Source: https://www.ferrocontrol.de/en/data-protection-declaration/
Timestamp: 2019-04-24 14:38:24+00:00

Document:
Thank you for vis­it­ing our web­site. We are de­light­ed that you are in­ter­est­ed in our com­pa­ny and our prod­ucts / ser­vices. We take pro­tect­ing your per­son­al da­ta very se­ri­ous­ly, and we want you to feel se­cure with re­gard to the in­for­ma­tion you give us when you vis­it our web­site.
De­spite care­ful trans­la­tion, we shall not be held li­able for the ac­cu­ra­cy of the En­glish ver­sion of this web­site. In case of doubt, the Ger­man ver­sion shall pre­vail.
Personal information refers to all information that can be used to identify you personally. We process your personal information (e.g. form of address, first name, second name, postal address, e-mail address, phone number) only in accordance with the provisions of German data protection law and the European Union’s (EU) data protection law. The following is to inform you about the methods, scope and purpose of collecting, processing and using personal information.
For security reasons and in order to protect the transmission of personal information and other confident content (e.g. requests directed at the controller), this website uses SSL encryption or TLS encryption. Encrypted connections can be identified by the character sequence “https://” and the padlock icon in your browser’s address bar.
If you use our websites for information purposes only, we will collect the following information transmitted by your browser to our server (so-called server log files) in order to display our website correctly: information on the user’s browser type and version, operating system, internet service provider and IP address as well as the date and time of access, websites from which the user has accessed our website and websites accessed by the user via our website.
The web servers’ access logs track which pages were accessed at what time. They contain the following information: IP, directory protection user, date, time, pages accessed, logs, status code, data volume, referrer, user agent, host name accessed.
IP addresses are anonymized for storage by removing the final three digits, which means that 127.0.0.1 will become 127.0.0.*. IPv6 addresses will be anonymized as well. Anonymized IP addresses will be stored for 60 days. The information on the directory protection user used will be anonymized after one day.
Error logs tracking page access errors will be deleted after seven days. Beside the error messages, they contain the accessing IP address and, depending on the error, the website accessed.
The legal basis for processing information is art. 6, par. 1f, of the GDPR, pertaining to our legitimate interest in improving our website’s stability and functionality. Information will not be passed on to other parties or used for any other purpose.
The technically required cookies will usually be deleted once the browser is closed. Persistent cookies have lifespans varying from several minutes to several years.
You can set up your browser to inform you when cookies are saved, authorize cookies on a case-by-case basis, prevent the saving of cookies in specific cases or in general and activate automatic cookie deletion on closing the browser. Cookie management varies across browsers. Please note that our website’s functionally may be impaired if cookies are not accepted.
The saving of other cookies (e.g. cookies designed to analyze your surfing behavior) is regulated separately in this privacy statement.
If you contact us (e.g. by contact form or e-mail), personal information will be collected. What information is collected is clear from the contact form used. That information is only stored and used for the purpose of responding to your request, that is for establishing contact and performing the technical administration required for that purpose. The legal basis for processing data is our legitimate interest in responding to your request in accordance with art. 6, par. 1f, of the GDPR. If your contacting us has the object of concluding a contract, this constitutes an additional legal basis for processing under art. 6, par. 1b, of the GDPR. Once your request has been fully resolved, your information will be deleted if there is no legal obligation to retain it.
Right of access in accordance with art. 15 of the GDPR: You have the right of access to the personal information processed by us as well as the purpose of processing, the categories of personal information processed, the recipients or recipient categories your information is or has been disclosed to, the planned storage period or the criteria for determining the storage period, to the existence of a right to rectification, erasure, restriction of processing, objection to processing and lodging a complaint with a supervisory authority, to the source of your personal information if it was not collected by us, to information on the existence of automated decision-making, including profiling, and, where applicable, meaningful information on the logic involved and the intended consequences of such processing as well as to information on your right of access to information on what safeguards exist pursuant to art. 46 of the GDPR relating to the passing on of your information to a third country.
Right to rectification in accordance with art. 16 of the GDPR: You have the right to rectification of your personal information if it is incorrect and/or incomplete.
Right to erasure in accordance with art. 17 of the GDPR: You have the right to have your personal information deleted if one of the conditions of art. 17, par. 1, of the GDPR is met. However, this right does not apply if processing is required for the exercise of the right of freedom of expression or information, for fulfilling legal obligations, for reasons of public interest or for the establishment, exercise or defense of legal claims.
Right to restriction of processing in accordance with art. 18 of the GDPR: You have the right to have the processing of your personal information restricted for the period during which they are being verified if you demand, instead of their deletion, a restriction of the processing of your information due to inadmissible data processing, if we no longer require your information for processing purposes but you require them for establishing, exercising or defending legal claims or if you have objected to processing and no final determination has been reached whether our legitimate grounds override yours.
Right to notification in accordance with art. 19 of the GDPR: If you have exercised your right to rectification, erasure or restriction of processing vis-à-vis the controller, they have an obligation to notify all recipients to whom your personal information has been disclosed of that rectification, erasure or restriction of processing of data unless this proves impossible or requires unreasonable effort. You are entitled to be informed about the recipients.
Right to data portability in accordance with art. 20 of the GDPR: You have the right to obtain or have transferred to another controller the personal information you have provided in a structured, commonly used and machine-readable format, wherever technically feasible.
Right to withdraw consent in accordance with art. 7, par. 3, of the GDPR: You have the right to withdraw your consent to data processing, once given, at any time with effect for the future. If you withdraw it, we will delete the information concerned immediately unless there is a legal basis for further processing without consent. Withdrawing your consent does not affect the lawfulness of any processing having taken place with consent prior to withdrawal.
Right to lodge a complaint in accordance with art. 77 of the GDPR: Irrespective of other administrative or judicial remedies, you are entitled to lodge a complaint with a supervisory authority, particularly in the member state where you reside, work or where the alleged violation has taken place if you deem the processing of your personal information to violate the GDPR.
The supervisory authority with which the complaint is lodged will inform the complainant of the status and the outcome of the complaint including the option of judicial remedies in accordance with art. 78 of the GDPR.
You have the right to object at any time with effect for the future to the processing of your personal information for reasons relating to your individual situation if we process your personal information on the basis of an overriding legitimate interest on our part.
If you exercise your right of objection, we will cease to process the information concerned unless we can demonstrate that there are compelling legitimate grounds for processing overriding your interests, rights and freedoms or unless the processing serves the establishment, exercise or defense of legal claims.
If your personal information is processed for the purpose of direct advertising, you have the right to object to the processing of your personal information for such advertising at any time. This includes profiling if it takes place in the context of such direct advertising.
If you object to processing for purposes of direct advertising, your personal information will no longer be processed for those purposes.
How long personal information will be stored depends on the applicable legal retention period (e.g. retention periods under commercial and fiscal law). Once the period expires, the information concerned will be routinely deleted wherever it is no longer required for contract fulfilment or initiation and/or there is no longer any continued legitimate interest on our part for retention.

References: art. 6
 art. 6
 art. 6
 art. 15
 art. 46
 art. 16
 art. 17
 art. 17
 art. 18
 art. 19
 art. 20
 art. 7
 art. 77
 art. 78