf and on the basis of contractual obligations that stipulate compliance with the agreed-upon organizational and technical measures.
2.Furthermore, a transfer of applicant data may also occur if a position has been expressly advertised by several companies within our group, i.e. the application procedure is carried out by several companies.
3.In all other cases, we ask the applicant for permission before we share their data.
1.Applicants can submit their applications to us by using the contact form on our website. The data is transmitted in encrypted form to us in accordance with the state of the art of technology.
2.Alternatively, applicants can submit their applications to us via e-mail. In this case, however, we note that e-mails are not sent in encrypted form. We can therefore assume no responsibility for the transmission path of the application between the sender and receipt on our server. For this reason, we recommend using the online form.
3.Rather than the application via the online form or e-mail, applicants still have the opportunity to submit their application by mail.
1.In the case of a successful application, the data provided to us by the applicant can be further processed by us for the purposes of employment.
2.Otherwise, if the application for a position is not successful, the data of the applicant will be deleted. The data of the applicant will also be deleted if an application is withdrawn, which the applicant is entitled to do at any time.
3.The deletion will be carried out, subject to a justified revocation of the applicant, after the expiry of a period of six months so that we can answer any follow-up questions regarding the application and meet our obligations of proof arising from the General Act on Equal Treatment (AGG).
1. When a user makes contact with us (using the contact form, by email, in the context of an order or, for example, by exchanging business cards), the user’s information is processed for the purpose of processing the contact request and responding to the inquiry.
2. The data of users may be stored in our customer relationship management system (“CRM system”) or similar inquiry organization systems for the further maintenance of the business relationship and, as commercial correspondence, must be kept for six years, due to statutory requirements, and, in the case of statutory tax relevance, for a period of ten years.
1. Log file information is collected by the provider solely as part of monitoring.
2. For security reasons (e.g. for the elucidation of abuse or fraud), log file information is stored for a maximum of seven days and then deleted. Data whose further retention is required for evidential purposes is excluded from deletion until the final clarification of the respective incident.
2.If users do not want cookies to be stored on their computer, they are asked to disable the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional limitations of this online offer.
The software used for this purpose runs exclusively on the servers of our website. Users’ personal data is stored there only. The data is not disclosed to third parties.
The legal basis for the processing of personal data of the user is Article 6, Paragraph 1, Subparagraph F, of the GDPR.
Processing the personal data of users makes it possible for us to analyze the surfing behavior of our users. The data gained through this analysis allows us to compile information about the use of the individual components of our website. This helps us to continually improve our website and make it more user-friendly. In these purposes, we also have a legitimate interest in processing the data according to Article 6, Paragraph 1, Subparagraph F, of the GDPR. Anonymizing the IP address sufficiently takes into account the users’ interest in protecting their personal data.
1.The links/buttons to social networks and platforms (hereinafter referred to as “social media”) used within our online offer do not create a connection between social networks and the users until users click on the links/buttons and the respective networks, or their websites, are accessed. This function corresponds to the operation of a regular online link.
1.Within our online offer, and on the basis of our legitimate interests (i.e. interest in the analysis, optimization, and economic operation of our online offer within the meaning of Article 6, Paragraph 1, Subparagraph F, of the GDPR), we use content or service offerings from third-party suppliers to embed their contents and services such as videos or fonts (hereinafter referred to uniformly as “content”). This always requires that the third-party supplier of the content learn the IP address of the user, because the content can not be sent to the browser without the IP address. The IP address is therefore required for the presentation of that content. We strive to use only such content whose respective provider only uses IP addresses for delivery of the content. Furthermore, third-party suppliers may also use so-called pixel tags (invisible graphics, also known as “Web beacons”) for statistical and marketing purposes. Through the pixel tags, information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information may also be stored in cookies on the device of the user and may contain, among other things, technical information about the browser and operating system, referring websites, visit time, and other information about the use of our online offer; the information can also be connected with other information from other sources.
•	Note regarding Google Inc.: Google is certified in accordance with the EU–U.S. Privacy Shield and it provides a guarantee of compliance with the European Data Protection Regulation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
1.Users have the right to request, free of charge, to receive information about the personal data that we have stored about them. In addition, users have the right to correct incorrect data, to limit the processing and deletion of their personal data, if applicable, to assert their right to data portability, and, in the case of suspicion of unlawful data processing, to file a complaint with the competent supervisory authority (the data privacy office in the German state of Baden-Württemberg, Königstrasse 10a, 70025 Stuttgart, Germany).
2.Users can also, in general with future effect, withdraw their consent without giving reasons.
1.The data stored on our servers will be deleted as soon as it is no longer required for its intended purpose and the deletion does not violate any statutory retention obligations. If the data of the user cannot be deleted because it is required for other purposes permitted by law, the processing of this data is restricted, which means that the data is locked and cannot be used for other purposes. This applies, for example, to user data that must be retained for commercial or tax reasons.
2.In accordance with the legal requirements, retention is carried out for six years pursuant to Section 257, Paragraph 1, of the German Commercial Code (trade books, inventories, opening balances, annual financial statements, business letters, receipts, etc.) and for ten years pursuant to Section 147, Paragraph 1, of the German Fiscal Code (books, records, financial reports, receipts, trade and business letters, tax-related documents, etc.).
Users can object to the future processing of their personal data in accordance with the statutory provisions at any time without giving reasons. The objection may relate, in particular, to processing for purposes of direct marketing.

References: Art. 6
 Art. 6
 Art 7
 Art. 6
 Art. 6
 Art. 6
 Art. 6