Source: http://www.drilltec.de/en/quicklinks/data-protection.html
Timestamp: 2019-04-20 21:26:23+00:00

Document:
Personal data means any information relating to an identified or identifiable natural person (“data subject”). And identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data subject is any identified or identifiable natural person, whose personal data is processed by the controller.
Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
In principle, we process personal data of our users only as far as this is necessary to provide a functioning website and our content and services. The processing of personal data of our users takes place regularly only with the consent of the user. An exception applies to cases in which prior consent cannot be obtained for reasons of fact and the processing of the data is permitted by law.
Insofar as we obtain the consent of the data subject for processing of personal data, Art. 6 para. 1 lit. a EU General Data Protection Regulation (GDPR) is legal basis. In the processing of personal data necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR is legal basis. This also applies to processing operations required to carry out pre-contractual actions. Insofar as processing of personal data is required to fulfill a legal obligation that is subject to our company, Art. 6 para. 1 lit. c GDPR is legal basis. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR is legal basis. If processing is necessary to safeguard the legitimate interests of our company or a third party, and if the interests, fundamental rights and freedoms of the data subject do not prevail over the first interest, Art. 6 para. 1 lit. f GDPR is legal basis for processing.
The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage is no longer applicable. Such storage may be done if this is stipulated by the European or national legislator in EU regulations, laws or other regulations to which the controller is subject. Blocking or deletion of the data also takes place if a storage period prescribed by the standards mentioned expires, unless there is a need for further storage of the data for conclusion of a contract or fulfillment of the contract.
Storage in log files is done to ensure the functionality of the website. In addition, the data is used to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context. Within these purposes, there is our legitimate interest in the processing of data according to Art. 6 para. 1 lit. f GDPR.
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. In the case of collecting the data for providing the website, this is the case when the respective session is terminated. In case of storing the data in log files, this is the case after no more than seven days. An additional storage is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible.
Collection of data for the provision of the website and the storage of the data in log files is essential for the operation of the website. There is consequently no possibility to object and erase on the part of the user.
The legal basis for the processing of personal data using technically necessary cookies is Article 6 para. 1 lit. f GDPR. The legal basis for the processing of personal data using cookies for analysis purposes is Art. 6 para. 1 lit a GDPR, in case of the user’s consent.
The use of the analysis cookies is for the purpose of improving the quality of our website and its contents. Analysis cookies help us understand how the website is being used, so we can use usage patterns and structures to continually improve our offerings and website by improving content or personalization and making it easier to use. Within these purposes, there is our legitimate interest in the processing of data according to Art. 6 para. 1 lit. f GDPR.
For the processing of personal data in the context of the sending process your consent is obtained and referred to this privacy statement. Alternatively, contact via the provided e-mail address is possible. In this case, the user´s personal data transmitted via e-mail will be stored. In this context, there is no disclosure of personal data to third parties. The personal data will be used exclusively for processing the conversation.
The legal basis for the processing of personal data is Art. 6 para. 1 lit. a GDPR, in case of the user’s consent.
The legal basis for the processing of the personal data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit. f GDPR. If the e-mail contact aims the conclusion of a contract, then additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.
The processing of the personal data from the input mask serves only to process the contact. In case of contact via e-mail, there is our legitimate interest in the processing of data. Any other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. For personal data from the input form of the contact form and those sent via e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the relevant facts have been finally clarified. The additional personal data collected during the sending process will be deleted at the latest after a period of seven days.
The user has the possibility at any time to revoke his/her consent to the processing of the personal data. If the user contacts us via e-mail, he/she may object to the storage of personal data at any time. In this case, the conversation cannot be continued. A notification to the contact details mentioned in point I (e.g. e-mail, fax, letter) is sufficient for the revocation of your consent and the objection of storage. All personal data stored in the course of contacting will be deleted in this case.
Data is transferred regardless of whether YouTube provides a user account that you are logged in to or whether there is no user account. When you're logged in to YouTube, your data will be assigned directly to your account. If you do not wish to be associated with your profile on YouTube, you must log out before activating the button.
For information about the legal basis for the processing of data by YouTube, please refer to the privacy statements.
YouTube stores your data as user profiles and uses them for purposes of advertising, market research and / or tailor-made website design. Such an evaluation is done in particular (even for users who are not logged in) to provide appropriate advertising and to inform other users of the social network about their activities on our website.
We have no influence on the collected data and data processing operations, nor are we aware of the full extent of data collection, the purpose of the processing, the retention periods. We also have no information about the deletion process regarding the data collected by YouTube.
You have a right of objection to the formation of user profiles, whereby you must be directed to YouTube in order to exercise it.
Data is transferred regardless of whether Google provides a user account that you are logged in to or whether there is no user account. When you're logged in to Google, your data will be assigned directly to your account. If you do not wish to be associated with your profile on Google, you must log out before activating the button.
For information about the legal basis for the processing of data by Google, please refer to the privacy statements of the plug-in provider.
Google stores your data as user profiles and uses them for purposes of advertising, market research and / or tailor-made website design. Such an evaluation is done in particular (even for users who are not logged in) to provide appropriate advertising and to inform other users of the social network about their activities on our website.
We have no influence on the collected data and data processing operations, nor are we aware of the full extent of data collection, the purpose of the processing, the retention periods. We also have no information about the deletion process regarding the data collected by the plug-in provider.
You have a right of objection to the formation of user profiles, whereby you must be directed to Google in order to exercise it.
You have the right to ask the controller in charge to confirm if personal data concerning you is processed by us.
(8) the existence of automated decision-making, including profiling, referred to in Article 22 (1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
Furthermore you shall have the right to obtain information as to whether personal data are transferred to a third country or to an international organisation. Where this is the case, you shall have the right to be informed of the appropriate safeguards according to Art. 46 GDPR relating to the transfer.
You have a right to rectification and / or completion to the controller, if the processed personal data about you is incorrect or incomplete. The controller must make the rectification without delay.
(3) the controller no longer needs the personal data for the purpose of the processing, but they are required by you for the establishment, exercise or defence of legal claims.
(4) you have objected to processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override yours.
If the processing of personal data concerning you has been restricted, this data may only be used - with the exception of its storage - with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State. If the processing has been restricted in accordance with the above conditions, you will be notified by the controller before the restriction is lifted.
(5) the personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
(6) the personal data have been collected in relation to the offer of information society services referred to in Art. 8 para. 1 GDPR.
Where the controller has made personal data public and is obliged pursuant to Art. 17 para. 1 GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that you as the data subject have requested erasure by such controllers of any links to, or copy or replication of, those personal data.
If you have asserted the right of rectification, erasure or restriction of processing to the controller, he / she is obliged to notify all recipients to whom your personal data have been disclosed of this rectification or erasure of the data or restriction of processing, unless: this proves to be impossible or involves a disproportionate effort. You have a right to the controller to be informed about these recipients.
Furthermore, in exercising your right to data portability you shall have the right to have personal data transmitted directly from one controller to another, where technically feasible and when doing so does not adversely affect the rights and freedoms of others. The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority delegated to the controller.
You have the right to object, on grounds relating to your particular situation, at any time, to processing of personal data concerning you, which is based on Art. 6 para. 1 lit. e or lit. f GDPR; this also applies to profiling based on these provisions. The controller shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. If the controller processes personal data for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing. This applies to profiling to the extent that it is related to such direct marketing. If you object to the controller to the processing for direct marketing purposes, we will no longer process the personal data for these purposes. You are free in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to use your right to object by automated means using technical specifications.
You have the right to withdraw your consent to processing your personal data at any time.
The withdrawal of consent does not affect the legality of the processing carried out on the basis of the consent until the withdrawal.
However, these decisions must not be based on special categories of personal data under Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a or g GDPR applies and reasonable measures have been taken to protect the rights and freedoms as well as your legitimate interests. With regard to the cases referred to in (1) and (3), the controller shall take appropriate measures to uphold the rights and freedoms and their legitimate interests, including at least the right to obtain the intervention of a person on the part of the controller, the right to express his / her own position and the right to challenge the decision.
Without prejudice to any other administrative or judicial remedy, you shall have the right to complain to a supervisory authority, in particular in the Member State of your place of residence, employment or the place of alleged infringement, if you believe that the processing of the personal data concerning you violates the regulations of GDPR. The supervisory authority to which the complaint has been submitted shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 46
 Art. 21
 Art. 8
 Art. 17
 Art. 6
 Art. 9
 Art. 9
 Art. 78